RobloxPlayerInstaller-TDW9VK3G4C[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
RobloxPlayerInstaller-TDW9VK3G4C.exe
Size 9.6MB
Sample260625-xtvrnae16n
SHA256 ff390fdfd02b4481f1aeb9212daebfb12a13e2403dc4ee67d976790fd285d924
MD5 752ddebfaf29d732af2b0413fdc7cd86
SHA1 31c644afafd3c5385664141b6ea82c8a62f3f60d
SHA512 f4d87133c681f7f1ec7ef991fd329450fc59211e4886dac4c2b42a60cc7d11c9d272c7cf69cc4cc88b48172dfae69cea11178ee1ded70f90af9e0b96351395b4
SSDEEP 196608:5sN+zrJKVLEqqTLcYmsxGeQYo00u83ZBCv5BYQynJA:5VKUsYmsxRjolu83ZBCvgQcJA
TLSH
T165A6AF22B901C032F8D100B296BD5FFA993D9A341B3954D3A7D45ABE5A305D33B39B1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
RobloxPlayerInstaller-TDW9VK3G4C.exe

File Explorer

RobloxPlayerInstaller-TDW9VK3G4C.exe

.exe 9.6MB

RobloxPlayerInstaller-TDW9VK3G4C.exe

IMPHASH 5b78a3a9724319212198dc169c2f0fd4
SHA256 ff390fdfd02b4481f1aeb9212daebfb12a13e2403dc4ee67d976790fd285d924
MD5 752ddebfaf29d732af2b0413fdc7cd86
SHA1 31c644afafd3c5385664141b6ea82c8a62f3f60d
SHA512 f4d87133c681f7f1ec7ef991fd329450fc59211e4886dac4c2b42a60cc7d11c9d272c7cf69cc4cc88b48172dfae69cea11178ee1ded70f90af9e0b96351395b4
SSDEEP 196608:5sN+zrJKVLEqqTLcYmsxGeQYo00u83ZBCv5BYQynJA:5VKUsYmsxRjolu83ZBCvgQcJA
TLSH
T165A6AF22B901C032F8D100B296BD5FFA993D9A341B3954D3A7D45ABE5A305D33B39B1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

89:b4:ba:bf:94:7f:18:c7:20:bb:e5:02:4c:fb:f8:a5:e9:91:e8:d0:9c:d6:a9:d5:0c:bb:e8:fb:bb:95:a6:cf

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jan 1, 0001

Subject

Serial Number

01:97:20:58:e4:2c:9c:ca:bd:73:0a:b1:26:7f:15:ed

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 19, 2025 - Dec 18, 2026

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

7091710

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\buildAgent\work\ci_deploy_ninja_boot-x86_git\build.ninja\common\vs2019\x86\release\Installer\Windows\RobloxPlayerInstaller.pdb

comctl32

InitCommonControlsEx _TrackMouseEvent ord345

gdiplus

GdiplusShutdown GdipCreateBitmapFromStream GdiplusStartup GdipFree GdipDisposeImage GdipCloneImage GdipAlloc GdipCreateHBITMAPFromBitmap

uxtheme

SetWindowTheme

advapi32

RegEnumKeyExW IsValidSid ReportEventW RegisterEventSourceW DeregisterEventSource CryptEnumProvidersW CryptSignHashW CryptDecrypt CryptExportKey GetTokenInformation CryptGenRandom SystemFunction036 CryptSetHashParam CryptGetProvParam CryptGetUserKey GetUserNameW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash RegCloseKey RegCreateKeyExW RegDeleteValueW RegOpenKeyExW RegSetValueExW RegGetValueW RegOpenKeyExA RegQueryValueExA CryptDestroyKey GetLengthSid RegQueryInfoKeyW RegQueryValueExW RegDeleteTreeW OpenProcessToken AllocateAndInitializeSid CopySid EqualSid FreeSid

crypt32

CertDuplicateCertificateContext CertFindCertificateInStore CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreA CertOpenStore CertGetCertificateContextProperty CertOpenSystemStoreW

ws2_32

inet_addr inet_ntop sendto gethostbyname getservbyport getservbyname shutdown gethostname getnameinfo WSASocketA htonl htons getsockopt send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAGetLastError socket setsockopt ntohs ntohl closesocket gethostbyaddr WSAEventSelect ioctlsocket freeaddrinfo getaddrinfo listen bind select __WSAFDIsSet WSAIoctl WSASetLastError recv getsockname getpeername connect accept WSACleanup WSAStartup recvfrom WSAWaitForMultipleEvents WSASetEvent WSAResetEvent inet_ntoa

iphlpapi

GetAdaptersAddresses if_nametoindex

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress

dbghelp

SymFromAddr

shell32

SHGetKnownFolderPath ShellExecuteExW SHGetFolderPathAndSubDirW Shell_NotifyIconW ShellExecuteW

kernel32

InitializeSListHead IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount GetCPInfo UnhandledExceptionFilter GetStartupInfoW RtlUnwind LCMapStringEx EncodePointer GetLocaleInfoEx InitOnceComplete InitOnceBeginInitialize SwitchToThread SleepConditionVariableCS WakeAllConditionVariable GetStringTypeW GetCommandLineA ExitThread FreeLibraryAndExitThread SetStdHandle IsDebuggerPresent DebugBreak OutputDebugStringW CloseHandle GetLastError SetLastError HeapAlloc HeapFree GetProcessHeap ReleaseSemaphore ReleaseMutex WaitForSingleObject WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW CreateSemaphoreExW GetCurrentProcessId GetCurrentThreadId GetModuleFileNameA GetModuleHandleW GetModuleHandleExW GetProcAddress FormatMessageW SetSearchPathMode GetCommandLineW VerSetConditionMask FindClose FindFirstFileW FindNextFileW GetDiskFreeSpaceExW CreateFileMappingW VerifyVersionInfoW LocaleNameToLCID GetUserDefaultLocaleName SetWaitableTimer CancelWaitableTimer CreateWaitableTimerW Sleep CreateEventA SetEvent SetUnhandledExceptionFilter CreateEventW OpenEventW TerminateProcess GetExitCodeProcess GetCurrentThread CreateProcessW SetThreadDescription GetSystemTime CreateFileW GetDriveTypeW GetVolumePathNameW GetFileInformationByHandleEx ExitProcess ReadFile MapViewOfFile UnmapViewOfFile DeleteFileW GetFileAttributesW SetFileAttributesW InitializeProcThreadAttributeList UpdateProcThreadAttribute OpenProcess GetModuleFileNameW SystemTimeToFileTime CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW QueryPerformanceFrequency QueryPerformanceCounter GetCurrentProcessorNumber GetSystemInfo VirtualAlloc VirtualProtect VirtualFree CreateThread GetCurrentProcess GlobalMemoryStatusEx K32GetProcessMemoryInfo CreateSemaphoreA WaitForMultipleObjectsEx GetSystemTimeAsFileTime GetVersionExA IsWow64Process LoadLibraryA OutputDebugStringA GetModuleHandleA MultiByteToWideChar K32GetProcessImageFileNameA Process32First Process32Next SetEndOfFile SetFilePointer FlushViewOfFile WideCharToMultiByte FileTimeToSystemTime DecodePointer RaiseException InitializeCriticalSectionEx DeleteCriticalSection GetNativeSystemInfo LoadLibraryExW DuplicateHandle GetTickCount LoadLibraryW VirtualQuery LocalAlloc LocalFree FindResourceExW LoadResource LockResource SizeofResource FindResourceW GlobalAlloc GlobalFree GlobalUnlock GlobalLock CreateDirectoryW GetFileSizeEx RemoveDirectoryW WriteFile CopyFileW CompareStringEx GetSystemFirmwareTable FreeLibrary GetEnvironmentVariableW ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection SleepEx CreateFileA GetFullPathNameW MoveFileExA CompareFileTime GetEnvironmentVariableA FormatMessageA FlushFileBuffers LockFileEx UnlockFile HeapDestroy HeapCompact HeapReAlloc DeleteFileA GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate CreateMutexW GetTempPathW UnlockFileEx GetFullPathNameA LockFile GetDiskFreeSpaceW HeapCreate AreFileApisANSI InitializeCriticalSection TryEnterCriticalSection GetCurrentDirectoryW InitializeSRWLock InitializeConditionVariable WakeConditionVariable SleepConditionVariableSRW GetLogicalProcessorInformation GetFileInformationByHandle GetFileTime SetFilePointerEx SetFileTime DeviceIoControl MoveFileExW ResetEvent TlsAlloc TlsGetValue TlsSetValue TlsFree CreateWaitableTimerA WriteConsoleW GetStdHandle GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW ReleaseSRWLockShared AcquireSRWLockShared SwitchToFiber DeleteFiber CreateFiberEx GetSystemDirectoryA GetExitCodeThread GetACP GetFileType ConvertFiberToThread ConvertThreadToFiberEx PeekNamedPipe SystemTimeToTzSpecificLocalTime GetConsoleOutputCP SetEnvironmentVariableW SetConsoleCtrlHandler GetTimeZoneInformation GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale InterlockedPushEntrySList GetUserDefaultLCID EnumSystemLocalesW FindFirstFileExW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW GetFinalPathNameByHandleW GetFileSize

user32

InvalidateRect EndPaint BeginPaint DrawTextW GetSystemMetrics EnumDisplayDevicesA GetUserObjectInformationW GetProcessWindowStation GetClientRect GetWindowRect GetWindowThreadProcessId SendMessageW MessageBoxW GetShellWindow TranslateAcceleratorW LoadAcceleratorsW DispatchMessageW TranslateMessage FillRect GetWindowLongW SetWindowLongW LoadBitmapW LoadIconW DefWindowProcW PostQuitMessage CallWindowProcW RegisterClassW GetMessageW DestroyIcon CreateWindowExW DestroyWindow ShowWindow GetDlgItem EnableWindow

gdi32

DeleteObject CreateSolidBrush SelectObject CreateFontW GetStockObject Rectangle SetDCPenColor SetBkMode SetDCBrushColor SetTextColor

ole32

CoCreateGuid StringFromGUID2 CoTaskMemFree CoTaskMemAlloc CoUninitialize CoInitialize CoCreateInstance CoInitializeEx

shlwapi

PathFindFileNameW PathFindExtensionW ord12

powrprof

CallNtPowerInformation

winmm

timeGetTime timeSetEvent timeGetDevCaps timeBeginPeriod timeEndPeriod

Sharing

General

Malware Config

Signatures

File Explorer

RobloxPlayerInstaller-TDW9VK3G4C.exe

PE Signature issue

comctl32

gdiplus

uxtheme

advapi32

crypt32

ws2_32

iphlpapi

api-ms-win-core-synch-l1-2-0

dbghelp

shell32

kernel32

user32

gdi32

ole32

shlwapi

powrprof

winmm

generic