RoblxExtern[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
RoblxExtern.exe
Size 103KB
Sample240726-rdd63sscnn
SHA256 60f0ed4e327ec2f37874d39d7d8112edd3ee5f3a88ac09d55f1e860ad1d16aab
MD5 96f4ada678831287e0e65a893bcbaead
SHA1 6d31200f6c78548164c416c7143d1ae2496c9dcb
SHA512 a055e1c871a6f0089d3643a714dc65effeab6eea62be996aab375a2941ab2c61099dd7fcfc0901784aebf9cceb31fbbe266d186c925953adede0e4d499a998d6
SSDEEP 1536:eAjVrqD0rWUVYqMdvM9m2o5+7nkG24dxugMGHd1mf2R6/ELA29o2IqQnsLTC+zhS:HFeyIj+0n+ym9EGWe
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RoblxExtern.exe

File Explorer

RoblxExtern.exe

.exe 103KB

RoblxExtern.exe

IMPHASH 985eee57ccac96ba61a13534baf4d517
SHA256 60f0ed4e327ec2f37874d39d7d8112edd3ee5f3a88ac09d55f1e860ad1d16aab
MD5 96f4ada678831287e0e65a893bcbaead
SHA1 6d31200f6c78548164c416c7143d1ae2496c9dcb
SHA512 a055e1c871a6f0089d3643a714dc65effeab6eea62be996aab375a2941ab2c61099dd7fcfc0901784aebf9cceb31fbbe266d186c925953adede0e4d499a998d6
SSDEEP 1536:eAjVrqD0rWUVYqMdvM9m2o5+7nkG24dxugMGHd1mf2R6/ELA29o2IqQnsLTC+zhS:HFeyIj+0n+ym9EGWe
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Password

Paper

Minor OS version

Major OS version

Entry point

87816

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\zanes\OneDrive\Desktop\Stuff\MyTools\RoblxExtern\build\RoblxExtern.pdb

urlmon

URLDownloadToFileW

kernel32

IsDebuggerPresent QueryPerformanceCounter Sleep IsProcessorFeaturePresent TerminateProcess GetCurrentProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext WideCharToMultiByte MultiByteToWideChar GetFileInformationByHandleEx GetModuleHandleW GetLastError CloseHandle AreFileApisANSI GetFileAttributesExW FindFirstFileW FindClose CreateFileW CreateDirectoryW GetLocaleInfoEx FormatMessageA LocalFree GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetCurrentProcessId

shell32

SHGetFolderPathW

msvcp140

?good@ios_base@std@@QEBA_NXZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Winerror_map@std@@YAHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ?uncaught_exceptions@std@@YAHXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__current_exception_context memcpy __std_exception_destroy __std_exception_copy __std_terminate __C_specific_handler _CxxThrowException __current_exception memmove memset

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh _set_new_mode

api-ms-win-crt-runtime-l1-1-0

_crt_atexit _register_thread_local_exe_atexit_callback _register_onexit_function __p___argv _invalid_parameter_noinfo_noreturn _exit exit _initterm_e _initterm _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv __p___argc _set_app_type _seh_filter_exe terminate _initialize_onexit_table system abort _cexit _c_exit

api-ms-win-crt-filesystem-l1-1-0

_stat64i32

api-ms-win-crt-environment-l1-1-0

getenv

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode getchar

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

api-ms-win-crt-math-l1-1-0

__setusermatherr