E:\RobloxSource\WindowsClient\Win32\Release\RobloxPlayerBetaRaw.pdb
Static task
static1
Behavioral task
behavioral1
Sample
RobloxPlayerBeta.exe
Resource
win10-20240404-en
General
-
Target
RobloxPlayerBeta.exe
-
Size
7.9MB
-
MD5
565b501f06f8fb0fecfe293cc61209ed
-
SHA1
d3682eb94e3c8c4f35907a3d7e15be11117ef9e7
-
SHA256
6f7cb0170990b44a5938b5bfd76e4b15d7d658089d609b1432de32d4748918d4
-
SHA512
d87c9afe1ba56bfcaef217e878fbca361db2ef7284de0f67bfe14665c6ce82b6ddbc0dcc9eb37982a9bb07e9f48df851a3421ee940c93e5b85177484f9e7debc
-
SSDEEP
196608:drvWg/lPMVHJfYjG6tbGCx8PnPJgsOFOr+UBW6c:d8WjGSZCxoFOaU3
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource RobloxPlayerBeta.exe
Files
-
RobloxPlayerBeta.exe.exe windows:6 windows x86 arch:x86
252d5089f32985a669dd8c36086fef2c
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
sdl2
SDL_JoystickInstanceID
sensapi
IsNetworkAlive
wmvcore
WMCreateProfileManager
urlmon
UrlMkSetSessionOption
fmod
?setDriver@System@FMOD@@QAG?AW4FMOD_RESULT@@H@Z
kernel32
GetVersionExA
QueryPerformanceCounter
GetModuleFileNameW
GetModuleHandleA
LoadLibraryA
LocalAlloc
LocalFree
GetModuleFileNameA
ExitProcess
user32
GetClassNameA
gdi32
GetDIBits
advapi32
OpenTraceA
shell32
SHGetFolderPathAndSubDirW
ole32
StringFromGUID2
oleaut32
VariantClear
shlwapi
PathStripPathA
msvcp110
_Mtx_destroy
msvcr110
_CIatan2
dbghelp
MiniDumpWriteDump
version
GetFileVersionInfoW
dinput8
DirectInput8Create
crypt32
CertCloseStore
wintrust
WinVerifyTrust
winmm
timeGetTime
psapi
GetModuleInformation
wininet
InternetWriteFile
winhttp
WinHttpOpenRequest
iphlpapi
GetAdaptersAddresses
ws2_32
inet_ntoa
libcurl
curl_easy_cleanup
pdh
PdhGetFormattedCounterValue
opengl32
glClearStencil
d3dx9_35
D3DXGetShaderConstantTable
Exports
Exports
4?l61}�Ɩ�Vo�j�߭$���V� 0���K��3c �9T{�PV9V0����1���^�/S�R���c8��&T�]^����+���=!^^ڀ�Y4�i�ͮ���/�wl��>� �ʉ#�i3����~�LߝP�8X/�������J�F��|�X���^�����X��'���h�\D.��1��j{O�3�M)6^%��:�M5�OiA�"w�BQ���/��Q�,,����q~`���qM�Xk�LK(_�'� %i�M$j���,˓5��q�N��d&0w�����O���9�Q�=8�$;�#�.�]����i�t%�8���I� $A���*��܄֕?�<H�A��J��H�c�ߢ+��M;�dT�$�+��e�c5����X]��`�.͈ŭ�y��ID�&\4e~Ds{��q��|���]onu�n��&�<�I^VQL��U�5߸ٽs���ջzNLRV���� ������A3�Y��@�m������Dv�Re��K���x�XU��}T^ԝ.�샜t���������W���1~'��Y�nG��7�py���4���5���'ťq��������JB4C�'j%��7����������91?P����ZNf�T;,��V��:�Ռ�$�ۡR%T�d�-..j��n6w�j k2-u�ۍ��]�FIǠ��O��訟5��;������<kTr�8��U�5s�x�xNSV����aJT�д������jӖ�c�,�y�J| ��i�\v��/����Qg�7�~�$�+5�g-C�� �ijI�e��@�w<����(�k�h������(;�P������Tc�B��=�.?�H�O�A�b/�}$0R��4j.=��o��M�Yj���S�x�q��#d�XU���^b�4�""�к0Wʺ�'�n>������b.#ϋ�O1�Hfi��Z�:(W3����'���{�=���bݩ`ɲ{Ē=��� �${F<plO��+ ����埑�e7D��3��/�����n �h�L��O�.�ͬ[�ڏ�� �K�:>��8�*���*��+�?{5��,��V�9c/���S�>ͳw��R��S1C3���,L�P�|Bo��i����?������9��<�����n���5W\��`e�]�(��;��h@W�C;�Rq�O���ĜKj�5Sk?k���AH,��G��<=�G��ǓBV���q�'�ا��NC��|�Ĕx=���J�|�ǡ�������Λ�E�2k�2���7Lt���rٷ���M��;Q�s���&�,a�Z��rh�I��B\D����ķb�p"����i4��� Z��P���kf�Y�/o���t���U*�1\峝� �̓���p���'bpBV��o�����tե2� "xuн��qvso]�bp��&W�d�?g��.x�XlBT�.s*x���U�O���/�K�U�TzqHO��W�Y�(:K��@��� �M�u7���e���dܥ�G��gf��k��P��Z���>���`g;;�ac�mN�������SO �@�u����7(�l�9"?0��^�y���֧!W�7��̥FJ��;�!5}��.F�c��,m��ހ͓@����8T��dҡd�h�9S�,�X�x�-�/�hؙ?B�0x?����`"*��2<�!=���2e�P屠�/ <?�v�A��>���xH����)1��Q�#]&����tA���9*R6�ĵ ���c*��}�-EϢ+�$r�m�?-Y���$�X�������e��+zɹ�h�c^���T��BgkFé'm�j3��y��0�7j��Id�#X��6���v��Q$��i!��Ħ7��"5��Dzv�V���T5�VM��YP7��#�ڌ����ȩ���� dq����I�K6B4�%+�c �2`9��$��A�B%1�f�{��J����� !Y��˕6�՚/����o���ۓ�l��?�T��Ѳ���s�~.��EM���k��K��76g�{u�3���8:_��Ty-�ɢ���.q�O�^@��XQю��$N�S���J3�}�P�+���Cp�q���B��,���Z�� ��5�A�ܹ�c�0���x�������蓁�=�\S�嚭�ݎ��!n���G!�-T8��o�Cn�t�6��Q�]�N���6���th��Ǖo���g7 '&�|-@��.�>J�;��X`ӱ����Wr-���F����<��YK��A�լ���_Ciq���W�w�0)ޯ;V:��ΰ~4g���v�8���.���Ȅ@[�vR���Uq4�/#�L��^`�b���Or<Ud�54� Jz��1eG;>��ƕ��}��ZC4�s^51h�^7��:����z�"�oG�w�T)��v-G��e��e���{��,>��Y����#���v'���U�X�L� )A�|������c.ԝJXM�n��=�b�*�����D^�Q"�8z[ᳫ/PBʁF����� (�%�h�;r��,�� vJ��Rj���?�Z�?�}Wכs,Ӆ����5�a����s�$�������/�s�xC��k�g�ɶ$�{� *��� �C%��A3<�NF�C��ķ��%�l�(S�Y�,\~��Z�<~^�h�.>���͡]fSp�E=w�������Sh�epB����� l��Ͼ_�n��c��y��0J"7s%x��<j��K��d�9o6�^Y��Q�I-���c������s�$�]��ئ�w��0��p��2O�D���<l�)`����3��f��[f��Hp<M�2Y�^ǩ�?�6S�#�G�H���� &ދв$�=�W���I��}H,R�\��V>�x��~���|rXo�H5���2��ڃs��)v��$�����+�ŏ��a�7cXJ�2��Z����������?�bG���ε��̑�'�p���� �y}��l��"��_1�����Q�j!��j��Z�v0��l���{��P�I^�窯������S*d��M!�Ғ��b�!O��5�InwO��J�z��?���ǐ�4��Y��$�_ldu��ˣ�P�� ��Yy^
?FastLog@FLog@@YAXEPBDPBX1111@Z
?FastLog@FLog@@YAXEPBDPBX11@Z
?FastLog@FLog@@YAXEPBDPBX@Z
?FastLogF@FLog@@YAXEPBDMMMM@Z
?FastLogFormatted@FLog@@YAXEPBDZZ
?FastLogFormattedNoAdorn@FLog@@YAXEPBDZZ
?FastLogS@FLog@@YAXEPBD0@Z
?FastLogS@FLog@@YAXEPBDABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?ForEachVariable@FLog@@YAXP6AXABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0PAX@Z1W4FastVarType@@@Z
?GetFastLogCounter@FLog@@YAHE@Z
?GetNumSynchronizedVariable@FLog@@YAGXZ
?GetValue@FLog@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AAV23@_N@Z
?Init@FLog@@YAXP6ANXZ@Z
?NowFast@FLog@@YANXZ
?RegisterFlag@FLog@@YAHPBDPA_NPAPA_NW4FastVarType@@@Z
?RegisterInt@FLog@@YAHPBDPAHPAPA_NW4FastVarType@@@Z
?RegisterLogGroup@FLog@@YAHPBDPAEPAPA_NW4FastVarType@@@Z
?RegisterString@FLog@@YAHPBDPAV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@PAPA_NW4FastVarType@@@Z
?ResetSynchronizedVariablesState@FLog@@YAXXZ
?SetBinaryLog@Detail@FLog@@YAXPAXP6AX0PBXI@Z@Z
?SetExternalLogFunc@FLog@@YAXP6AXEPBD@Z@Z
?SetValue@FLog@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0W4FastVarType@@_N@Z
?SetValueFromServer@FLog@@YA_NABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@0@Z
?WriteFastLogDump@FLog@@YAXPBDH@Z
AmdPowerXpressRequestHighPerformance
NvOptimusEnablement
unusedPadding
Sections
.text Size: - Virtual size: 10.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.zero Size: - Virtual size: 5KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 3.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: 512B - Virtual size: 9B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp0 Size: - Virtual size: 2.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.vmp1 Size: 7.8MB - Virtual size: 7.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 102KB - Virtual size: 101KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ