roblox-auto-signup[.]v2[.]2[.]8[.]exe

General

Target
roblox-auto-signup.v2.2.8.exe
Size 15.4MB
Sample260522-3qd8dsaz7w
SHA256 f170081590752090a2cf7bae69db7e518c7d90e8fd6790cbacb9f004f9c6600b
MD5 0c03bccb7a3d002b15f5a2837ccf4b72
SHA1 d8708e593a9c665a40f3fd7a287b1963d62fced7
SHA512 a18cc6caa66731ef48b19938d92ee21507b323d95c338bbff906b8d58b96fc11305d8ce4fdd265c32444c3c9447b37f8089cfcd494ad29304f6f3585669040c1
SSDEEP 393216:TLbjDfDg+lBmsmw3gc6raxiVWMJYYAHH:T/jb0+loY/OaxmWMSYA
TLSH
T114F63391E2500895D5F7D63B9C1AD578B1A37823874BDA9743F1AB923E03BD4183BF12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

pyinstaller

Malware Config

Signatures

Detects Pyinstaller 1 IoCs

pyinstaller

resource	yara_rule
sample	pyinstaller

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
roblox-auto-signup.v2.2.8.exe

File Explorer

roblox-auto-signup.v2.2.8.exe

.exe 15.4MB
main.pyc

18KB

roblox-auto-signup.v2.2.8.exe

IMPHASH a06f302f71edd380da3d5bf4a6d94ebd
SHA256 f170081590752090a2cf7bae69db7e518c7d90e8fd6790cbacb9f004f9c6600b
MD5 0c03bccb7a3d002b15f5a2837ccf4b72
SHA1 d8708e593a9c665a40f3fd7a287b1963d62fced7
SHA512 a18cc6caa66731ef48b19938d92ee21507b323d95c338bbff906b8d58b96fc11305d8ce4fdd265c32444c3c9447b37f8089cfcd494ad29304f6f3585669040c1
SSDEEP 393216:TLbjDfDg+lBmsmw3gc6raxiVWMJYYAHH:T/jb0+loY/OaxmWMSYA
TLSH
T114F63391E2500895D5F7D63B9C1AD578B1A37823874BDA9743F1AB923E03BD4183BF12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Detects Pyinstaller

pyinstaller
Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

0

Major OS version

6

Entry point

49952

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_GUARD_CF IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

user32

TranslateMessage ShutdownBlockReasonCreate GetWindowThreadProcessId SetWindowLongPtrW GetWindowLongPtrW MsgWaitForMultipleObjects ShowWindow DestroyWindow CreateWindowExW RegisterClassW DefWindowProcW PeekMessageW DispatchMessageW GetMessageW

kernel32

GetTimeZoneInformation GetProcessHeap FreeEnvironmentStringsW GetEnvironmentStringsW GetCPInfo GetOEMCP GetACP IsValidCodePage GetStringTypeW FormatMessageW GetLastError GetModuleFileNameW LoadLibraryExW SetDllDirectoryW CreateSymbolicLinkW GetProcAddress CreateDirectoryW GetCommandLineW GetEnvironmentVariableW ExpandEnvironmentStringsW DeleteFileW FindClose FindFirstFileW FindNextFileW HeapSize RemoveDirectoryW GetTempPathW CloseHandle QueryPerformanceCounter QueryPerformanceFrequency WaitForSingleObject Sleep GetCurrentProcess GetCurrentProcessId TerminateProcess GetExitCodeProcess CreateProcessW GetStartupInfoW FreeLibrary LocalFree SetConsoleCtrlHandler GetConsoleWindow K32EnumProcessModules K32GetModuleFileNameExW CreateFileW FindFirstFileExW GetFinalPathNameByHandleW MultiByteToWideChar WideCharToMultiByte GetFileAttributesExW HeapReAlloc WriteConsoleW SetEndOfFile GetDriveTypeW IsDebuggerPresent RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter IsProcessorFeaturePresent GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GetModuleHandleW RtlUnwindEx SetLastError EnterCriticalSection LeaveCriticalSection DeleteCriticalSection InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree EncodePointer RaiseException RtlPcToFileHeader GetFileInformationByHandle GetFileType PeekNamedPipe SystemTimeToTzSpecificLocalTime FileTimeToSystemTime ReadFile GetFullPathNameW SetStdHandle GetStdHandle WriteFile ExitProcess GetModuleHandleExW GetCommandLineA HeapFree GetConsoleMode ReadConsoleW SetFilePointerEx GetConsoleOutputCP GetFileSizeEx HeapAlloc FlsAlloc FlsGetValue FlsSetValue FlsFree CompareStringW LCMapStringW GetCurrentDirectoryW FlushFileBuffers SetEnvironmentVariableW

advapi32

ConvertSidToStringSidW GetTokenInformation OpenProcessToken ConvertStringSecurityDescriptorToSecurityDescriptorW

Resubmissions

Sharing