Roblox Audio Downloader[.]exe

Sharing

Copy URL Twitter E-mail

General

Target

Roblox Audio Downloader.exe
Size

463KB
MD5

4c8e78129d660a270dfae0a950e31ed1
SHA1

8f68fb04e4d953361c2ad85d3f94eea812e3fe39
SHA256

36c9d5d4f2a78752219ecc7a4f396e1723962f28df0a46e810f02262b4689b3d
SHA512

9e61c65963de392c32cd5c811a88bf65b5b43a455191ec91116b09854480d5353fc26f3512b565d456e31ff779457c07842518f9618b72ee9a7fe676cdcdb3ac
SSDEEP

6144:8/VbY7lIQzxgx5oYp9fHLNQt8Cwv2SSf4xewJfe8yYsdAVeX8zQUipJ/aybkuBwv:89s7lIQzxgDpPQXffWeM1lQVfTxyiCr

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Roblox Audio Downloader.exe

Files

Roblox Audio Downloader.exe
.exe windows:6 windows x86 arch:x86

Password: infected

1ce73059d2b32b0bb64c2446bc27d8ba

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

PDB Paths

C:\Users\harry\coding time\C++\Roblox Audio Downloader\Release\Roblox Audio Downloader.pdb

Imports

ws2_32

sendto
getpeername
ioctlsocket
freeaddrinfo
recvfrom
WSACloseEvent
WSACreateEvent
send
gethostname
getsockopt
recv
listen
WSAEnumNetworkEvents
WSAEventSelect
WSAResetEvent
WSAWaitForMultipleEvents
closesocket
WSAGetLastError
ntohs
WSASetLastError
WSAStartup
WSACleanup
setsockopt
htonl
getsockname
WSAIoctl
htons
connect
socket
__WSAFDIsSet
select
accept
bind
getaddrinfo

wldap32

ord217
ord46
ord301
ord200
ord30
ord79
ord35
ord33
ord32
ord27
ord26
ord22
ord41
ord50
ord143
ord60
ord45
ord211

crypt32

PFXImportCertStore
CryptStringToBinaryA
CertFreeCertificateContext
CryptDecodeObjectEx
CertEnumCertificatesInStore
CertCloseStore
CertOpenStore
CertAddCertificateContextToStore
CertFindExtension
CertGetNameStringA
CryptQueryObject
CertCreateCertificateChainEngine
CertFreeCertificateChainEngine
CertGetCertificateChain
CertFreeCertificateChain
CertFindCertificateInStore

normaliz

IdnToAscii

kernel32

GetFileInformationByHandle
GetFileAttributesExW
FindNextFileW
FindFirstFileExW
FindFirstFileW
FindClose
CreateDirectoryW
SetFileInformationByHandle
AreFileApisANSI
DeviceIoControl
CopyFileW
MoveFileExW
GetFileSizeEx
CreateFileA
VerifyVersionInfoW
VerSetConditionMask
SleepEx
GetCurrentProcessId
GetFileInformationByHandleEx
CreateSymbolicLinkW
LocalFree
FormatMessageA
GetLocaleInfoEx
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetCurrentProcess
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
CreateFileW
InitializeCriticalSectionEx
WaitForMultipleObjects
SetConsoleTitleA
GetStdHandle
Sleep
CloseHandle
ExitProcess
GetModuleHandleW
GetConsoleWindow
CreateProcessA
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
QueryPerformanceCounter
GetTickCount
EnterCriticalSection
LeaveCriticalSection
PeekNamedPipe
DeleteCriticalSection
QueryPerformanceFrequency
GetSystemDirectoryA
FreeLibrary
GetModuleHandleA
GetProcAddress
LoadLibraryA
MultiByteToWideChar
WideCharToMultiByte
GetLastError
SetLastError
FormatMessageW
MoveFileExA
WaitForSingleObjectEx
GetEnvironmentVariableA
GetFileType
ReadFile

user32

LoadImageA
PostMessageW
CreateWindowExW
CreatePopupMenu
TrackPopupMenu
ShowWindow
DefWindowProcW
RegisterClassW
TranslateMessage
InsertMenuW
PostQuitMessage
SetForegroundWindow
GetCursorPos
GetMessageW
DispatchMessageW

advapi32

CryptEncrypt
CryptImportKey
CryptDestroyKey
CryptDestroyHash
CryptHashData
CryptCreateHash
CryptGetHashParam
CryptReleaseContext
CryptAcquireContextA

shell32

Shell_NotifyIconW

msvcp140

?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@P6AAAV01@AAV01@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@_K@Z
?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QAEHXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@D@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QBEDD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
_Xtime_get_ticks
_Query_perf_counter
_Thrd_sleep
_Cnd_do_broadcast_at_thread_exit
?_Syserror_map@std@@YAPBDH@Z
?_Xlength_error@std@@YAXPBD@Z
?_Winerror_map@std@@YAHH@Z
?_Xout_of_range@std@@YAXPBD@Z
?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exceptions@std@@YAHXZ
?good@ios_base@std@@QBE_NXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
?_Throw_Cpp_error@std@@YAXH@Z
_Query_perf_frequency

bcrypt

BCryptGenRandom

vcruntime140

__std_exception_copy
memcmp
__std_terminate
memset
strchr
memcpy
strrchr
memchr
memmove
strstr
__current_exception
__current_exception_context
_CxxThrowException
_except_handler4_common
__std_exception_destroy
__CxxFrameHandler3

api-ms-win-crt-heap-l1-1-0

calloc
free
malloc
_set_new_mode
_callnewh
realloc

api-ms-win-crt-stdio-l1-1-0

fread
fclose
fputc
fwrite
_close
_fileno
_write
_read
fseek
__p__commode
_set_fmode
fputs
fopen_s
_lseeki64
feof
fgets
_open
fopen
__stdio_common_vsprintf
ftell
fflush
__stdio_common_vsscanf
__acrt_iob_func

api-ms-win-crt-runtime-l1-1-0

_exit
__p___argc
__p___argv
_c_exit
_register_thread_local_exe_atexit_callback
exit
_initterm_e
_initterm
_get_initial_narrow_environment
_controlfp_s
_set_app_type
_seh_filter_exe
_cexit
_crt_atexit
_register_onexit_function
_initialize_onexit_table
_initialize_narrow_environment
_configure_narrow_argv
__sys_errlist
_invalid_parameter_noinfo_noreturn
_errno
terminate
system
_beginthreadex
__sys_nerr

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-string-l1-1-0

strncpy
_strdup
strcspn
strspn
strpbrk
strncmp

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-time-l1-1-0

strftime
_gmtime64
_time64

api-ms-win-crt-convert-l1-1-0

wcstombs
strtoll
atoi
strtol
strtoul

api-ms-win-crt-filesystem-l1-1-0

_stat64
_unlink
_fstat64
_access

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func
_configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr
_fdopen

Sections

.text
Size: 365KB - Virtual size: 365KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 67KB - Virtual size: 66KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rsrc
Size: 11KB - Virtual size: 11KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 17KB - Virtual size: 16KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

Password: infected

1ce73059d2b32b0bb64c2446bc27d8ba

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

ws2_32

wldap32

crypt32

normaliz

kernel32

user32

advapi32

shell32

msvcp140

bcrypt

vcruntime140

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-conio-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-math-l1-1-0

Sections

.text Size: 365KB - Virtual size: 365KB

.rdata Size: 67KB - Virtual size: 66KB

.data Size: 1KB - Virtual size: 3KB

.rsrc Size: 11KB - Virtual size: 11KB

.reloc Size: 17KB - Virtual size: 16KB

.text
Size: 365KB - Virtual size: 365KB

.rdata
Size: 67KB - Virtual size: 66KB

.data
Size: 1KB - Virtual size: 3KB

.rsrc
Size: 11KB - Virtual size: 11KB

.reloc
Size: 17KB - Virtual size: 16KB