RobloxStudioInstaller[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
RobloxStudioInstaller.exe
Size 7.7MB
Sample260629-axg9eahw71
SHA256 653b5ff08c0c890e103e31f53fcf6b9cfbbf462fc4481a62ffc84cf4f0c562dd
MD5 c26f2f88223b100d1caa2e254aeb3fd2
SHA1 a6543b3d00c198f86f6e2118242aa402b8672ac3
SHA512 e2031cd73321b54dd6c1ca4ecafcc7754678dbac20e4b75aa65909c7ef7d3d68a48b253bdc9af7f73c3fd9feba630a0769da6138256d1d035f5862cc97763e46
SSDEEP 196608:jVQLDyoinEnwR5fvhho+CsBh1ocRPRKRqYYc:jHrEnk53hG+CsRoaK
TLSH
T19386BE22F944C031E5D101B2A6BD6FB99D7D99341B3858D77BC80DB84A705E3363AB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
RobloxStudioInstaller.exe

File Explorer

RobloxStudioInstaller.exe

.exe 7.7MB

RobloxStudioInstaller.exe

IMPHASH ca9eacd2ca50fb06ea9bbac5630e0c63
SHA256 653b5ff08c0c890e103e31f53fcf6b9cfbbf462fc4481a62ffc84cf4f0c562dd
MD5 c26f2f88223b100d1caa2e254aeb3fd2
SHA1 a6543b3d00c198f86f6e2118242aa402b8672ac3
SHA512 e2031cd73321b54dd6c1ca4ecafcc7754678dbac20e4b75aa65909c7ef7d3d68a48b253bdc9af7f73c3fd9feba630a0769da6138256d1d035f5862cc97763e46
SSDEEP 196608:jVQLDyoinEnwR5fvhho+CsBh1ocRPRKRqYYc:jHrEnk53hG+CsRoaK
TLSH
T19386BE22F944C031E5D101B2A6BD6FB99D7D99341B3858D77BC80DB84A705E3363AB2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

c2:cc:3d:1b:6f:92:80:e9:44:6a:f8:a1:88:f0:c0:e0:b7:4a:76:23:bd:b7:06:2b:9c:c2:42:1b:dc:70:79:c3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jan 1, 0001

Subject

Serial Number

07:1f:a3:3b:b6:bd:8f:10:10:42:ed:aa:0e:b2:dd:28

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jan 9, 2025 - Jan 8, 2026

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert Timestamp 2024,O=DigiCert,C=US

Serial Number

0b:ae:66:bc:5a:ba:7f:95:87:c6:f9:e9:04:e3:33:04

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Sep 26, 2024 - Nov 25, 2035

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Serial Number

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Mar 23, 2022 - Mar 22, 2037

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

5264005

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\buildAgent\work\ci_deploy_ninja_boot-x86_git\build.ninja\common\vs2019\x86\release\Installer\Windows\RobloxStudioInstaller.pdb

comctl32

_TrackMouseEvent InitCommonControlsEx

gdiplus

GdipCreateHBITMAPFromBitmap GdiplusStartup GdiplusShutdown GdipCloneImage GdipDisposeImage GdipCreateBitmapFromStream GdipAlloc GdipFree

wininet

InternetConnectW HttpQueryInfoW HttpSendRequestW HttpAddRequestHeadersW InternetQueryDataAvailable InternetQueryOptionW InternetSetStatusCallbackW InternetReadFile InternetOpenW InternetCloseHandle HttpOpenRequestW

shell32

ShellExecuteExW Shell_NotifyIconW SHGetKnownFolderPath SHGetFolderPathAndSubDirW

iphlpapi

GetAdaptersAddresses

ws2_32

gethostname shutdown getservbyname getservbyport gethostbyname gethostbyaddr ioctlsocket freeaddrinfo inet_ntoa listen select __WSAFDIsSet WSAIoctl setsockopt recv getsockname getpeername connect bind accept WSACleanup WSAStartup WSASetLastError inet_pton WSAGetLastError WSACreateEvent WSACloseEvent send getsockopt htons inet_ntop socket ntohs ntohl closesocket htonl inet_addr sendto recvfrom getnameinfo getaddrinfo

advapi32

CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW GetUserNameW RegCloseKey RegCreateKeyExW RegDeleteValueW RegOpenKeyExW RegSetValueExW RegGetValueW RegOpenKeyExA RegQueryValueExA CryptAcquireContextA CryptDestroyKey CryptGenRandom SystemFunction036 CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptSignHashW CryptEnumProvidersW DeregisterEventSource RegisterEventSourceW ReportEventW RegEnumKeyExW RegQueryInfoKeyW RegQueryValueExW RegDeleteTreeW OpenProcessToken AllocateAndInitializeSid CopySid EqualSid FreeSid GetLengthSid GetTokenInformation IsValidSid

crypt32

CertCloseStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreA CertGetCertificateContextProperty CertDuplicateCertificateContext CertFindCertificateInStore CertOpenStore CertOpenSystemStoreW CertEnumCertificatesInStore

kernel32

WakeAllConditionVariable SleepConditionVariableCS SleepConditionVariableSRW SwitchToThread InitOnceBeginInitialize InitOnceComplete EncodePointer LCMapStringEx InitializeConditionVariable GetCPInfo GetLocaleInfoEx InitializeCriticalSectionAndSpinCount IsProcessorFeaturePresent InitializeSListHead UnhandledExceptionFilter GetStartupInfoW RtlUnwind InterlockedPushEntrySList GetCommandLineA WakeConditionVariable CreateThread DebugBreak HeapAlloc HeapFree GetProcessHeap GetCurrentThreadId GetModuleFileNameA GetModuleHandleW GetModuleHandleExW GetProcAddress FormatMessageW SetSearchPathMode GetCommandLineW IsDebuggerPresent OutputDebugStringW CloseHandle GetLastError SetLastError ReleaseSemaphore ReleaseMutex WaitForSingleObject WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW CreateSemaphoreExW GetCurrentProcessId VerSetConditionMask GetDiskFreeSpaceExW CreateFileMappingW VerifyVersionInfoW MulDiv LocaleNameToLCID GetUserDefaultLocaleName SetWaitableTimer CancelWaitableTimer CreateWaitableTimerW Sleep CreateEventA SetEvent FindClose FindFirstFileW FindNextFileW SetUnhandledExceptionFilter CreateEventW OpenEventW TerminateProcess GetExitCodeProcess CreateProcessW GetSystemTime CreateFileW ExitThread ReadFile MapViewOfFile UnmapViewOfFile DeleteFileW InitializeProcThreadAttributeList UpdateProcThreadAttribute OpenProcess GetModuleFileNameW SystemTimeToFileTime CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW GetCurrentProcess GlobalMemoryStatusEx K32GetProcessMemoryInfo GetCurrentProcessorNumber GetSystemInfo GetSystemTimeAsFileTime GetVersionExA IsWow64Process LoadLibraryA ResetEvent CreateSemaphoreA DuplicateHandle GetModuleHandleA GetTickCount OutputDebugStringA QueryPerformanceCounter QueryPerformanceFrequency FileTimeToSystemTime MultiByteToWideChar WideCharToMultiByte GetNativeSystemInfo LoadLibraryExW DecodePointer RaiseException InitializeCriticalSectionEx DeleteCriticalSection VirtualQuery GetCurrentThread LoadLibraryW WaitForMultipleObjectsEx LocalAlloc LocalFree FindResourceExW LoadResource LockResource SizeofResource FindResourceW CreateDirectoryW GetFileAttributesW GetFileSizeEx RemoveDirectoryW SetFileAttributesW WriteFile CopyFileW MoveFileW GlobalAlloc GlobalFree GlobalUnlock GlobalLock CompareStringEx FreeLibrary GetEnvironmentVariableW FlushFileBuffers FormatMessageA LockFileEx CreateFileMappingA UnlockFile HeapDestroy HeapCompact HeapReAlloc DeleteFileA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate GetVersionExW CreateMutexW GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW GetFullPathNameW HeapCreate AreFileApisANSI ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection GetSystemDirectoryA SleepEx MoveFileExA GetEnvironmentVariableA CompareFileTime VirtualAlloc VirtualProtect VirtualFree ReleaseSRWLockShared AcquireSRWLockShared GetCurrentDirectoryW GetFileInformationByHandle GetFileTime SetFilePointerEx SetFileTime DeviceIoControl MoveFileExW ResumeThread TlsAlloc TlsGetValue TlsSetValue TlsFree CreateWaitableTimerA InitializeCriticalSection WriteConsoleW GetStdHandle GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW InitializeSRWLock SwitchToFiber DeleteFiber CreateFiberEx TryEnterCriticalSection GetExitCodeThread GetACP GetFileType ConvertFiberToThread ConvertThreadToFiberEx FreeLibraryAndExitThread SetStdHandle GetDriveTypeW PeekNamedPipe SystemTimeToTzSpecificLocalTime SetConsoleCtrlHandler ExitProcess GetConsoleOutputCP GetStringTypeW GetTimeZoneInformation GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW FindFirstFileExW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW GetFinalPathNameByHandleW GetFileSize

user32

FillRect GetWindowRect InvalidateRect EndPaint BeginPaint GetDC DrawTextW GetSystemMetrics EnableWindow KillTimer GetWindowThreadProcessId GetWindowLongW GetDlgItem ShowWindow DestroyWindow SetWindowLongW GetUserObjectInformationW GetProcessWindowStation LoadIconW DestroyIcon MessageBoxW SendMessageW DefWindowProcW GetShellWindow TranslateAcceleratorW LoadAcceleratorsW DispatchMessageW TranslateMessage LoadBitmapW GetDlgCtrlID EnumDisplayDevicesA PostQuitMessage CallWindowProcW RegisterClassW CreateWindowExW SetTimer GetMessageW

gdi32

SetDCPenColor SetTextColor SelectObject RoundRect Rectangle GetStockObject GetDeviceCaps DeleteObject DeleteDC CreateSolidBrush CreatePen CreateFontW SetBkMode SetDCBrushColor

ole32

CoInitializeEx CoTaskMemAlloc CoTaskMemFree CoUninitialize CoInitialize CoCreateGuid CoCreateInstance StringFromGUID2

shlwapi

PathFindFileNameW PathFindExtensionW ord12

powrprof

CallNtPowerInformation

winmm

timeGetDevCaps timeGetTime timeBeginPeriod timeSetEvent

Sharing

General

Malware Config

Signatures

File Explorer

RobloxStudioInstaller.exe

PE Signature issue

comctl32

gdiplus

wininet

shell32

iphlpapi

ws2_32

advapi32

crypt32

kernel32

user32

gdi32

ole32

shlwapi

powrprof

winmm

generic