C:\Cobalt\src\Installer\BootstrapperClient\bin\Release\BootstrapperClient.pdb
Static task
static1
Behavioral task
behavioral1
Sample
RobloxPlayerLauncher.exe
Resource
win11-20240611-en
General
-
Target
RobloxPlayerLauncher.exe
-
Size
884KB
-
MD5
e08730e0e3ee36a477cda966403acd1a
-
SHA1
9cbdb2886acd340c11cb70235655192605e72fd6
-
SHA256
4516b047f0e42c7da52071c388602ca575af53944d869aee5e687ce6eefe6f84
-
SHA512
958324fdd4fc82cda708f58de058767f309d6df50f9746738f62187bd932b71eb1d20869ff62dc7237ce9bcd8afdd6386c2b5c16734e304c5fad347b695da715
-
SSDEEP
12288:Vc7BKHlWKdQ10neuMpsUhRF55g+BqeWaTsS+6bS+EMDk7l:Vc7C1Q10neuUsUhRFjCaTU6W+EMDk7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource RobloxPlayerLauncher.exe
Files
-
RobloxPlayerLauncher.exe.exe windows:6 windows x86 arch:x86
8d51726692e9479f1628286a22526f28
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
kernel32
CreateDirectoryW
GetDiskFreeSpaceExW
GetTempPathW
DeleteFileW
GetVersionExW
lstrcmpW
GetProcAddress
GetModuleHandleW
GetModuleFileNameW
WaitForSingleObject
InterlockedDecrement
ReleaseMutex
CreateMutexW
SetEvent
ResetEvent
OpenEventW
CreateEventW
CloseHandle
CreateEventA
GetSystemTime
GetLastError
FindNextFileW
FindFirstFileW
CompareFileTime
GetGeoInfoW
GetUserGeoID
TerminateProcess
RaiseException
CreateProcessW
FreeLibrary
LoadLibraryW
DuplicateHandle
GetCurrentThread
GetCurrentProcess
GetCurrentThreadId
OpenProcess
LocalFree
ReleaseSemaphore
GetSystemTimeAsFileTime
HeapFree
GetProcessHeap
HeapAlloc
CreateSemaphoreA
GetModuleHandleA
GetTickCount
TlsFree
FindResourceExW
FindResourceW
LoadResource
LockResource
SizeofResource
TlsSetValue
TlsGetValue
Sleep
VerifyVersionInfoW
VerSetConditionMask
SetLastError
InterlockedCompareExchange
GetQueuedCompletionStatus
SetWaitableTimer
CreateIoCompletionPort
PostQueuedCompletionStatus
SleepEx
QueueUserAPC
TerminateThread
WaitForMultipleObjects
InterlockedExchangeAdd
InterlockedExchange
TlsAlloc
LeaveCriticalSection
EnterCriticalSection
DeleteCriticalSection
InterlockedIncrement
GetLocalTime
lstrlenW
RemoveDirectoryW
CreateFileMappingW
MapViewOfFile
MultiByteToWideChar
InitializeCriticalSectionAndSpinCount
FindClose
UnmapViewOfFile
GetShortPathNameW
FormatMessageW
CreateFileW
GetFileAttributesW
GetFileAttributesExW
GetFileSizeEx
MulDiv
WaitForSingleObjectEx
GetExitCodeProcess
lstrcpyW
lstrcatW
WriteFile
GetFileTime
DosDateTimeToFileTime
LocalFileTimeToFileTime
SetFileTime
HeapDestroy
HeapReAlloc
HeapSize
EncodePointer
DecodePointer
IsDebuggerPresent
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
FormatMessageA
OpenEventA
ResumeThread
CreateWaitableTimerA
SystemTimeToFileTime
WideCharToMultiByte
SetFileAttributesW
user32
CreateWindowExW
SetWindowLongW
ShowWindow
InvalidateRect
CallWindowProcW
GetParent
SetWindowTextW
LoadAcceleratorsW
GetMessageW
TranslateAcceleratorW
TranslateMessage
DispatchMessageW
SetFocus
GetWindowRect
MessageBoxW
PostThreadMessageW
GetWindowThreadProcessId
LoadBitmapW
GetDlgItem
PostQuitMessage
BeginPaint
FillRect
EndPaint
LoadIconW
RegisterClassW
GetSystemMetrics
SendMessageW
ReleaseDC
SetTimer
KillTimer
DestroyWindow
EnableWindow
IsWindowVisible
SetForegroundWindow
PostMessageW
GetDC
EnumWindows
DefWindowProcW
GetWindowLongW
AllowSetForegroundWindow
CharNextW
CharUpperW
MessageBoxA
SetWindowPos
GetWindowTextW
gdi32
Rectangle
SelectObject
CreatePen
GetStockObject
GetDeviceCaps
CreateSolidBrush
DeleteObject
SetBkMode
CreateFontW
SetTextColor
advapi32
GetUserNameW
RegDeleteKeyW
RegEnumKeyExW
RegDeleteValueW
RegFlushKey
CryptAcquireContextW
CryptCreateHash
CryptReleaseContext
CryptDestroyHash
IsValidSid
GetLengthSid
CopySid
OpenProcessToken
OpenThreadToken
GetSidLengthRequired
InitializeSid
GetSidSubAuthority
CheckTokenMembership
DuplicateToken
RegCloseKey
RegSetValueExW
RegCreateKeyExW
RegQueryValueExW
RegOpenKeyExW
GetTokenInformation
CryptGetHashParam
CryptHashData
shell32
ShellExecuteW
ShellExecuteExW
SHGetFolderPathAndSubDirW
ole32
CoInitialize
CoCreateInstance
CoCreateGuid
CoUninitialize
StringFromGUID2
oleaut32
VariantClear
VariantInit
RegisterTypeLi
SysFreeString
SysAllocString
shlwapi
StrRChrW
StrCpyW
StrDupW
StrCmpNW
PathAddBackslashW
StrCmpW
PathFileExistsW
StrStrW
SHDeleteKeyW
msvcp110
?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHXZ
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE_N_N@Z
?_Getcvt@_Locinfo@std@@QBE?AU_Cvtvec@@XZ
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@_JHH@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE?AV?$fpos@H@2@V32@H@Z
?_Gettrue@_Locinfo@std@@QBEPBDXZ
?_Getfalse@_Locinfo@std@@QBEPBDXZ
?_Getlconv@_Locinfo@std@@QBEPBUlconv@@XZ
?id@?$numpunct@D@std@@2V0locale@2@A
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@_JH@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@PAD_J@Z
??5?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV01@AAI@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?tellp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE?AV?$fpos@H@2@XZ
?seekp@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@PBD_J@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@K@Z
_Mbrtowc
?_Fiopen@std@@YAPAU_iobuf@@PBDHH@Z
?id@?$numpunct@_W@std@@2V0locale@2@A
?_Add_vtordisp2@?$basic_ios@DU?$char_traits@D@std@@@std@@UAEXXZ
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEAAV12@V?$fpos@H@2@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_J@Z
?_Syserror_map@std@@YAPBDH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?uncaught_exception@std@@YA_NXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_BADOFF@std@@3_JB
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Add_vtordisp1@?$basic_istream@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UAE@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?_Add_vtordisp2@?$basic_ostream@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UAE@XZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0_Lockit@std@@QAE@H@Z
??1_Lockit@std@@QAE@XZ
?_Getgloballocale@locale@std@@CAPAV_Locimp@12@XZ
?_Fiopen@std@@YAPAU_iobuf@@PB_WHH@Z
?id@?$codecvt@DDH@std@@2V0locale@2@A
?_Getcat@?$codecvt@DDH@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QBE?AVlocale@2@XZ
?unshift@?$codecvt@DDH@std@@QBEHAAHPAD1AAPAD@Z
?_Gndec@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
?out@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
?in@?$codecvt@DDH@std@@QBEHAAHPBD1AAPBDPAD3AAPAD@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?_Add_vtordisp1@?$basic_ios@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEXXZ
?always_noconv@codecvt_base@std@@QBE_NXZ
??Bid@locale@std@@QAEIXZ
?classic@locale@std@@SAABV12@XZ
??_7_Facet_base@std@@6B@
?_Decref@facet@locale@std@@UAEPAV_Facet_base@3@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
?_Winerror_map@std@@YAPBDH@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?getloc@ios_base@std@@QBE?AVlocale@2@XZ
?_Incref@facet@locale@std@@UAEXXZ
?_Getcat@?$ctype@D@std@@SAIPAPBVfacet@locale@2@PBV42@@Z
??1_Locinfo@std@@QAE@XZ
??0_Locinfo@std@@QAE@PBD@Z
??1facet@locale@std@@MAE@XZ
??_7facet@locale@std@@6B@
??0facet@locale@std@@IAE@I@Z
?id@?$ctype@D@std@@2V0locale@2@A
?_Init@locale@std@@CAPAV_Locimp@12@_N@Z
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??_D?$basic_istream@DU?$char_traits@D@std@@@std@@QAEXXZ
msvcr110
_except_handler4_common
__crtSetUnhandledExceptionFilter
_invoke_watson
_controlfp_s
__crtTerminateProcess
__crtUnhandledException
_crt_debugger_hook
_vsnprintf_s
_commode
_fmode
_wcmdln
_initterm
_initterm_e
__setusermatherr
_configthreadlocale
_cexit
_exit
exit
__set_app_type
_amsg_exit
__crtGetShowWindowMode
_XcptFilter
??1type_info@@UAE@XZ
_onexit
__dllonexit
_calloc_crt
_unlock
_lock
?terminate@@YAXXZ
memset
fseek
ftell
ferror
fread
strcpy_s
fopen
wcsstr
ispunct
vswprintf_s
_getpid
__wargv
__argc
wcstombs_s
srand
wcscat_s
wcscpy_s
realloc
_time64
_gmtime64
isspace
_beginthreadex
isdigit
tolower
??0exception@std@@QAE@XZ
_vscprintf
_vsnwprintf_s
memchr
_vscwprintf
atoi
??1bad_cast@std@@UAE@XZ
??0bad_cast@std@@QAE@ABV01@@Z
??0bad_cast@std@@QAE@PBD@Z
fclose
fflush
setvbuf
fsetpos
fgetpos
_fseeki64
fwrite
_unlock_file
_lock_file
ungetc
fputc
fgetc
??8type_info@@QBE_NABV0@@Z
?what@exception@std@@UBEPBDXZ
??0exception@std@@QAE@ABV01@@Z
rand
??0exception@std@@QAE@ABQBDH@Z
??1exception@std@@UAE@XZ
??0exception@std@@QAE@ABQBD@Z
longjmp
??2@YAPAXI@Z
memcpy_s
_purecall
??_V@YAXPAX@Z
_recalloc
wcsnlen
malloc
calloc
free
wmemcpy_s
_wtoi
memmove
sprintf_s
wcsncpy_s
_wcsicmp
??3@YAXPAX@Z
__wgetmainargs
strerror
_CxxThrowException
__CxxFrameHandler3
memcpy
_setjmp3
memmove_s
memcmp
version
VerQueryValueW
GetFileVersionInfoW
GetFileVersionInfoSizeW
ws2_32
WSASend
WSARecv
setsockopt
WSAGetLastError
getaddrinfo
getsockopt
WSASetLastError
select
ioctlsocket
closesocket
WSACleanup
freeaddrinfo
connect
WSAStartup
WSASocketW
wininet
HttpSendRequestExW
InternetReadFile
InternetConnectW
InternetOpenW
InternetQueryDataAvailable
InternetCloseHandle
HttpOpenRequestW
HttpAddRequestHeadersW
HttpSendRequestW
HttpQueryInfoW
HttpEndRequestW
InternetWriteFile
InternetSetOptionW
sensapi
IsNetworkAlive
userenv
UnloadUserProfile
comctl32
_TrackMouseEvent
InitCommonControlsEx
psapi
GetProcessImageFileNameW
EnumProcesses
iphlpapi
GetAdaptersInfo
Sections
.text Size: 290KB - Virtual size: 289KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 126KB - Virtual size: 126KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 34KB - Virtual size: 35KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 2B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 388KB - Virtual size: 388KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 44KB - Virtual size: 43KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ