arrombar.tar
- SHA256 44aab99b2d37350d2beee414aa7fb7060ee9ba2a3a3cbcedc55309b837ec7357
Static task
static1
Behavioral task
behavioral1
Sample
arrombar.tar
Resource
win10v2004-20260513-en
Checks for missing Authenticode signature.
| resource |
|---|
| unpack001/Microsoft.VC90.CRT/msvcm90.dll |
| unpack001/Microsoft.VC90.MFC/mfcm90.dll |
| unpack001/SDL2.dll |
| unpack001/VMProtectSDK32.dll |
| unpack001/fmodex.dll |
| unpack001/tbb.dll |
| unpack001/tbb_debug.dll |
Codesigned file was signed by an untrusted entity.
| resource |
|---|
| unpack001/Bootstrapper.exe |
| unpack001/Microsoft.VC90.CRT/msvcp90.dll |
| unpack001/Microsoft.VC90.CRT/msvcr90.dll |
| unpack001/Microsoft.VC90.MFC/mfc90.dll |
| unpack001/Microsoft.VC90.OPENMP/vcomp90.dll |
| unpack001/RobloxPlayerBeta.exe |
| unpack001/RobloxProxy.dll |
| unpack001/RobloxProxy64.dll |
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Apr 10, 2015
CN=ROBLOX Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ROBLOX Corporation,L=Menlo Park,ST=California,C=US
count=1, id=150, version=20413,
count=27, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=132, productName=VS2008 build 21022, version=21022,
count=4, id=109, productName=VS2005 build 50727, version=50727,
count=31, id=123, productName=VS2005 build 50727, version=50727,
count=69, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=179, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=315, id=1, productName=Unmarked objects,
count=38, id=138, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=151,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Unsigned PE
Checks for missing Authenticode signature.
count=3, id=147, productName=VS2008 build 21022, version=21022,
count=1, id=150, version=20413,
count=1, id=149, productName=VS2008 build 21022, version=21022,
count=2, id=123, version=60516,
count=4, id=123, productName=VS2005 build 50727, version=50727,
count=151, id=1, productName=Unmarked objects,
count=14, id=131, productName=VS2008 build 21022, version=21022,
count=91, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=146, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Nov 7, 2007
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=123, productName=VS2005 build 50727, version=50727,
count=3, id=147, productName=VS2008 build 21022, version=21022,
count=127, id=1, productName=Unmarked objects,
count=1, id=150, version=20413,
count=5, id=149, productName=VS2008 build 21022, version=21022,
count=39, id=132, productName=VS2008 build 21022, version=21022,
count=60, id=131, productName=VS2008 build 21022, version=21022,
count=1, id=146, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Nov 7, 2007
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=3, id=123, productName=VS2005 build 50727, version=50727,
count=162, id=1, productName=Unmarked objects,
count=490, id=131, productName=VS2008 build 21022, version=21022,
count=85, id=149, productName=VS2008 build 21022, version=21022,
count=184, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=146, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Nov 7, 2007
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=1, id=110, productName=VS2005 build 50727, version=50727,
count=1, id=35, version=8350,
count=16, id=109, productName=VS2005 build 50727, version=50727,
count=2, id=147, productName=VS2008 build 21022, version=21022,
count=1, id=150, version=20413,
count=11, id=149, productName=VS2008 build 21022, version=21022,
count=31, id=131, productName=VS2008 build 21022, version=21022,
count=9, id=132, productName=VS2008 build 21022, version=21022,
count=9, id=123, productName=VS2005 build 50727, version=50727,
count=864, id=1, productName=Unmarked objects,
count=223, id=138, version=21022,
count=1, id=146, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=109, productName=VS2005 build 50727, version=50727,
count=2, id=123, version=60516,
count=7, id=147, productName=VS2008 build 21022, version=21022,
count=1, id=150, version=20413,
count=1, id=149, productName=VS2008 build 21022, version=21022,
count=13, id=131, productName=VS2008 build 21022, version=21022,
count=4, id=123, productName=VS2005 build 50727, version=50727,
count=147, id=1, productName=Unmarked objects,
count=20, id=132, productName=VS2008 build 21022, version=21022,
count=1, id=146, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Nov 7, 2007
CN=Microsoft Corporation,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=13, id=149, productName=VS2008 build 21022, version=21022,
count=13, id=131, productName=VS2008 build 21022, version=21022,
count=5, id=123, productName=VS2005 build 50727, version=50727,
count=64, id=1, productName=Unmarked objects,
count=13, id=138, version=21022,
count=1, id=146, productName=VS2008 build 21022, version=21022,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 build 21022, version=21022,
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Apr 10, 2015
CN=ROBLOX Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ROBLOX Corporation,L=Menlo Park,ST=California,C=US
count=2, id=25, version=9210,
count=2, id=28, version=9178,
count=30, id=96, productName=Windows Server 2003 SP1 DDK build 4035, version=4035,
count=2, id=4, productName=VC++ 6.0 SP5 imp/exp build 8447, version=8447,
count=16, id=199, version=41118,
count=13, id=205, version=50929,
count=22, id=206, version=50929,
count=2, id=203, productName=VS2012 UPD3 build 60610, version=60610,
count=4, id=203, version=50929,
count=23, id=207, version=50929,
count=825, id=207, productName=VS2012 UPD4 build 61030, version=61030,
count=2, id=203, productName=VS2012 UPD4 build 61030, version=61030,
count=6, id=185, version=30716,
count=183, id=206, productName=VS2012 UPD4 build 61030, version=61030,
count=47, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=1044, id=1, productName=Unmarked objects,
count=8, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=44, id=211, version=61030,
count=1, id=202, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=201, productName=VS2012 UPD4 build 61030, version=61030,
count=1, id=151,
count=1, id=204, productName=VS2012 UPD4 build 61030, version=61030,
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Apr 10, 2015
CN=ROBLOX Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ROBLOX Corporation,L=Menlo Park,ST=California,C=US
count=2, id=150, version=20413,
count=3, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=9, id=109, productName=VS2005 build 50727, version=50727,
count=17, id=123, productName=VS2005 build 50727, version=50727,
count=239, id=1, productName=Unmarked objects,
count=17, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=15, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
Apr 10, 2015
CN=ROBLOX Corporation,OU=Digital ID Class 3 - Microsoft Software Validation v2,O=ROBLOX Corporation,L=Menlo Park,ST=California,C=US
count=2, id=150, version=20413,
count=2, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=4, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=8, id=109, productName=VS2005 build 50727, version=50727,
count=1, id=128, version=50727,
count=17, id=123, productName=VS2005 build 50727, version=50727,
count=237, id=1, productName=Unmarked objects,
count=17, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=14, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Unsigned PE
Checks for missing Authenticode signature.
Unsigned PE
Checks for missing Authenticode signature.
count=32, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=16, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=99, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=87, id=1, productName=Unmarked objects,
count=2, id=138, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Unsigned PE
Checks for missing Authenticode signature.
count=2, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=150, version=20413,
count=12, id=149, productName=VS2008 SP1 build 30729, version=30729,
count=2, id=109, productName=VS2005 build 50727, version=50727,
count=15, id=123, productName=VS2005 build 50727, version=50727,
count=198, id=1, productName=Unmarked objects,
count=9, productName=Unmarked objects (old),
count=70, id=131, productName=VS2008 SP1 build 30729, version=30729,
count=157, id=132, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=146, productName=VS2008 SP1 build 30729, version=30729,
count=1, id=148, productName=VS2008 build 21022, version=21022,
count=1, id=145, productName=VS2008 SP1 build 30729, version=30729,
Nov 6, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Nov 6, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=2, id=185, version=30716,
count=220, id=1, productName=Unmarked objects,
count=3, id=203, version=50929,
count=8, id=205, version=50929,
count=51, id=207, version=50929,
count=80, id=206, version=50929,
count=6, id=211, version=50929,
count=1, id=202, version=50929,
count=1, id=201, version=50929,
count=1, id=204, version=50929,
Nov 6, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Code Signing PCA 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
CN=Microsoft Root Certificate Authority 2011,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
Nov 6, 2012
CN=Microsoft Corporation,OU=MOPR,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US
count=178, id=1, productName=Unmarked objects,
count=3, id=185, version=30716,
count=491, id=206, version=50929,
count=97, id=205, version=50929,
count=55, id=211, version=50929,
count=184, id=207, version=50929,
count=1, id=202, version=50929,
count=1, id=201, version=50929,
count=1, id=204, version=50929,
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=199, version=41118,
count=19, id=205, version=50929,
count=54, id=207, version=50929,
count=125, id=206, version=50929,
count=100, id=1, productName=Unmarked objects,
count=3, id=185, version=30716,
count=36, id=211, version=60610,
count=2, id=205, productName=VS2012 UPD3 build 60610, version=60610,
count=1, id=202, productName=VS2012 UPD3 build 60610, version=60610,
count=1, id=201, productName=VS2012 UPD3 build 60610, version=60610,
count=1, id=151,
count=1, id=204, productName=VS2012 UPD3 build 60610, version=60610,
Unsigned PE
Checks for missing Authenticode signature.
count=1, id=199, version=41118,
count=21, id=205, version=50929,
count=69, id=207, version=50929,
count=134, id=206, version=50929,
count=3, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=106, id=1, productName=Unmarked objects,
count=36, id=207, productName=VS2012 UPD3 build 60610, version=60610,
count=2, id=205, productName=VS2012 UPD3 build 60610, version=60610,
count=1, id=202, productName=VS2012 UPD3 build 60610, version=60610,
count=1, id=201, productName=VS2012 UPD3 build 60610, version=60610,
count=1, id=151,
count=1, id=204, productName=VS2012 UPD3 build 60610, version=60610,