RobloxStudioInstaller[.]exe

Target
RobloxStudioInstaller.exe
Size 5.5MB
Sample240903-clxk3athln
SHA256 c91803f5c89cc6b4c649f1a6dc85901208a0cf83cbe5d44c4e4800cc0e3b8fde
MD5 24bcceca8b115ff5d0060b2d9def17c6
SHA1 a06ba5c1f6d64c9a95627c4b2291806d2b5cd300
SHA512 d0d5163a972860ae532d8d0f29d97a1a74796b94aec00d112e30efabc1139b1bb97c892afe7f3a69ef1323aa387a71ae006749e91f374ee93b465586ed6a913d
SSDEEP 98304:GylvpWmVc0qvvtCfSp1SeBg+zTqltWRBfKpph6Ubhh/a/:LpWachtCmpg+CWR4ppkUw
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

RobloxStudioInstaller.exe

.exe 5.5MB

RobloxStudioInstaller.exe

IMPHASH 53e5dc2c495a99907478e103dc5dd6a5
SHA256 c91803f5c89cc6b4c649f1a6dc85901208a0cf83cbe5d44c4e4800cc0e3b8fde
MD5 24bcceca8b115ff5d0060b2d9def17c6
SHA1 a06ba5c1f6d64c9a95627c4b2291806d2b5cd300
SHA512 d0d5163a972860ae532d8d0f29d97a1a74796b94aec00d112e30efabc1139b1bb97c892afe7f3a69ef1323aa387a71ae006749e91f374ee93b465586ed6a913d
SSDEEP 98304:GylvpWmVc0qvvtCfSp1SeBg+zTqltWRBfKpph6Ubhh/a/:LpWachtCmpg+CWR4ppkUw
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

Password

Eeeee

PE Signature issue

Digest

9e:89:e8:2a:17:b8:8c:db:58:bf:a9:bc:98:53:be:99:a6:cb:25:b5:e2:10:34:8b:12:88:8f:8d:6a:bf:46:e2

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jan 1, 0001

Subject

Serial Number

0d:af:ec:46:d2:b7:34:a6:7f:4e:ad:75:7c:0b:c9:6b

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 13, 2024 - Feb 12, 2025

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

Serial Number

05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Jul 14, 2023 - Oct 13, 2034

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

3143072

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\buildAgent\work\ci_deploy_ninja_boot-x86_git\build.ninja\common\vs2019\x86\release\Installer\Windows\RobloxStudioInstaller.pdb

comctl32

_TrackMouseEvent InitCommonControlsEx

gdiplus

GdiplusShutdown GdipCloneImage GdiplusStartup GdipCreateHBITMAPFromBitmap GdipDisposeImage GdipCreateBitmapFromStream GdipAlloc GdipFree

wininet

InternetReadFile InternetQueryDataAvailable InternetQueryOptionW HttpOpenRequestW HttpAddRequestHeadersW HttpSendRequestW InternetOpenW HttpQueryInfoW InternetCloseHandle InternetConnectW

shell32

SHGetFolderPathAndSubDirW ShellExecuteExW SHGetKnownFolderPath Shell_NotifyIconW

iphlpapi

GetAdaptersAddresses

bcrypt

BCryptGenRandom

advapi32

CopySid RegDeleteValueW AllocateAndInitializeSid OpenProcessToken RegCreateKeyExW RegDeleteTreeW RegQueryValueExW RegQueryInfoKeyW RegEnumKeyExW IsValidSid GetTokenInformation GetLengthSid SystemFunction036 DeregisterEventSource RegisterEventSourceW ReportEventW CryptSetHashParam CryptGetProvParam FreeSid CryptGetUserKey CryptExportKey CryptDecrypt CryptSignHashW CryptEnumProvidersW EqualSid RegCloseKey CryptDestroyKey RegQueryValueExA RegOpenKeyExA RegGetValueW RegSetValueExW GetUserNameW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash RegOpenKeyExW

ws2_32

connect __WSAFDIsSet WSAIoctl inet_pton getaddrinfo freeaddrinfo WSACreateEvent WSACloseEvent getsockopt htonl WSASetLastError WSACleanup WSAStartup setsockopt send select recv listen htons getsockname closesocket bind accept inet_ntop socket ntohs ntohl ioctlsocket getnameinfo gethostname WSAGetLastError

crypt32

CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreA CertOpenStore CertFindCertificateInStore CertGetCertificateContextProperty CertCloseStore CertDuplicateCertificateContext

kernel32

GetStringTypeW GetLocaleInfoEx GetCPInfo InitializeSListHead LCMapStringEx EncodePointer InitOnceComplete InitOnceBeginInitialize SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable GetStartupInfoW RtlUnwind InterlockedPushEntrySList GetCommandLineA CreateThread ExitThread FreeLibraryAndExitThread GetConsoleOutputCP SetStdHandle HeapSize IsProcessorFeaturePresent TryEnterCriticalSection InitializeSRWLock GetExitCodeThread GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime SetConsoleCtrlHandler ExitProcess IsDebuggerPresent DebugBreak OutputDebugStringW CloseHandle GetLastError SetLastError HeapAlloc HeapFree GetProcessHeap ReleaseSemaphore ReleaseMutex WaitForSingleObject WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW CreateSemaphoreExW GetCurrentProcessId GetCurrentThreadId GetModuleFileNameA GetModuleHandleW GetModuleHandleExW GetProcAddress FormatMessageW SetSearchPathMode GetCommandLineW VerSetConditionMask GetDiskFreeSpaceExW CreateFileMappingW VerifyVersionInfoW GetTimeZoneInformation LocaleNameToLCID GetUserDefaultLocaleName Sleep FindClose FindFirstFileW FindNextFileW SetUnhandledExceptionFilter SetEvent CreateEventW OpenEventW CreateProcessW GetSystemTime CreateFileW GetFileSize MapViewOfFile UnmapViewOfFile DeleteFileW TerminateProcess InitializeProcThreadAttributeList UpdateProcThreadAttribute OpenProcess GetModuleFileNameW SystemTimeToFileTime CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW GetCurrentProcess GetCurrentProcessorNumber GlobalMemoryStatusEx GetSystemInfo GetSystemTimeAsFileTime GetVersionExA IsWow64Process LoadLibraryA K32GetProcessMemoryInfo ResetEvent CreateEventA CreateSemaphoreA DuplicateHandle GetModuleHandleA GetTickCount OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency SwitchToThread MultiByteToWideChar WideCharToMultiByte GetNativeSystemInfo LoadLibraryExW FileTimeToSystemTime VirtualQuery RaiseException GetCurrentThread LoadLibraryW DecodePointer InitializeCriticalSectionEx DeleteCriticalSection WaitForMultipleObjectsEx GetExitCodeProcess LocalAlloc LocalFree FindResourceExW LoadResource LockResource SizeofResource FindResourceW GlobalAlloc GlobalFree GlobalUnlock GlobalLock CreateDirectoryW GetFileAttributesW GetFileSizeEx ReadFile RemoveDirectoryW SetFileAttributesW WriteFile CopyFileW CompareStringEx FreeLibrary GetEnvironmentVariableW VirtualAlloc VirtualProtect VirtualFree ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared EnterCriticalSection LeaveCriticalSection GetSystemDirectoryA MoveFileExA CompareFileTime GetEnvironmentVariableA SleepEx FormatMessageA SetWaitableTimer ResumeThread TlsAlloc TlsGetValue TlsSetValue TlsFree CreateWaitableTimerA GetCurrentDirectoryW GetFileAttributesExW GetFileInformationByHandle GetFileTime GetFullPathNameW SetEndOfFile SetFilePointerEx SetFileTime GetTempPathW DeviceIoControl MoveFileExW AreFileApisANSI InitializeCriticalSection GetStdHandle GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW InitializeCriticalSectionAndSpinCount SwitchToFiber DeleteFiber CreateFiber GetFileType ConvertFiberToThread ConvertThreadToFiber GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID UnhandledExceptionFilter EnumSystemLocalesW FlushFileBuffers HeapReAlloc FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW WriteConsoleW GetFinalPathNameByHandleW MulDiv

user32

GetWindowRect InvalidateRect EndPaint BeginPaint GetDC DrawTextW GetSystemMetrics EnableWindow KillTimer SetTimer DispatchMessageW GetUserObjectInformationW ShowWindow DestroyWindow CreateWindowExW GetProcessWindowStation LoadBitmapW EnumDisplayDevicesA FillRect TranslateMessage MessageBoxW SendMessageW DefWindowProcW GetMessageW DestroyIcon LoadIconW SetWindowLongW GetWindowLongW GetWindowThreadProcessId GetShellWindow TranslateAcceleratorW GetDlgItem PostQuitMessage CallWindowProcW RegisterClassW LoadAcceleratorsW GetDlgCtrlID

gdi32

SetTextColor SetBkMode SetDCPenColor SetDCBrushColor SelectObject RoundRect CreateFontW GetStockObject GetDeviceCaps DeleteObject DeleteDC CreateSolidBrush CreatePen Rectangle

ole32

CoInitializeEx CoTaskMemAlloc CoCreateInstance CoUninitialize CoInitialize CoCreateGuid CoTaskMemFree StringFromGUID2

shlwapi

ord12 PathFindFileNameW PathFindExtensionW

powrprof

CallNtPowerInformation

winmm

timeGetTime timeGetDevCaps timeBeginPeriod timeSetEvent

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

RobloxStudioInstaller.exe

PE Signature issue

comctl32

gdiplus

wininet

shell32

iphlpapi

bcrypt

advapi32

ws2_32

crypt32

kernel32

user32

gdi32

ole32

shlwapi

powrprof

winmm

generic