robloxinstaller[.]exe

Target
robloxinstaller.exe
Size 7.9MB
Sample260622-w7tk3sfx71
SHA256 af65a4a08c365d476ea941add0d62058ccdaa544cf42509e05c78d9658a8005d
MD5 40d47e4d4c2c52de03a2ef0fa9c3a44c
SHA1 6937df33891f26a67e6cf746ac8a04f11e5558c0
SHA512 84c538a1ad2533312914380ca48d89becdbd8b5577acfa1ab0e06674f073da15f777850676cc35bcf128391ceb656e12a8184f3a2efc0aefcdc552d7c09dd665
SSDEEP 196608:aat/0HrmGYhpP/vaM+HsiaYRTRAR8De50:a3mGYh5/vX+Hpaay6
TLSH
T12686BF12FD05C061E5D101B2A6BD6FB59D7D89301B3848D77BC85DAC8A705E33A3AB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
robloxinstaller.exe

File Explorer

robloxinstaller.exe

.exe 7.9MB

robloxinstaller.exe

IMPHASH 650726dc2201e5b564e13add92a290f7
SHA256 af65a4a08c365d476ea941add0d62058ccdaa544cf42509e05c78d9658a8005d
MD5 40d47e4d4c2c52de03a2ef0fa9c3a44c
SHA1 6937df33891f26a67e6cf746ac8a04f11e5558c0
SHA512 84c538a1ad2533312914380ca48d89becdbd8b5577acfa1ab0e06674f073da15f777850676cc35bcf128391ceb656e12a8184f3a2efc0aefcdc552d7c09dd665
SSDEEP 196608:aat/0HrmGYhpP/vaM+HsiaYRTRAR8De50:a3mGYh5/vX+Hpaay6
TLSH
T12686BF12FD05C061E5D101B2A6BD6FB59D7D89301B3848D77BC85DAC8A705E33A3AB2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

2a:57:91:73:e8:ad:2e:87:28:1a:6d:06:3e:0c:2f:39:5a:61:86:d5:76:cd:4b:60:bd:d7:6e:fb:0c:82:33:04

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jan 1, 0001

Subject

Serial Number

07:1f:a3:3b:b6:bd:8f:10:10:42:ed:aa:0e:b2:dd:28

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 9, 2025 - Jan 8, 2026

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

5387749

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\buildAgent\work\ci_deploy_ninja_boot-x86_git\build.ninja\common\vs2019\x86\release\Installer\Windows\RobloxPlayerInstaller.pdb

comctl32

_TrackMouseEvent InitCommonControlsEx

gdiplus

GdiplusStartup GdipFree GdipAlloc GdipCloneImage GdipDisposeImage GdipCreateBitmapFromStream GdiplusShutdown GdipCreateHBITMAPFromBitmap

wininet

InternetConnectW InternetReadFile InternetCloseHandle HttpQueryInfoW HttpSendRequestW HttpAddRequestHeadersW HttpOpenRequestW InternetOpenW InternetSetStatusCallbackW InternetQueryOptionW InternetQueryDataAvailable

shell32

SHGetFolderPathAndSubDirW Shell_NotifyIconW SHGetKnownFolderPath ShellExecuteExW

iphlpapi

GetAdaptersAddresses

ws2_32

getnameinfo gethostname ioctlsocket freeaddrinfo getaddrinfo listen accept getservbyname __WSAFDIsSet WSAIoctl shutdown recv getsockname getpeername connect bind WSACleanup WSAStartup WSASetLastError inet_pton WSAGetLastError WSACreateEvent WSACloseEvent send getsockopt htons htonl inet_ntop socket ntohs ntohl closesocket setsockopt getservbyport gethostbyname gethostbyaddr inet_ntoa sendto inet_addr select recvfrom

advapi32

CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW GetUserNameW CryptHashData CryptDestroyHash RegCloseKey RegCreateKeyExW RegDeleteValueW RegOpenKeyExW RegSetValueExW RegGetValueW RegOpenKeyExA RegQueryValueExA CryptAcquireContextA CryptGenRandom SystemFunction036 CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptSignHashW CryptEnumProvidersW DeregisterEventSource RegisterEventSourceW ReportEventW CryptDestroyKey RegEnumKeyExW RegQueryInfoKeyW RegQueryValueExW RegDeleteTreeW OpenProcessToken AllocateAndInitializeSid CopySid EqualSid FreeSid GetLengthSid GetTokenInformation IsValidSid

crypt32

CertCloseStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreA CertEnumCertificatesInStore CertOpenSystemStoreW CertGetCertificateContextProperty CertDuplicateCertificateContext CertFindCertificateInStore CertOpenStore

kernel32

SleepConditionVariableCS SleepConditionVariableSRW SwitchToThread InitOnceBeginInitialize InitOnceComplete EncodePointer LCMapStringEx GetCPInfo GetLocaleInfoEx InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent InitializeSListHead UnhandledExceptionFilter GetStartupInfoW DebugBreak HeapAlloc HeapFree GetProcessHeap GetCurrentThreadId GetModuleFileNameA GetModuleHandleW GetModuleHandleExW GetProcAddress FormatMessageW SetSearchPathMode GetCommandLineW IsDebuggerPresent OutputDebugStringW CloseHandle GetLastError SetLastError ReleaseSemaphore ReleaseMutex WaitForSingleObject WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW CreateSemaphoreExW GetCurrentProcessId VerSetConditionMask GetDiskFreeSpaceExW CreateMutexW TerminateProcess OpenProcess CreateFileMappingW MapViewOfFile UnmapViewOfFile VerifyVersionInfoW MulDiv LocaleNameToLCID GetUserDefaultLocaleName SetWaitableTimer CancelWaitableTimer CreateWaitableTimerW Sleep CreateEventA SetEvent FindClose FindFirstFileW FindNextFileW SetUnhandledExceptionFilter CreateEventW OpenEventW GetExitCodeProcess CreateProcessW GetSystemTime CreateFileW GetFileSize ReadFile DeleteFileW RtlUnwind SetFileAttributesW InitializeProcThreadAttributeList UpdateProcThreadAttribute GetModuleFileNameW SystemTimeToFileTime CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW GetCurrentProcess GlobalMemoryStatusEx K32GetProcessMemoryInfo GetProcessHandleCount GetCurrentProcessorNumber GetSystemInfo GetSystemTimeAsFileTime GetVersionExA IsWow64Process LoadLibraryA ResetEvent CreateSemaphoreA DuplicateHandle WakeConditionVariable GetTickCount OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency FileTimeToSystemTime MultiByteToWideChar WideCharToMultiByte GetNativeSystemInfo LoadLibraryExW DecodePointer RaiseException InitializeCriticalSectionEx DeleteCriticalSection VirtualQuery GetCurrentThread LoadLibraryW WaitForMultipleObjectsEx LocalAlloc LocalFree FindResourceExW LoadResource LockResource SizeofResource FindResourceW CreateDirectoryW GetFileSizeEx RemoveDirectoryW WriteFile CopyFileW MoveFileW GlobalAlloc GlobalFree GlobalUnlock GlobalLock CompareStringEx FreeLibrary GetEnvironmentVariableW FlushFileBuffers FormatMessageA LockFileEx UnlockFile HeapDestroy HeapCompact HeapReAlloc DeleteFileA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW GetFullPathNameW HeapCreate AreFileApisANSI ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection GetSystemDirectoryA SleepEx MoveFileExA CompareFileTime GetEnvironmentVariableA VirtualAlloc VirtualProtect VirtualFree GetCurrentDirectoryW GetFileInformationByHandle GetFileTime SetFilePointerEx SetFileTime DeviceIoControl MoveFileExW ResumeThread TlsAlloc TlsGetValue TlsSetValue TlsFree CreateWaitableTimerA InitializeCriticalSection WriteConsoleW GetStdHandle GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW InitializeSRWLock ReleaseSRWLockShared AcquireSRWLockShared SwitchToFiber DeleteFiber CreateFiberEx TryEnterCriticalSection GetExitCodeThread GetACP GetFileType ConvertFiberToThread ConvertThreadToFiberEx GetStringTypeW InterlockedPushEntrySList GetCommandLineA WakeAllConditionVariable GetModuleHandleA CreateThread ExitThread FreeLibraryAndExitThread SetStdHandle GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime SetConsoleCtrlHandler ExitProcess GetConsoleOutputCP GetTimeZoneInformation GetDateFormatW InitializeConditionVariable GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FindFirstFileExW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetFinalPathNameByHandleW GetFileAttributesW

user32

MapWindowPoints GetWindowRect InvalidateRect EndPaint BeginPaint TranslateAcceleratorW GetMessageW TranslateMessage SetWindowLongW GetShellWindow MessageBoxW SendMessageW DefWindowProcW PostQuitMessage GetWindowThreadProcessId DispatchMessageW GetUserObjectInformationW GetProcessWindowStation LoadBitmapW GetParent LoadIconW GetWindowLongW DestroyIcon CallWindowProcW RegisterClassW CreateWindowExW DestroyWindow LoadAcceleratorsW ShowWindow GetDlgItem GetDlgCtrlID SetTimer KillTimer EnableWindow GetSystemMetrics DrawTextW GetDC EnumDisplayDevicesA

gdi32

BitBlt SetDCPenColor SetDCBrushColor SelectObject RoundRect GetStockObject GetDeviceCaps DeleteObject DeleteDC CreateSolidBrush CreatePatternBrush CreateFontW CreateCompatibleDC CreateCompatibleBitmap SetTextColor SetBkMode

ole32

CoInitialize CoCreateInstance CoTaskMemAlloc CoTaskMemFree CoCreateGuid CoInitializeEx StringFromGUID2 CoUninitialize

shlwapi

PathFindExtensionW PathFindFileNameW ord12

powrprof

CallNtPowerInformation

winmm

timeBeginPeriod timeSetEvent timeGetTime timeGetDevCaps

api-ms-win-core-synch-l1-2-0

WaitOnAddress WakeByAddressSingle WakeByAddressAll

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

robloxinstaller.exe

PE Signature issue

comctl32

gdiplus

wininet

shell32

iphlpapi

ws2_32

advapi32

crypt32

kernel32

user32

gdi32

ole32

shlwapi

powrprof

winmm

api-ms-win-core-synch-l1-2-0

generic