MultiRoblox[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
MultiRoblox.exe
Size 7.7MB
Sample260717-mesnmsgz8q
SHA256 e663bb178c801d33d159f4d681cfe9da3a3ee1043bad29e6a0e8705b8303d9bb
MD5 5569a4670429d3640f62a82c5511b380
SHA1 2c532f09736b46c966b0a880fde48e5fea43ca91
SHA512 2fb58698cd9382de6f3a2eba8a1d58f93098b4818428ec9b4a80100ca28700063015eeb78c1a71885e979e53078996e6c411456b58ee14a69f8bc90a111e382e
SSDEEP 98304:0ogDJoCmNpy4akZZH81Q2LKxK7tIE1rDdmp1On+0:01GCmN37Hc/Dcp10
TLSH
T13C864A03F6A281E8C0AEC474835AA733E772B8CD493472EB5BA45B212F56F506F1D749
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
MultiRoblox.exe

File Explorer

MultiRoblox.exe

.exe 7.7MB

MultiRoblox.exe

IMPHASH d449b9473aa1c0cb52e39983be9ef394
SHA256 e663bb178c801d33d159f4d681cfe9da3a3ee1043bad29e6a0e8705b8303d9bb
MD5 5569a4670429d3640f62a82c5511b380
SHA1 2c532f09736b46c966b0a880fde48e5fea43ca91
SHA512 2fb58698cd9382de6f3a2eba8a1d58f93098b4818428ec9b4a80100ca28700063015eeb78c1a71885e979e53078996e6c411456b58ee14a69f8bc90a111e382e
SSDEEP 98304:0ogDJoCmNpy4akZZH81Q2LKxK7tIE1rDdmp1On+0:01GCmN37Hc/Dcp10
TLSH
T13C864A03F6A281E8C0AEC474835AA733E772B8CD493472EB5BA45B212F56F506F1D749
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

6038976

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

MultiRoblox.pdb

bcryptprimitives

ProcessPrng

ntdll

NtCreateFile NtCreateNamedPipeFile NtCancelIoFileEx NtDeviceIoControlFile NtOpenFile RtlNtStatusToDosError NtReadFile RtlGetVersion NtWriteFile

kernel32

SetFileCompletionNotificationModes RegisterWaitForSingleObject SetLastError GetSystemTimeAsFileTime lstrlenW LoadLibraryA GetSystemTimePreciseAsFileTime FindClose IsDebuggerPresent LocalFree SleepConditionVariableSRW WakeAllConditionVariable SwitchToThread AcquireSRWLockExclusive HeapReAlloc HeapFree ReleaseSRWLockExclusive GetProcessHeap GetCurrentThread SetThreadStackGuarantee IsProcessorFeaturePresent GetModuleHandleW LoadLibraryW GetModuleHandleA FreeEnvironmentStringsW Sleep RtlLookupFunctionEntry WaitForSingleObjectEx GetCurrentProcess GetCurrentProcessId WideCharToMultiByte ReleaseMutex WaitForSingleObject MultiByteToWideChar HeapAlloc GetProcAddress SleepEx FormatMessageW SetHandleInformation SetFileTime FindFirstFileExW GetFileInformationByHandle GetUserDefaultUILanguage ExitProcess TerminateProcess GetExitCodeProcess GetSystemDirectoryW GetWindowsDirectoryW GetFileAttributesW GetModuleFileNameW DuplicateHandle GetTempPathW CreateSymbolicLinkW SetWaitableTimer SetFilePointerEx FindNextFileW GetEnvironmentStringsW QueryPerformanceCounter QueryPerformanceFrequency GetEnvironmentVariableW GetCurrentDirectoryW RtlVirtualUnwind RtlCaptureContext LCIDToLocaleName GetCommandLineW SetEnvironmentVariableW GetCurrentThreadId GetLastError CloseHandle AddVectoredExceptionHandler CreateWaitableTimerExW DeviceIoControl CreateProcessW CreateDirectoryW CreateThread WriteFileEx ReadFileEx WriteConsoleW GetConsoleOutputCP GetConsoleMode GetStdHandle CreateMutexA SetNamedPipeHandleState CreateFileW CancelIoEx CreateIoCompletionPort GetQueuedCompletionStatusEx ReadFile PostQueuedCompletionStatus InitializeSListHead WriteFile GetOverlappedResult GetFinalPathNameByHandleW SetUnhandledExceptionFilter DeleteFileW SetFileInformationByHandle UnhandledExceptionFilter CompareStringOrdinal GetProcessId FreeLibrary LoadLibraryExW OutputDebugStringW OutputDebugStringA GlobalAlloc LoadLibraryExA GlobalFree GetBinaryTypeW UnregisterWaitEx OpenProcess GetFullPathNameW GetFileInformationByHandleEx GetSystemInfo

advapi32

EventWriteTransfer EventSetInformation EventRegister RegOpenKeyExW RegCloseKey RegGetValueW SystemFunction036 EventUnregister RegQueryValueExW

shell32

ILCreateFromPathW SHGetKnownFolderPath ShellExecuteExW ShellExecuteW DragFinish DragQueryFileW SHAppBarMessage ILFree SHOpenFolderAndSelectItems

ole32

CoTaskMemAlloc CoCreateInstance RegisterDragDrop CoCreateFreeThreadedMarshaler CoTaskMemFree CoUninitialize CoInitialize CoInitializeEx RevokeDragDrop OleInitialize

api-ms-win-core-synch-l1-2-0

WakeByAddressAll WaitOnAddress WakeByAddressSingle

user32

GetKeyboardState SetWindowTextW EnableWindow GetWindowTextW InvalidateRect UpdateWindow GetAsyncKeyState SetCursorPos GetWindowTextLengthW MonitorFromPoint SetWindowDisplayAffinity EnumDisplayMonitors AdjustWindowRect RedrawWindow MonitorFromRect ToUnicodeEx PostMessageW IsWindowVisible MapVirtualKeyExW GetKeyboardLayout ClipCursor GetSystemMetrics GetKeyState GetClipCursor ShowCursor SystemParametersInfoW GetWindowLongPtrW ScreenToClient IsWindowEnabled SetCapture GetMonitorInfoW SetPropW SetWindowRgn GetWindowPlacement SetWindowPlacement RegisterClassExW CreateWindowExW SetWindowPos GetTouchInputInfo TranslateMessage DispatchMessageA EnumChildWindows ChangeDisplaySettingsExW SetWindowLongW GetSystemMenu DefWindowProcW RegisterRawInputDevices AdjustWindowRectEx IsWindow SetParent GetWindowLongW InvalidateRgn ReleaseCapture GetParent GetWindow RegisterTouchWindow RegisterWindowMessageA SetFocus FlashWindowEx IsProcessDPIAware MonitorFromWindow TrackPopupMenu SetForegroundWindow ClientToScreen GetForegroundWindow FindWindowExW GetCursorPos EnableMenuItem DrawIconEx GetDC VkKeyScanW AppendMenuW InsertMenuW SendInput CheckMenuItem DrawTextW ReleaseDC FillRect GetWindowDC OffsetRect GetWindowRect MapWindowPoints GetClientRect GetMenuBarInfo ShowWindow SendMessageW PostQuitMessage SystemParametersInfoA GetActiveWindow SetMenu RemoveMenu CreateIcon SetMenuItemInfoW DrawMenuBar CreatePopupMenu CreateMenu CreateAcceleratorTableW DestroyAcceleratorTable DestroyIcon DestroyMenu LoadCursorW SetCursor CloseTouchInputHandle TranslateAcceleratorW MsgWaitForMultipleObjectsEx MapVirtualKeyW GetUpdateRect PeekMessageW PostThreadMessageW ValidateRect GetRawInputData GetMenuItemInfoW SetWindowLongPtrW DispatchMessageW GetMessageW DestroyWindow GetMenu GetMessageA TrackMouseEvent IsIconic

comctl32

TaskDialogIndirect RemoveWindowSubclass SetWindowSubclass DefSubclassProc

oleaut32

SetErrorInfo GetErrorInfo SysFreeString SysStringLen

shlwapi

SHCreateMemStream

dwmapi

DwmGetWindowAttribute DwmEnableBlurBehindWindow DwmSetWindowAttribute

gdi32

CreateRectRgn BitBlt CombineRgn GetDeviceCaps CreateSolidBrush DeleteObject DeleteDC SelectObject CreateDIBSection CreateCompatibleDC SetTextColor SetBkMode

ws2_32

shutdown send recv freeaddrinfo getaddrinfo WSACleanup WSAStartup bind WSASend connect ioctlsocket WSASocketW WSAIoctl closesocket getsockopt getsockname WSAGetLastError getpeername setsockopt

bcrypt

BCryptGenRandom

crypt32

CryptUnprotectData CryptProtectData

psapi

EmptyWorkingSet

vcruntime140

_CxxThrowException __std_exception_destroy __std_exception_copy __current_exception_context __current_exception __C_specific_handler _purecall wcsrchr memcmp memmove memset memcpy __CxxFrameHandler3

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-string-l1-1-0

wcslen wcscmp _wcsicmp

api-ms-win-crt-math-l1-1-0

trunc round pow roundf __setusermatherr floor

api-ms-win-crt-convert-l1-1-0

_ultow_s wcstol _wtoi

api-ms-win-crt-runtime-l1-1-0

terminate _register_thread_local_exe_atexit_callback _crt_atexit _register_onexit_function _initterm_e exit _initialize_onexit_table _get_initial_narrow_environment _initialize_narrow_environment _configure_narrow_argv _set_app_type _seh_filter_exe _initterm _c_exit _cexit __p___argv __p___argc _exit

api-ms-win-crt-stdio-l1-1-0

__p__commode _set_fmode

api-ms-win-crt-locale-l1-1-0

_configthreadlocale

api-ms-win-crt-heap-l1-1-0

free malloc _set_new_mode _callnewh