RobloxPlayerInstaller-KG8MG9JR2X[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
RobloxPlayerInstaller-KG8MG9JR2X.exe
Size 9.8MB
Sample260718-wpd3nshv3m
SHA256 22858fa38591e6f06b10adff0a994b624c8c45b1ff8cc9f349adcdaaf2cbef7b
MD5 c64d69d3b38406a4cee941a7d2635675
SHA1 ccd513891219b9f64fdbfc0f6b0ea044b3c75f11
SHA512 f96707447bd23c0354f773593209186b1975c9c01b55ce151ee96853c5577817b7e8b989abd4e8ddb808512d2005db28b67200e8807b8cff5056a812f968a61f
SSDEEP 196608:oKlQ2GVK1WdgxK1t8msxmlzwDoVa//eB5iyLs:ohVKY8msxGzaoVa//l0s
TLSH
T17DA6BF22FA01C032E9D200B2D6BDAFB6597C9930077944D3A7D45EB959305E33B39B6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
RobloxPlayerInstaller-KG8MG9JR2X.exe

File Explorer

RobloxPlayerInstaller-KG8MG9JR2X.exe

.exe 9.8MB

RobloxPlayerInstaller-KG8MG9JR2X.exe

IMPHASH 4176dba319799e21afe980b163be4073
SHA256 22858fa38591e6f06b10adff0a994b624c8c45b1ff8cc9f349adcdaaf2cbef7b
MD5 c64d69d3b38406a4cee941a7d2635675
SHA1 ccd513891219b9f64fdbfc0f6b0ea044b3c75f11
SHA512 f96707447bd23c0354f773593209186b1975c9c01b55ce151ee96853c5577817b7e8b989abd4e8ddb808512d2005db28b67200e8807b8cff5056a812f968a61f
SSDEEP 196608:oKlQ2GVK1WdgxK1t8msxmlzwDoVa//eB5iyLs:ohVKY8msxGzaoVa//l0s
TLSH
T17DA6BF22FA01C032E9D200B2D6BDAFB6597C9930077944D3A7D45EB959305E33B39B6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

3e:9a:3b:8f:71:7c:43:a7:aa:a9:a5:0c:f2:46:2c:63:43:12:90:7f:c8:4a:a1:5e:8c:29:98:1c:1c:48:2d:b9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jan 1, 0001

Subject

Serial Number

01:97:20:58:e4:2c:9c:ca:bd:73:0a:b1:26:7f:15:ed

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 19, 2025 - Dec 18, 2026

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

7216846

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\buildAgent\work\ci_deploy_ninja_boot-x86_git\build.ninja\common\vs2019\x86\release\Installer\Windows\RobloxPlayerInstaller.pdb

comctl32

InitCommonControlsEx _TrackMouseEvent ord345

gdiplus

GdiplusShutdown GdipCreateBitmapFromStream GdiplusStartup GdipFree GdipDisposeImage GdipCloneImage GdipAlloc GdipCreateHBITMAPFromBitmap

uxtheme

SetWindowTheme

advapi32

RegEnumKeyExW IsValidSid ReportEventW RegisterEventSourceW DeregisterEventSource CryptEnumProvidersW CryptSignHashW CryptDecrypt CryptExportKey GetTokenInformation CryptGenRandom SystemFunction036 CryptSetHashParam CryptGetProvParam CryptGetUserKey GetUserNameW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash RegCloseKey RegCreateKeyExW RegDeleteValueW RegOpenKeyExW RegSetValueExW RegGetValueW RegOpenKeyExA RegQueryValueExA CryptAcquireContextA CryptDestroyKey GetLengthSid RegQueryInfoKeyW RegQueryValueExW RegDeleteTreeW OpenProcessToken AllocateAndInitializeSid CopySid EqualSid FreeSid

crypt32

CertDuplicateCertificateContext CertFindCertificateInStore CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreA CertOpenStore CertGetCertificateContextProperty CertOpenSystemStoreW

ws2_32

inet_addr inet_ntop sendto gethostbyname getservbyport getservbyname shutdown gethostname getnameinfo WSASocketA htonl htons getsockopt send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAGetLastError socket setsockopt ntohs ntohl closesocket gethostbyaddr WSAEventSelect ioctlsocket freeaddrinfo getaddrinfo listen select __WSAFDIsSet WSAIoctl WSASetLastError recv getsockname getpeername connect bind accept WSACleanup WSAStartup recvfrom WSAWaitForMultipleEvents WSASetEvent WSAResetEvent inet_ntoa

iphlpapi

GetAdaptersAddresses if_nametoindex

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress

dbghelp

SymFromAddr

shell32

SHGetKnownFolderPath ShellExecuteExW SHGetFolderPathAndSubDirW Shell_NotifyIconW ShellExecuteW

kernel32

InitializeSListHead IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount GetCPInfo UnhandledExceptionFilter GetStartupInfoW RtlUnwind LCMapStringEx EncodePointer GetLocaleInfoEx InitOnceComplete InitOnceBeginInitialize SwitchToThread SleepConditionVariableCS WakeAllConditionVariable GetStringTypeW GetCommandLineA ExitThread FreeLibraryAndExitThread SetStdHandle IsDebuggerPresent DebugBreak OutputDebugStringW CloseHandle GetLastError SetLastError HeapAlloc HeapFree GetProcessHeap ReleaseSemaphore ReleaseMutex WaitForSingleObject WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW CreateSemaphoreExW GetCurrentProcessId GetCurrentThreadId GetModuleFileNameA GetModuleHandleW GetModuleHandleExW GetProcAddress FormatMessageW SetSearchPathMode GetCommandLineW VerSetConditionMask FindClose FindFirstFileW FindNextFileW GetDiskFreeSpaceExW CreateFileMappingW VerifyVersionInfoW LocaleNameToLCID GetUserDefaultLocaleName SetWaitableTimer CancelWaitableTimer CreateWaitableTimerW Sleep CreateEventA SetEvent SetUnhandledExceptionFilter CreateEventW OpenEventW TerminateProcess GetExitCodeProcess GetCurrentThread CreateProcessW SetThreadDescription GetSystemTime CreateFileW GetDriveTypeW GetVolumePathNameW GetFileInformationByHandleEx ExitProcess ReadFile MapViewOfFile UnmapViewOfFile DeleteFileW GetFileAttributesW SetFileAttributesW InitializeProcThreadAttributeList UpdateProcThreadAttribute OpenProcess GetModuleFileNameW SystemTimeToFileTime CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW QueryPerformanceFrequency QueryPerformanceCounter GetCurrentProcessorNumber GetSystemInfo VirtualAlloc VirtualProtect VirtualFree CreateThread GetCurrentProcess GlobalMemoryStatusEx K32GetProcessMemoryInfo CreateSemaphoreA WaitForMultipleObjectsEx GetSystemTimeAsFileTime GetVersionExA IsWow64Process LoadLibraryA OutputDebugStringA GetModuleHandleA DuplicateHandle MultiByteToWideChar K32GetProcessImageFileNameA Process32First Process32Next SetEndOfFile SetFilePointer FlushViewOfFile WideCharToMultiByte FileTimeToSystemTime DecodePointer RaiseException InitializeCriticalSectionEx DeleteCriticalSection GetNativeSystemInfo LoadLibraryExW GetTickCount LoadLibraryW VirtualQuery LocalAlloc LocalFree FindResourceExW LoadResource LockResource SizeofResource FindResourceW GlobalAlloc GlobalFree GlobalUnlock GlobalLock CreateDirectoryW GetFileSizeEx RemoveDirectoryW WriteFile CopyFileW CompareStringEx GetSystemFirmwareTable FreeLibrary GetEnvironmentVariableW ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection SleepEx CreateFileA GetFullPathNameW MoveFileExA GetEnvironmentVariableA CompareFileTime FormatMessageA FlushFileBuffers LockFileEx UnlockFile HeapDestroy HeapCompact HeapReAlloc DeleteFileA GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate CreateMutexW GetTempPathW UnlockFileEx GetFullPathNameA LockFile GetDiskFreeSpaceW HeapCreate AreFileApisANSI InitializeCriticalSection TryEnterCriticalSection GetCurrentDirectoryW InitializeSRWLock InitializeConditionVariable WakeConditionVariable SleepConditionVariableSRW GetLogicalProcessorInformation GetFileInformationByHandle GetFileTime SetFilePointerEx SetFileTime DeviceIoControl MoveFileExW ResetEvent TlsAlloc TlsGetValue TlsSetValue TlsFree CreateWaitableTimerA WriteConsoleW GetStdHandle GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW ReleaseSRWLockShared AcquireSRWLockShared SwitchToFiber DeleteFiber CreateFiberEx GetSystemDirectoryA GetExitCodeThread GetACP GetFileType ConvertFiberToThread ConvertThreadToFiberEx PeekNamedPipe SystemTimeToTzSpecificLocalTime GetConsoleOutputCP SetEnvironmentVariableW SetConsoleCtrlHandler GetTimeZoneInformation GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale InterlockedPushEntrySList GetUserDefaultLCID EnumSystemLocalesW FindFirstFileExW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW GetFinalPathNameByHandleW GetFileSize

user32

InvalidateRect EndPaint BeginPaint DrawTextW GetSystemMetrics EnumDisplayDevicesA GetUserObjectInformationW GetProcessWindowStation GetClientRect GetWindowRect GetWindowThreadProcessId SendMessageW MessageBoxW GetShellWindow TranslateAcceleratorW LoadAcceleratorsW DispatchMessageW TranslateMessage FillRect GetWindowLongW SetWindowLongW LoadBitmapW LoadIconW DefWindowProcW PostQuitMessage CallWindowProcW RegisterClassW GetMessageW DestroyIcon CreateWindowExW DestroyWindow ShowWindow GetDlgItem EnableWindow

gdi32

DeleteObject CreateSolidBrush SelectObject CreateFontW GetStockObject Rectangle SetDCPenColor SetBkMode SetDCBrushColor SetTextColor

ole32

CoCreateGuid StringFromGUID2 CoTaskMemFree CoTaskMemAlloc CoUninitialize CoInitialize CoCreateInstance CoInitializeEx

shlwapi

PathFindFileNameW PathFindExtensionW ord12

powrprof

CallNtPowerInformation

winmm

timeGetTime timeSetEvent timeGetDevCaps timeBeginPeriod timeEndPeriod

Sharing

General

Malware Config

Signatures

File Explorer

RobloxPlayerInstaller-KG8MG9JR2X.exe

PE Signature issue

comctl32

gdiplus

uxtheme

advapi32

crypt32

ws2_32

iphlpapi

api-ms-win-core-synch-l1-2-0

dbghelp

shell32

kernel32

user32

gdi32

ole32

shlwapi

powrprof

winmm

generic