robux[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
robux.exe
Size 1.7MB
Sample260625-wp64fses8m
SHA256 acaf609bb1ab070117d4fc399f86e23f3a4ab727513bab3f9a4ea6ef267c0f58
MD5 cf556edad43f3d0296cdad2a643bd186
SHA1 b33d43d7bd1ea5eeea0c02548664d842f3fefbcb
SHA512 f62cd2214e412ac69d7d637d7549165bd3cffa221ccd0a458e1c5c45580413d354d162f2d6c56edb96c22e27561fd452934c4c0c266a9c9650988967e478fc13
SSDEEP 24576:rePEC/abY66GAvye3Dja3gmOVmn/26La2IiOg8vPoPidc+UJQrrpMrhP39zPJS63:TPY+AKOH4gdQ/nLa2IU8vPtyCqh/S
TLSH
T193851242D3564054D339123CB0F08F63D766ED5A43AE6BD75E91B0327EE93C829E2B85
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
robux.exe

File Explorer

robux.exe

.exe 1.7MB

robux.exe

IMPHASH b19c4b464783e7b3e8c5b79955a2b218
SHA256 acaf609bb1ab070117d4fc399f86e23f3a4ab727513bab3f9a4ea6ef267c0f58
MD5 cf556edad43f3d0296cdad2a643bd186
SHA1 b33d43d7bd1ea5eeea0c02548664d842f3fefbcb
SHA512 f62cd2214e412ac69d7d637d7549165bd3cffa221ccd0a458e1c5c45580413d354d162f2d6c56edb96c22e27561fd452934c4c0c266a9c9650988967e478fc13
SSDEEP 24576:rePEC/abY66GAvye3Dja3gmOVmn/26La2IiOg8vPoPidc+UJQrrpMrhP39zPJS63:TPY+AKOH4gdQ/nLa2IU8vPtyCqh/S
TLSH
T193851242D3564054D339123CB0F08F63D766ED5A43AE6BD75E91B0327EE93C829E2B85
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

35680

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter GetCurrentProcess TerminateProcess IsProcessorFeaturePresent RtlCaptureContext QueryPerformanceCounter GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime ReleaseSRWLockExclusive InitializeSListHead SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive GetModuleHandleW GlobalLock GlobalFree GetTickCount64 IsDebuggerPresent Sleep

user32

GetMessageW DefWindowProcW FindWindowExW SetWindowPos CreateWindowExW GetSystemMetrics DispatchMessageW SetTimer RegisterClassW SetLayeredWindowAttributes EndPaint TranslateMessage FindWindowW LoadCursorW GetClientRect PostQuitMessage UpdateWindow InvalidateRect BeginPaint

gdi32

DeleteDC DeleteObject GetStockObject SelectObject BitBlt

advapi32

RegCloseKey RegSetValueExW

shell32

SHGetFolderPathW

ole32

CreateStreamOnHGlobal

msvcp140

?_Xbad_alloc@std@@YAXXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?uncaught_exceptions@std@@YAHXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?_Xlength_error@std@@YAXPEBD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z

wininet

HttpOpenRequestA InternetConnectA InternetOpenA

winmm

mciSendStringW

gdiplus

GdipAlloc GdipDrawImageRectI GdipDisposeImage GdipGraphicsClear GdipFree GdipImageSelectActiveFrame GdipCreateFromHDC GdipImageGetFrameCount GdipDeleteGraphics GdipGetImageWidth GdipLoadImageFromStream GdipGetPropertyItem GdipCloneImage GdipGetImageHeight GdiplusShutdown GdiplusStartup GdipGetPropertyItemSize

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy memmove memset __current_exception_context __current_exception _CxxThrowException __C_specific_handler __std_terminate __std_exception_destroy __std_exception_copy

api-ms-win-crt-stdio-l1-1-0

_set_fmode _fseeki64 fread fsetpos ungetc setvbuf fgetpos __p__commode fwrite fflush _get_stream_buffer_pointers fgetc fclose fputc

api-ms-win-crt-runtime-l1-1-0

__p___argv __p___argc _exit _invoke_watson _c_exit _register_thread_local_exe_atexit_callback _configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type terminate _get_initial_narrow_environment _initterm _initterm_e exit

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-heap-l1-1-0

_set_new_mode malloc _callnewh free

api-ms-win-crt-math-l1-1-0

__setusermatherr

api-ms-win-crt-locale-l1-1-0

_configthreadlocale