D:\!\robloxfakeexe\Roblox\obj\Debug\Roblox.pdb
Behavioral task
behavioral1
Sample
RobloxPlayerBeta.exe
Resource
win7-20240704-en
General
-
Target
NYX.zip
-
Size
5.1MB
-
MD5
793cc10cde15c18bd124a40b6af5f0bc
-
SHA1
b29cd7a9b283e0340e98e3d587a5da96a0aa1353
-
SHA256
ef5c7bce557175f829753e1d831dd791c216fd697df35b923320004ec1ffbe29
-
SHA512
d4175da49fa53f8b0a4f04b18a9ed9e97aa60160f88be54fc3a4fc9230b6679f590c98b2a218df02cdd6627f002650c2b5f0568c9a6c1c3b57e0c0c063823d54
-
SSDEEP
98304:VCN1sA4I3HPJb3Nw4jxkIlz88DUFDCvJQ3+NmE3EuUA/s:Inz4499VlkOz88YFWv++c4HUT
Malware Config
Signatures
-
resource yara_rule static1/unpack001/SkidNyx.exe vmprotect -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/RobloxPlayerBeta.exe unpack001/SkidNyx.exe
Files
-
NYX.zip.zip
-
RobloxPlayerBeta.exe.exe windows:4 windows x86 arch:x86
f34d5f2d4577ed6d9ceec516c1f5a744
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_NO_SEH
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB Paths
Imports
mscoree
_CorExeMain
Sections
.text Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 512B - Virtual size: 12B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
-
SkidNyx.exe.exe windows:6 windows x64 arch:x64
eab1b5e5a9d160cba8e3e716894d7dbf
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
kernel32
GetModuleHandleA
FlsSetValue
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetForegroundWindow
GetProcessWindowStation
GetProcessWindowStation
GetUserObjectInformationW
shell32
SHGetFolderPathA
msvcp140
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
ntdll
NtReadVirtualMemory
ws2_32
shutdown
mswsock
AcceptEx
vcruntime140
__current_exception_context
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
signal
api-ms-win-crt-stdio-l1-1-0
fputc
api-ms-win-crt-heap-l1-1-0
_callnewh
api-ms-win-crt-filesystem-l1-1-0
remove
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-string-l1-1-0
isgraph
api-ms-win-crt-math-l1-1-0
pow
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
wtsapi32
WTSSendMessageW
Exports
Exports
ѫ���B��0��*�}h1��k����6ˈ~kQ�a�=�©���&I�֥�z�DM��۴�����D!���R�$��B_ �إ��f��� 9�vA��)]sNF�M���q��f��;rq�H�2���繮�~e��Pz�*ώ��0��!N����S��*r�x͚ D�G[�k�0����� ����h�F�T[ ���S���`s6a�i��a�+[�XH���c�N�1m�lŀ��K�@�W�9�4�9�81C��ը"q��������桼�0 ����_$�.L�)�îa2������������PKuvD8�N��_�j���L����1������(�*Cp�N�y{�}܍�H1R@(*̕�{^7Y��:����0,��U�G�*� u�i�r� �=����@M<�K��/L�s�3�,+�\��2 ���������[n �&=k�O �f��X����+��βt�y0\�:���h�O��ygL��� ]����aҸ�->���~��'H�EL�����~�L/̍w���1����p��>�L���dW��� �G�F ��D�r{y���F9L�$0��N��N7-H��RY.7�`�s��Pr�P~<�6^��k�#���|��F�F�݉V�;�U ��� Jʊ��� �R�8bW���B��sJF���0�=̛�g\tb��8���Yk�~����1Cl���l4���[�u.v�`�I� �A-�������g�Y��-Г?��{b|}�2����;���N2Y�4��;����'���]|�W�u��"�>�h�z�s��@�i&j =`r�z�C�=D=��O��q�e1�(���Y&56Ou�![y��e���T sCgg��5�E0DF���1;�]w,b�9n<�Hd@��e�=�M��g~�>=JJ��K���1Se��^g��[�yi;�̤|�7w�4e�7���qf��X�<F!���@���A�p#ev+�I#T�9{Ϊ֪�Y��ri�����"���*��kX/LV���i@~�~�� �y��GZ.��!��:s�=(�vlό:o�}�5S��z�ʠ5�u�C�j"�u�����F����8��J��RoI���*�"��x��S���۴[<��:���5`J�ѥAz�b�)o8����1M**��3$�Uf��-#�Θ���Q���'Ph���o����ޏ�턅��ɲ�@@��Ӈ�ǁ���&9!ŠY+ �[b���n�~�_�[��_������� �Z{��k��ġ$���V����8L©��2�*��I4�`����"y���g��r)Uه��]���rB�Nw|�uw�R�K��z�� 0�Ԍ�\��x���e*G�T����zI��7�(~���8� �]�����B`&@�#�Q�I�S~^=�T���@�^�z�f|�.y�*����L���5� �=6�Wa�n ET�?J�M�Yr���g5���\�)����Yo4���_d�#��ݶ �����pɨMCt9�!�R���� ?F��snDS��Q�u��4�1V��f#XG�u��b>yn��γd?g��X��T�7i�������d��f��\h��5����X�#��Vi���Je7C�nW ��Sl'��#µ\Nּ�HH��Ǭ�K���-��%O�'��;���Z��#��"y��TQ��{�!���6'���f[gr.w��� AJֻ�u����WHV��kC:t�[��0�dT����;=B-u�y���`l0�m�W����E�mQZ-��n�I�1�)]�l�8�/b�¸���uȖ��t]����a�Eyp,� r������j`�����|��@u�Řy�K�=�\�t]"�:���neH��,�%�r�q>S̅�|�J�(.S��/���nU o�H�x� � ����"/�H��<�����_[i/bp�J�L��:�N�c��,˱^��oo��X��6����� �<.v�U։%f��;x��M�ޅ����0'�-BU�����g��V=5 �ի��9�Es��Pc2wt��P�Y ���^`4]�h�T0�,�'}?-�"KL�]�Gr� �?����4���I���֘v�Q��scٸՍǂ2h�c���S��WV��ʾO�$���'�S�9n�y4���������M#�N��I ��VH�^r+�ʹ�'�&��ˏ9i�|�^t�i�P��1Y�r\�uT��6� �͍Dm�/����a�HT�Uu����9W�T[.i� ����4+9č�4�7�>bhSg�9p%��n���U��#eua����1R$��4#����2(��Q,������J�F��eC��G3� f��%j H��*#&��o�!4��;�G��_���`���8�#a��'�a�T�mO�rV���G8�ƀ�\,i��~Wy���#���|!����@��:bd����A ���`�O���f/r�V��-�N��4�OXl��z]n<c�a�QJ�_=��j��d�(uӚ�ZĂ���x���8Z���R�����V�ޯFw�4=��3_���_�����y�|V%Kh�c��֮R��:q��G�=�G̽DX9�_` &�J�Ay�ۛL����"�C��������gH����k�:'�"듒g�E�i5���O�T�}��M\�)��J��ћ��6�WB��w��E��=���O��c�n�\�$+啉t�,����=D��ܺ4?��N��o�����Le�����wUp5K�h�g�r�����7݈��@����Y (U���6���l\Ƨr�K�D����I�����Y%Gb��8b�.������<(�c�����Ss��J��3��a�$W[���ڷ�O��������v'xi�X��W�GN�D�<�t�� �Y#���j�[�=�n`��@H;�Fiéf��^ º7[��×������YMv�7Y�b��(����u���,��ɌDè��W�$�����������?B��Wv�����Oi�j֬o�A�*�F�Y�0��C��|d �s �e?�R*���oqLo*��SC�[���5�\�q}��!�m�
Sections
.text Size: - Virtual size: 1.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 268KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 69KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 50KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.vmp0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.vmp1 Size: 5.5MB - Virtual size: 5.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 512B - Virtual size: 469B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ