rare.zip
- SHA256 fc3e50225f78710a6e66912d4fa18431ec644fb1a200a1573c293ebe0ea6e6ca
Static task
static1
Behavioral task
behavioral1
Sample
RobloxPlayerInstaller.exe
Resource
win7-20240611-en
windows7-x64
1 signatures
150 seconds
General
- Target rare.zip
- Size 2.6MB
- Sample240620-rfjvca1frf
- SHA256 fc3e50225f78710a6e66912d4fa18431ec644fb1a200a1573c293ebe0ea6e6ca
- MD5 73570c55c8b1d3c6cef317a51fba407d
- SHA1 27b607a7f77a88c94eb90f6d2c9343cc7f26d454
- SHA512 07b200da1569dcacb7ee168a46241bf453f0bb55c1f5606094df547104ae4d7b93e9e15d0e23e955afd24245d3ee6356ee2de753536fb2479d308e10498615b5
- SSDEEP 49152:/1FDoiW7Ys1joBiJNPoxWpRuRtFr8jdVqr1lWKu+I2I03xuLGXHa:/1ZVWn1/ctFrQ81lWKP0LQ6
- MD5 SHA1 SHA512 SSDEEP
Score
1/10
Malware Config
Signatures
File Explorer
-
rare.zip.zip 2.6MB
-
RobloxPlayerInstaller.exe.exe 5.7MB
RobloxPlayerInstaller.exe
- IMPHASH d81272b214a55b9744a6eb766add6c97
- SHA256 a65dd1ed5b9c447a7e3e2dab559478e5fb3ad7a610152c1792fd4b1f4b3a7290
- MD5 c484a17ffc8468f2815c0798a53427b8
- SHA1 a73a6fe8d32cfead5b39073488e3d161fb0df1ef
- SHA512 be82caf808a70746f6bc95401536229643ee5d22f0d5689d2e6207191d5593b67890e46fc462de9ba24f897c01ef701b9bd78cd20cb65893544cb2c9053c196d
- SSDEEP 98304:anvCdBAtAOZPKZvf2H2dDgl3UZqPKCRAvMcCLSbuPr+75RF:CYAdumYglHpRpc8aSrWr
- MD5 SHA1 SHA512 SSDEEP
PE Signature issue
Digest
11:22:68:f6:57:da:8b:55:94:7e:fb:e1:7b:94:b4:fd:65:94:a6:98:c1:3c:77:96:4f:8c:a1:79:53:bc:11:a2
Digest Algorithm
sha256
PE Digests Matches
Not matched
Trusted
Not trusted
Signing Certificate
SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Chains
Jan 1, 0001
Subject
SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553
Serial Number
0d:af:ec:46:d2:b7:34:a6:7f:4e:ad:75:7c:0b:c9:6b
Issuer
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Feb 13, 2024 - Feb 12, 2025
Subject
CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US
Serial Number
08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Apr 29, 2021 - Apr 28, 2036
Subject
CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US
Serial Number
05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16
Issuer
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Jul 14, 2023 - Oct 13, 2034
Subject
CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US
Serial Number
07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Timespan
Mar 23, 2022 - Mar 22, 2037
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
3048944
Magic Number
267
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB paths
C:\buildAgent\work\ci_deploy_ninja_boot-x86_git\build.ninja\common\vs2019\x86\release\Installer\Windows\RobloxPlayerInstaller.pdb
comctl32
_TrackMouseEvent
InitCommonControlsEx
gdiplus
GdipFree
GdiplusStartup
GdiplusShutdown
GdipCloneImage
GdipDisposeImage
GdipCreateBitmapFromStream
GdipAlloc
GdipCreateHBITMAPFromBitmap
wininet
InternetReadFile
InternetConnectW
InternetQueryOptionW
HttpOpenRequestW
HttpAddRequestHeadersW
InternetCloseHandle
HttpSendRequestW
HttpQueryInfoW
InternetOpenW
InternetQueryDataAvailable
bcrypt
BCryptGenRandom
advapi32
EqualSid
CryptEnumProvidersW
CryptSignHashW
CryptDecrypt
CopySid
RegDeleteTreeW
RegQueryValueExW
RegQueryInfoKeyW
RegEnumKeyExW
IsValidSid
GetTokenInformation
SystemFunction036
DeregisterEventSource
RegisterEventSourceW
ReportEventW
CryptSetHashParam
CryptGetProvParam
CryptGetUserKey
GetLengthSid
CryptExportKey
GetUserNameW
CryptAcquireContextW
CryptReleaseContext
CryptGetHashParam
CryptCreateHash
CryptHashData
CryptDestroyHash
RegCloseKey
RegCreateKeyExW
RegDeleteValueW
RegOpenKeyExW
RegSetValueExW
RegGetValueW
AllocateAndInitializeSid
RegOpenKeyExA
RegQueryValueExA
CryptDestroyKey
OpenProcessToken
FreeSid
shell32
Shell_NotifyIconW
ShellExecuteExW
SHGetKnownFolderPath
SHGetFolderPathAndSubDirW
iphlpapi
GetAdaptersAddresses
ws2_32
connect
__WSAFDIsSet
WSAIoctl
inet_pton
WSAGetLastError
freeaddrinfo
WSACreateEvent
WSACloseEvent
getsockopt
htonl
WSASetLastError
WSACleanup
WSAStartup
setsockopt
send
select
recv
listen
htons
getsockname
closesocket
bind
accept
inet_ntop
socket
ntohs
ntohl
ioctlsocket
getnameinfo
gethostname
getaddrinfo
crypt32
CertCloseStore
CertEnumCertificatesInStore
CertFreeCertificateContext
CertGetEnhancedKeyUsage
CertGetIntendedKeyUsage
CertOpenSystemStoreA
CertOpenStore
CertFindCertificateInStore
CertDuplicateCertificateContext
CertGetCertificateContextProperty
kernel32
GetStringTypeW
GetLocaleInfoEx
GetCPInfo
InitializeSListHead
LCMapStringEx
EncodePointer
InitOnceComplete
InitOnceBeginInitialize
SleepConditionVariableSRW
SleepConditionVariableCS
WakeAllConditionVariable
WakeConditionVariable
InitializeConditionVariable
GetStartupInfoW
RtlUnwind
InterlockedPushEntrySList
GetCommandLineA
CreateThread
ExitThread
FreeLibraryAndExitThread
GetConsoleOutputCP
IsProcessorFeaturePresent
SetStdHandle
HeapSize
TryEnterCriticalSection
InitializeSRWLock
GetExitCodeThread
GetDriveTypeW
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
SetConsoleCtrlHandler
IsDebuggerPresent
DebugBreak
OutputDebugStringW
CloseHandle
GetLastError
SetLastError
HeapAlloc
HeapFree
GetProcessHeap
ReleaseSemaphore
ReleaseMutex
WaitForSingleObject
WaitForSingleObjectEx
OpenSemaphoreW
CreateMutexExW
CreateSemaphoreExW
GetCurrentProcessId
GetCurrentThreadId
GetModuleFileNameA
GetModuleHandleW
GetModuleHandleExW
GetProcAddress
FormatMessageW
SetSearchPathMode
GetCommandLineW
VerSetConditionMask
GetDiskFreeSpaceExW
CreateFileMappingW
VerifyVersionInfoW
MulDiv
ExitProcess
GetUserDefaultLocaleName
Sleep
FindClose
FindFirstFileW
FindNextFileW
SetUnhandledExceptionFilter
SetEvent
CreateEventW
OpenEventW
CreateProcessW
GetSystemTime
CreateFileW
GetFileSize
MapViewOfFile
UnmapViewOfFile
DeleteFileW
TerminateProcess
InitializeProcThreadAttributeList
UpdateProcThreadAttribute
OpenProcess
GetModuleFileNameW
SystemTimeToFileTime
CreateToolhelp32Snapshot
Process32FirstW
Process32NextW
K32GetModuleFileNameExW
GetCurrentProcess
GetCurrentProcessorNumber
GlobalMemoryStatusEx
GetSystemInfo
GetSystemTimeAsFileTime
GetVersionExA
IsWow64Process
LoadLibraryA
K32GetProcessMemoryInfo
GetModuleHandleA
OutputDebugStringA
QueryPerformanceCounter
QueryPerformanceFrequency
CreateEventA
SwitchToThread
MultiByteToWideChar
WideCharToMultiByte
GetNativeSystemInfo
LoadLibraryExW
FileTimeToSystemTime
VirtualQuery
RaiseException
GetCurrentThread
LoadLibraryW
DecodePointer
InitializeCriticalSectionEx
DeleteCriticalSection
CreateSemaphoreA
DuplicateHandle
GetTickCount
WaitForMultipleObjectsEx
GetExitCodeProcess
LocalAlloc
LocalFree
FindResourceExW
LoadResource
LockResource
SizeofResource
FindResourceW
GlobalAlloc
GlobalFree
GlobalUnlock
GlobalLock
CreateDirectoryW
GetFileAttributesW
GetFileSizeEx
ReadFile
RemoveDirectoryW
SetFileAttributesW
WriteFile
CopyFileW
CompareStringEx
FreeLibrary
GetEnvironmentVariableW
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
EnterCriticalSection
LeaveCriticalSection
GetSystemDirectoryA
MoveFileExA
CompareFileTime
GetEnvironmentVariableA
SleepEx
VirtualAlloc
ReleaseSRWLockShared
AcquireSRWLockShared
FormatMessageA
GetCurrentDirectoryW
GetFileAttributesExW
GetFileInformationByHandle
GetFileTime
GetFullPathNameW
SetEndOfFile
SetFilePointerEx
SetFileTime
GetTempPathW
DeviceIoControl
MoveFileExW
ResetEvent
SetWaitableTimer
ResumeThread
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
CreateWaitableTimerA
AreFileApisANSI
InitializeCriticalSection
GetStdHandle
GetConsoleMode
SetConsoleMode
ReadConsoleA
ReadConsoleW
InitializeCriticalSectionAndSpinCount
SwitchToFiber
DeleteFiber
CreateFiber
GetFileType
ConvertFiberToThread
ConvertThreadToFiber
GetTimeZoneInformation
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
UnhandledExceptionFilter
EnumSystemLocalesW
FlushFileBuffers
HeapReAlloc
FindFirstFileExW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
WriteConsoleW
GetFinalPathNameByHandleW
LocaleNameToLCID
user32
GetWindowRect
InvalidateRect
EndPaint
BeginPaint
GetDC
DrawTextW
GetSystemMetrics
EnableWindow
KillTimer
SetTimer
TranslateAcceleratorW
FillRect
ShowWindow
DestroyWindow
GetShellWindow
GetUserObjectInformationW
GetProcessWindowStation
LoadBitmapW
GetWindowLongW
LoadAcceleratorsW
MessageBoxW
SendMessageW
DefWindowProcW
DispatchMessageW
TranslateMessage
GetMessageW
DestroyIcon
LoadIconW
EnumDisplayDevicesA
GetWindowThreadProcessId
GetDlgItem
PostQuitMessage
CallWindowProcW
RegisterClassW
CreateWindowExW
SetWindowLongW
GetDlgCtrlID
gdi32
CreateSolidBrush
CreatePen
DeleteDC
DeleteObject
GetDeviceCaps
GetStockObject
Rectangle
RoundRect
SelectObject
SetDCBrushColor
SetDCPenColor
SetBkMode
SetTextColor
CreateFontW
ole32
CoInitializeEx
StringFromGUID2
CoCreateInstance
CoUninitialize
CoInitialize
CoTaskMemFree
CoCreateGuid
CoTaskMemAlloc
shlwapi
PathFindExtensionW
PathFindFileNameW
ord12
powrprof
CallNtPowerInformation
winmm
timeGetTime
timeGetDevCaps
timeBeginPeriod
timeSetEvent
Name
.text
Size
3.2MB
Virtual Size
3.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
919KB
Virtual Size
918KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
777KB
Virtual Size
13.1MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
368KB
Virtual Size
368KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
472KB
Virtual Size
472KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=29, id=259, version=29395,
count=206, id=261, version=29395,
count=7, id=253, version=28518,
count=21, id=260, version=30034,
count=27, id=259, version=30034,
count=93, id=261, version=30034,
count=2, id=253, version=23601,
count=33, id=260, version=29395,
count=559, id=260, version=24245,
count=1, id=262, version=29395,
count=127, id=260, version=30154,
count=27, productName=Unmarked objects (old),
count=41, id=257, version=29395,
count=464, id=1, productName=Unmarked objects,
count=182, id=261, version=30154,
count=1, id=255, version=30154,
count=1, id=151,
count=1, id=258, version=30154,