RobloxPlayerInstaller[.]exe

Target
RobloxPlayerInstaller.exe
Size 9.5MB
Sample260702-kfm4faex2v
SHA256 340c9103a94ded6f1db7a36dc8513d8f2a14f5dfaa3398c5f43f9739483b2dbf
MD5 c45ae0d98270b32567b6a6dcc719dbfd
SHA1 c4a31f649ac8a8472352eaa680c5d4fa87922b18
SHA512 9b55935fee10357609fc69b2107db3b23ceba869d8503defe73dbf4572e427021320b7e01ff038cbb4f92c1d41bc88944430526715d030cb32800c2ec764231c
SSDEEP 196608:WeAMbzCW5uZ5Weyd2QLzdOIX6GPAXItWpyRaBnU64yYT:WKO5Mzd/XpPAXItWpeyXA
TLSH
T13DA6CE22F940C031E9D202B2A6BD6FB65D7D9A341B3948C767C45DB845305E33B3AB6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
RobloxPlayerInstaller.exe

File Explorer

RobloxPlayerInstaller.exe

.exe 9.5MB

RobloxPlayerInstaller.exe

IMPHASH bb1785bce6e9d97eee93ef24df272dd5
SHA256 340c9103a94ded6f1db7a36dc8513d8f2a14f5dfaa3398c5f43f9739483b2dbf
MD5 c45ae0d98270b32567b6a6dcc719dbfd
SHA1 c4a31f649ac8a8472352eaa680c5d4fa87922b18
SHA512 9b55935fee10357609fc69b2107db3b23ceba869d8503defe73dbf4572e427021320b7e01ff038cbb4f92c1d41bc88944430526715d030cb32800c2ec764231c
SSDEEP 196608:WeAMbzCW5uZ5Weyd2QLzdOIX6GPAXItWpyRaBnU64yYT:WKO5Mzd/XpPAXItWpeyXA
TLSH
T13DA6CE22F940C031E9D202B2A6BD6FB65D7D9A341B3948C767C45DB845305E33B3AB6B
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

0d:9d:ac:76:55:af:b1:28:6b:8a:a7:df:2f:e8:d5:a5:71:81:d4:3c:8f:23:c4:0a:36:44:b4:13:06:bd:d9:d7

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jan 1, 0001

Subject

Serial Number

01:97:20:58:e4:2c:9c:ca:bd:73:0a:b1:26:7f:15:ed

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 19, 2025 - Dec 18, 2026

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

6935454

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\buildAgent\work\ci_deploy_ninja_boot-x86_git\build.ninja\common\vs2019\x86\release\Installer\Windows\RobloxPlayerInstaller.pdb

comctl32

InitCommonControlsEx _TrackMouseEvent ord345

gdiplus

GdiplusStartup GdiplusShutdown GdipCloneImage GdipDisposeImage GdipCreateBitmapFromStream GdipFree GdipCreateHBITMAPFromBitmap GdipAlloc

wininet

InternetConnectW InternetQueryDataAvailable HttpQueryInfoW HttpSendRequestW HttpAddRequestHeadersW InternetCloseHandle InternetOpenW HttpOpenRequestW InternetSetStatusCallbackW InternetQueryOptionW InternetReadFile

uxtheme

SetWindowTheme

advapi32

EqualSid RegCreateKeyExW RegCloseKey CryptDestroyHash IsValidSid GetTokenInformation GetLengthSid FreeSid CryptHashData CopySid AllocateAndInitializeSid OpenProcessToken RegDeleteTreeW RegQueryValueExW RegQueryInfoKeyW RegEnumKeyExW CryptDestroyKey CryptAcquireContextA RegQueryValueExA RegOpenKeyExA RegGetValueW RegSetValueExW RegOpenKeyExW GetUserNameW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash RegDeleteValueW

iphlpapi

GetAdaptersAddresses

ws2_32

getsockopt htons WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSASetEvent ntohs ioctlsocket freeaddrinfo getaddrinfo listen select __WSAFDIsSet WSAWaitForMultipleEvents WSAIoctl recv getsockname getpeername connect setsockopt bind accept WSACleanup WSAStartup WSASetLastError recvfrom closesocket ntohl getnameinfo gethostname send htonl socket WSAGetLastError inet_ntop getservbyname WSASocketA sendto inet_addr inet_ntoa gethostbyaddr gethostbyname getservbyport shutdown

crypt32

CertOpenSystemStoreA CertGetIntendedKeyUsage CertGetEnhancedKeyUsage CertFreeCertificateContext CertEnumCertificatesInStore CertCloseStore CertOpenSystemStoreW CertGetCertificateContextProperty CertDuplicateCertificateContext CertFindCertificateInStore CertOpenStore

dbghelp

SymFromAddr

shell32

Shell_NotifyIconW SHGetFolderPathAndSubDirW ShellExecuteExW SHGetKnownFolderPath ShellExecuteW

kernel32

GetEnvironmentStringsW InterlockedPushEntrySList RtlUnwind GetOEMCP IsValidCodePage FindFirstFileExW EnumSystemLocalesW FreeEnvironmentStringsW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetTimeZoneInformation SetConsoleCtrlHandler SetEnvironmentVariableW ConvertThreadToFiberEx ConvertFiberToThread GetFileType GetACP GetExitCodeThread CreateFiberEx DeleteFiber SwitchToFiber AcquireSRWLockShared ReleaseSRWLockShared ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode GetStdHandle WriteConsoleW GetConsoleOutputCP SystemTimeToTzSpecificLocalTime PeekNamedPipe ExitProcess SetStdHandle FreeLibraryAndExitThread ExitThread GetCommandLineA CreateWaitableTimerA TlsFree TlsSetValue TlsGetValue TlsAlloc MoveFileExW DeviceIoControl SetFileTime SetFilePointerEx GetFileTime GetFileInformationByHandle GetLogicalProcessorInformation VirtualAlloc IsDebuggerPresent DebugBreak OutputDebugStringW CloseHandle GetLastError SetLastError HeapAlloc HeapFree GetProcessHeap ReleaseSemaphore ReleaseMutex WaitForSingleObject WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW CreateSemaphoreExW GetCurrentProcessId GetCurrentThreadId GetModuleFileNameA GetModuleHandleW GetModuleHandleExW GetProcAddress FormatMessageW SetSearchPathMode GetCommandLineW VerSetConditionMask GetDiskFreeSpaceExW CreateFileMappingW VerifyVersionInfoW LocaleNameToLCID GetUserDefaultLocaleName SetWaitableTimer CancelWaitableTimer CreateWaitableTimerW Sleep CreateEventA SetEvent FindClose FindFirstFileW FindNextFileW SetUnhandledExceptionFilter CreateEventW OpenEventW TerminateProcess GetExitCodeProcess CreateProcessW GetSystemTime CreateFileW GetDriveTypeW GetVolumePathNameW GetFileInformationByHandleEx GetFileSize ReadFile MapViewOfFile UnmapViewOfFile DeleteFileW GetFileAttributesW SetFileAttributesW InitializeProcThreadAttributeList UpdateProcThreadAttribute OpenProcess GetModuleFileNameW SystemTimeToFileTime CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW GetCurrentProcessorNumber GetSystemInfo QueryPerformanceCounter QueryPerformanceFrequency VirtualFree CreateThread GetCurrentProcess GlobalMemoryStatusEx K32GetProcessMemoryInfo GetProcessHandleCount GetSystemTimeAsFileTime GetVersionExA IsWow64Process LoadLibraryA ResetEvent OutputDebugStringA GetModuleHandleA CreateSemaphoreA DuplicateHandle MultiByteToWideChar K32GetProcessImageFileNameA Process32First Process32Next SetEndOfFile SetFilePointer FlushViewOfFile WideCharToMultiByte FileTimeToSystemTime DecodePointer RaiseException InitializeCriticalSectionEx DeleteCriticalSection GetNativeSystemInfo LoadLibraryExW WaitForMultipleObjectsEx GetTickCount GetCurrentThread LoadLibraryW VirtualQuery LocalAlloc LocalFree FindResourceExW LoadResource LockResource SizeofResource FindResourceW CreateDirectoryW GetFileSizeEx RemoveDirectoryW WriteFile CopyFileW GlobalAlloc GlobalFree GlobalUnlock GlobalLock CompareStringEx GetSystemFirmwareTable FreeLibrary GetEnvironmentVariableW ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection GetSystemDirectoryA SleepEx GetFullPathNameW MoveFileExA GetEnvironmentVariableA CompareFileTime FlushFileBuffers FormatMessageA LockFileEx UnlockFile HeapDestroy HeapCompact HeapReAlloc DeleteFileA CreateFileA GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate CreateMutexW GetTempPathW UnlockFileEx GetFullPathNameA LockFile GetDiskFreeSpaceW HeapCreate AreFileApisANSI InitializeCriticalSection TryEnterCriticalSection GetCurrentDirectoryW InitializeSRWLock InitializeConditionVariable WakeConditionVariable SleepConditionVariableSRW

user32

GetProcessWindowStation GetUserObjectInformationW EnumDisplayDevicesA GetWindowThreadProcessId GetShellWindow TranslateAcceleratorW LoadAcceleratorsW DispatchMessageW TranslateMessage GetMessageW DestroyIcon LoadIconW SetWindowLongW GetWindowLongW FillRect GetWindowRect GetClientRect InvalidateRect LoadBitmapW SendMessageW MessageBoxW DefWindowProcW PostQuitMessage CallWindowProcW RegisterClassW CreateWindowExW DestroyWindow ShowWindow GetDlgItem EnableWindow GetSystemMetrics DrawTextW BeginPaint EndPaint

gdi32

SetDCBrushColor SetDCPenColor SetBkMode SetTextColor SelectObject Rectangle DeleteObject CreateSolidBrush CreateFontW GetStockObject

ole32

StringFromGUID2 CoTaskMemFree CoInitialize CoUninitialize CoTaskMemAlloc CoCreateInstance CoCreateGuid CoInitializeEx

shlwapi

PathFindExtensionW ord12 PathFindFileNameW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll InitOnceBeginInitialize InitOnceComplete SleepConditionVariableCS WakeAllConditionVariable WaitOnAddress

api-ms-win-core-memory-l1-1-3

VirtualProtectFromApp VirtualAllocFromApp

api-ms-win-power-base-l1-1-0

CallNtPowerInformation

api-ms-win-mm-time-l1-1-0

timeBeginPeriod timeGetDevCaps timeGetTime

api-ms-win-security-cryptoapi-l1-1-0

CryptEnumProvidersW CryptGenRandom CryptSetHashParam CryptSignHashW CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt

api-ms-win-security-systemfunctions-l1-1-0

SystemFunction036

api-ms-win-eventlog-legacy-l1-1-0

RegisterEventSourceW ReportEventW DeregisterEventSource

api-ms-win-core-string-l1-1-0

GetStringTypeW

api-ms-win-core-processthreads-l1-1-0

SwitchToThread GetStartupInfoW

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionAndSpinCount

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx GetCPInfo LCMapStringEx

api-ms-win-core-util-l1-1-0

EncodePointer

api-ms-win-core-file-l1-1-0

GetFinalPathNameByHandleW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter

winmm

timeSetEvent

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

RobloxPlayerInstaller.exe

PE Signature issue

comctl32

gdiplus

wininet

uxtheme

advapi32

iphlpapi

ws2_32

crypt32

dbghelp

shell32

kernel32

user32

gdi32

ole32

shlwapi

api-ms-win-core-synch-l1-2-0

api-ms-win-core-memory-l1-1-3

api-ms-win-power-base-l1-1-0

api-ms-win-mm-time-l1-1-0

api-ms-win-security-cryptoapi-l1-1-0

api-ms-win-security-systemfunctions-l1-1-0

api-ms-win-eventlog-legacy-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

winmm

generic