RobloxPlayerInstaller (1) (1)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
RobloxPlayerInstaller (1) (1).exe
Size 6.6MB
Sample241117-klnbdsvpcw
SHA256 d0af716bd0939e74b9d64872e76da049ff30f1a199c64c3e9c5a5c99b587f015
MD5 5088d91c1e88554a4139566f37384d89
SHA1 e900d1005911601082896ca5bda4b033d8f87bd2
SHA512 61bdf2070ba5dae8a8b0cd43f8e3e8aa7559bbd60797e27cc1b9ce4d99e260806b81e1e3c56159eacf4865c0af42a98b53dc9c4ce498f06af62ae9e97396a314
SSDEEP 98304:AxvXWL7mlkPO0CsJZhaT4KVOGZvPRABKnMphs/g1WwxS9TQ+PYnIoE9/tyF5C3:aG3mlOO7sjUDJz1g1WW+PtoQ/k63
MD5 SHA1 SHA512 SSDEEP

Score

1^/10

Malware Config

Signatures

File Explorer

RobloxPlayerInstaller (1) (1).exe

.exe 6.6MB

RobloxPlayerInstaller (1) (1).exe

IMPHASH 21c0bbb1e4138b920aadb19c58eb4ebc
SHA256 d0af716bd0939e74b9d64872e76da049ff30f1a199c64c3e9c5a5c99b587f015
MD5 5088d91c1e88554a4139566f37384d89
SHA1 e900d1005911601082896ca5bda4b033d8f87bd2
SHA512 61bdf2070ba5dae8a8b0cd43f8e3e8aa7559bbd60797e27cc1b9ce4d99e260806b81e1e3c56159eacf4865c0af42a98b53dc9c4ce498f06af62ae9e97396a314
SSDEEP 98304:AxvXWL7mlkPO0CsJZhaT4KVOGZvPRABKnMphs/g1WwxS9TQ+PYnIoE9/tyF5C3:aG3mlOO7sjUDJz1g1WW+PtoQ/k63
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x86 arch:x86

PE Signature issue

Digest

5f:01:e5:50:38:2a:7a:b7:ed:71:10:b2:f0:38:65:0e:ee:79:48:34:7f:8b:80:eb:e3:ec:ed:62:83:b0:67:be

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jan 1, 0001

Subject

Serial Number

0d:af:ec:46:d2:b7:34:a6:7f:4e:ad:75:7c:0b:c9:6b

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Feb 13, 2024 - Feb 12, 2025

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

4031973

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\buildAgent\work\ci_deploy_ninja_boot-x86_git\build.ninja\common\vs2019\x86\release\Installer\Windows\RobloxPlayerInstaller.pdb

comctl32

_TrackMouseEvent InitCommonControlsEx

gdiplus

GdiplusShutdown GdipCloneImage GdiplusStartup GdipCreateHBITMAPFromBitmap GdipDisposeImage GdipCreateBitmapFromStream GdipAlloc GdipFree

wininet

InternetReadFile InternetQueryDataAvailable InternetQueryOptionW InternetSetStatusCallbackW HttpOpenRequestW HttpAddRequestHeadersW HttpSendRequestW HttpQueryInfoW InternetConnectW InternetCloseHandle InternetOpenW

shell32

ShellExecuteExW SHGetFolderPathAndSubDirW SHGetKnownFolderPath Shell_NotifyIconW

iphlpapi

GetAdaptersAddresses

bcrypt

BCryptGenRandom

advapi32

GetUserNameW IsValidSid GetTokenInformation GetLengthSid FreeSid EqualSid CopySid AllocateAndInitializeSid OpenProcessToken RegDeleteTreeW RegQueryValueExW RegQueryInfoKeyW RegEnumKeyExW CryptDestroyKey SystemFunction036 DeregisterEventSource RegisterEventSourceW ReportEventW CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptSignHashW RegQueryValueExA RegOpenKeyExA RegGetValueW RegSetValueExW RegOpenKeyExW RegDeleteValueW RegCreateKeyExW RegCloseKey CryptEnumProvidersW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash

ws2_32

listen getsockname connect recv getaddrinfo accept select __WSAFDIsSet WSAIoctl gethostname WSACleanup WSAStartup inet_pton WSAGetLastError freeaddrinfo closesocket WSACreateEvent WSACloseEvent send getsockopt htons htonl inet_ntop socket ntohs ntohl ioctlsocket getnameinfo WSASetLastError setsockopt bind

crypt32

CertOpenStore CertFindCertificateInStore CertDuplicateCertificateContext CertOpenSystemStoreA CertCloseStore CertEnumCertificatesInStore CertGetIntendedKeyUsage CertGetEnhancedKeyUsage CertGetCertificateContextProperty CertFreeCertificateContext

kernel32

InitOnceComplete InitOnceBeginInitialize SleepConditionVariableSRW SleepConditionVariableCS WakeAllConditionVariable WakeConditionVariable InitializeConditionVariable TryEnterCriticalSection InitializeSRWLock EncodePointer LCMapStringEx GetCPInfo GetLocaleInfoEx GetStringTypeW IsProcessorFeaturePresent InitializeSListHead UnhandledExceptionFilter GetStartupInfoW RtlUnwind InterlockedPushEntrySList GetCommandLineA CreateThread GetExitCodeThread ExitThread FreeLibraryAndExitThread GetConsoleOutputCP SetStdHandle GetDriveTypeW PeekNamedPipe IsDebuggerPresent DebugBreak OutputDebugStringW CloseHandle GetLastError SetLastError HeapAlloc HeapFree GetProcessHeap ReleaseSemaphore ReleaseMutex WaitForSingleObject WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW CreateSemaphoreExW GetCurrentProcessId GetCurrentThreadId GetModuleFileNameA GetModuleHandleW GetModuleHandleExW GetProcAddress FormatMessageW SetSearchPathMode GetCommandLineW VerSetConditionMask GetDiskFreeSpaceExW CreateFileMappingW VerifyVersionInfoW MulDiv LocaleNameToLCID GetUserDefaultLocaleName SetWaitableTimer CancelWaitableTimer CreateWaitableTimerW Sleep FindClose FindFirstFileW FindNextFileW SetUnhandledExceptionFilter SetEvent CreateEventW SystemTimeToTzSpecificLocalTime TerminateProcess GetExitCodeProcess CreateProcessW GetSystemTime CreateFileW GetFileSize MapViewOfFile UnmapViewOfFile DeleteFileW InitializeProcThreadAttributeList UpdateProcThreadAttribute OpenProcess GetModuleFileNameW SystemTimeToFileTime CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW GetCurrentProcess GetCurrentProcessorNumber GlobalMemoryStatusEx GetSystemInfo GetSystemTimeAsFileTime GetVersionExA IsWow64Process LoadLibraryA K32GetProcessMemoryInfo ResetEvent CreateEventA CreateSemaphoreA DuplicateHandle GetModuleHandleA GetTickCount OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency SwitchToThread MultiByteToWideChar WideCharToMultiByte GetNativeSystemInfo LoadLibraryExW FileTimeToSystemTime DecodePointer RaiseException InitializeCriticalSectionEx DeleteCriticalSection VirtualQuery GetCurrentThread LoadLibraryW WaitForMultipleObjectsEx LocalAlloc LocalFree FindResourceExW LoadResource LockResource SizeofResource FindResourceW CreateDirectoryW GetFileAttributesW GetFileSizeEx ReadFile RemoveDirectoryW SetFileAttributesW WriteFile CopyFileW GlobalAlloc GlobalFree GlobalUnlock GlobalLock CompareStringEx FreeLibrary GetEnvironmentVariableW VirtualAlloc VirtualProtect VirtualFree ReleaseSRWLockExclusive ReleaseSRWLockShared AcquireSRWLockExclusive AcquireSRWLockShared FlushFileBuffers FormatMessageA LockFileEx CreateFileMappingA UnlockFile HeapDestroy HeapCompact HeapReAlloc DeleteFileA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate GetVersionExW CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW GetFullPathNameW HeapCreate AreFileApisANSI EnterCriticalSection LeaveCriticalSection GetSystemDirectoryA MoveFileExA CompareFileTime GetEnvironmentVariableA SleepEx ResumeThread TlsAlloc TlsGetValue TlsSetValue TlsFree CreateWaitableTimerA GetCurrentDirectoryW GetFileInformationByHandle GetFileTime SetFilePointerEx SetFileTime DeviceIoControl MoveFileExW InitializeCriticalSection WriteConsoleW GetStdHandle GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW InitializeCriticalSectionAndSpinCount SwitchToFiber DeleteFiber CreateFiber GetFileType ConvertFiberToThread ConvertThreadToFiber SetConsoleCtrlHandler ExitProcess GetTimeZoneInformation GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetFinalPathNameByHandleW OpenEventW

user32

GetUserObjectInformationW GetProcessWindowStation GetWindowRect InvalidateRect EndPaint BeginPaint GetDC DrawTextW GetSystemMetrics EnableWindow KillTimer GetMessageW GetDlgCtrlID GetDlgItem LoadBitmapW DestroyWindow CreateWindowExW RegisterClassW CallWindowProcW PostQuitMessage DefWindowProcW EnumDisplayDevicesA GetWindowThreadProcessId GetShellWindow MapWindowPoints DestroyIcon MessageBoxW SendMessageW TranslateAcceleratorW LoadIconW GetParent SetWindowLongW GetWindowLongW LoadAcceleratorsW DispatchMessageW ShowWindow TranslateMessage SetTimer

gdi32

RoundRect GetDeviceCaps DeleteObject DeleteDC CreateSolidBrush CreatePatternBrush CreateFontW CreateCompatibleDC CreateCompatibleBitmap SelectObject SetDCBrushColor SetDCPenColor SetBkMode SetTextColor BitBlt GetStockObject

ole32

CoInitializeEx CoTaskMemAlloc CoUninitialize CoInitialize CoCreateInstance CoCreateGuid CoTaskMemFree StringFromGUID2

shlwapi

PathFindExtensionW ord12 PathFindFileNameW

powrprof

CallNtPowerInformation

winmm

timeSetEvent timeGetDevCaps timeBeginPeriod timeGetTime

Sharing

General

Malware Config

Signatures

File Explorer

RobloxPlayerInstaller (1) (1).exe

PE Signature issue

comctl32

gdiplus

wininet

shell32

iphlpapi

bcrypt

advapi32

ws2_32

crypt32

kernel32

user32

gdi32

ole32

shlwapi

powrprof

winmm

generic