loaderrobloxskid2[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
loaderrobloxskid2.exe
Size 721KB
Sample260723-bc434sbr21
SHA256 b040c8b8d9e80f636ba74600c15bf560bec75b6b004987147bbd44a3d900a827
MD5 79b2513acf605457514adc39a16d3f7c
SHA1 a9a932136ca94e8f0ad80316cf9ebe23dece788d
SHA512 294b93bcf70570a104c30f63c1e24ae9d81dff6628d8c27eb19fae38393eb938fa341717e6b218ddca124d966ee325968a8ba02b5573cea4d9fb9c70c42d31ff
SSDEEP 12288:o5RClfkw5lOMX6GsDHpn/i+nisuMy23ocFHSJdtqUxCj2AqeMQmzFTSpkP2NnnrC:o5RC/LHCHp/risU23ocFqtquGKFzFTSk
TLSH
T1DFF4CF0AF3B192B9C127D574C962E617FB317C056B2086CB73D41899AFF75A08EAF211
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
loaderrobloxskid2.exe

File Explorer

loaderrobloxskid2.exe

.exe 721KB

loaderrobloxskid2.exe

IMPHASH e9f672de64830e5bfac30605f0f56f8e
SHA256 b040c8b8d9e80f636ba74600c15bf560bec75b6b004987147bbd44a3d900a827
MD5 79b2513acf605457514adc39a16d3f7c
SHA1 a9a932136ca94e8f0ad80316cf9ebe23dece788d
SHA512 294b93bcf70570a104c30f63c1e24ae9d81dff6628d8c27eb19fae38393eb938fa341717e6b218ddca124d966ee325968a8ba02b5573cea4d9fb9c70c42d31ff
SSDEEP 12288:o5RClfkw5lOMX6GsDHpn/i+nisuMy23ocFHSJdtqUxCj2AqeMQmzFTSpkP2NnnrC:o5RC/LHCHp/risU23ocFqtquGKFzFTSk
TLSH
T1DFF4CF0AF3B192B9C127D574C962E617FB317C056B2086CB73D41899AFF75A08EAF211
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

374336

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpQueryHeaders WinHttpSetOption WinHttpReceiveResponse WinHttpOpen WinHttpQueryDataAvailable WinHttpReadData WinHttpOpenRequest WinHttpCloseHandle WinHttpSendRequest WinHttpSetTimeouts WinHttpConnect WinHttpAddRequestHeaders

kernel32

GlobalAlloc GlobalFree GlobalLock WideCharToMultiByte GlobalUnlock LoadLibraryA QueryPerformanceFrequency GetProcAddress VerSetConditionMask GetModuleHandleW VerifyVersionInfoW QueryPerformanceCounter GetCurrentProcess InitializeCriticalSectionEx GetLastError CloseHandle DeleteCriticalSection MultiByteToWideChar GetStdHandle GetModuleHandleA GetCurrentThread GetThreadContext ExitProcess AllocConsole IsDebuggerPresent CheckRemoteDebuggerPresent GetFileSizeEx WriteFile GetVolumeInformationA WaitForSingleObject Sleep GetTempPathA CreateFileA DeleteFileA CreateDirectoryA GetTickCount GetExitCodeProcess OutputDebugStringW ReleaseSRWLockExclusive InitializeSListHead GetSystemTimeAsFileTime GetCurrentThreadId GetCurrentProcessId GetStartupInfoW SetUnhandledExceptionFilter SleepConditionVariableSRW WakeAllConditionVariable AcquireSRWLockExclusive SetConsoleTextAttribute

user32

SetWindowRgn GetSystemMetrics DispatchMessageW PeekMessageW TranslateMessage PostQuitMessage FindWindowA UpdateWindow GetWindowLongW SetClipboardData DefWindowProcW AdjustWindowRectEx GetKeyState DestroyWindow GetDC SetWindowPos MonitorFromWindow EnumDisplayMonitors CreateWindowExW ScreenToClient UnregisterClassW SetWindowTextW RegisterClassExW WindowFromPoint ShowWindow GetCapture GetMonitorInfoW ClientToScreen IsChild GetForegroundWindow SetLayeredWindowAttributes SetFocus BringWindowToTop LoadCursorW SetCapture SetCursor SetWindowLongW GetClientRect GetWindowRect SetForegroundWindow IsIconic SetCursorPos ReleaseDC GetCursorPos OpenClipboard CloseClipboard GetClipboardData EmptyClipboard ReleaseCapture

gdi32

CreateRoundRectRgn GetDeviceCaps

shell32

ShellExecuteExA ShellExecuteA SHGetFolderPathA

xinput1_4

ord4 ord2

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow

msvcp140

?_Xinvalid_argument@std@@YAXPEBD@Z ?_Xbad_alloc@std@@YAXXZ ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ _Thrd_detach _Query_perf_counter _Cnd_do_broadcast_at_thread_exit ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Throw_Cpp_error@std@@YAXH@Z _Query_perf_frequency ?always_noconv@codecvt_base@std@@QEBA_NXZ ?good@ios_base@std@@QEBA_NXZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?_Xbad_function_call@std@@YAXXZ ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?_Xlength_error@std@@YAXPEBD@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exception@std@@YA_NXZ ?_Id_cnt@id@locale@std@@0HA ?_Xout_of_range@std@@YAXPEBD@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z

d3d9

Direct3DCreate9

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_terminate strstr __std_exception_destroy __std_exception_copy __C_specific_handler __current_exception __current_exception_context _CxxThrowException memchr memcmp memcpy memmove memset

api-ms-win-crt-stdio-l1-1-0

fgetc __p__commode _set_fmode fputc __acrt_iob_func fgetpos setvbuf feof ungetc fopen_s __stdio_common_vsscanf fread fsetpos __stdio_common_vsprintf _wfopen fwrite _fseeki64 fseek fclose fflush freopen_s _get_stream_buffer_pointers ftell ferror

api-ms-win-crt-string-l1-1-0

strncpy strncmp strlen strcmp strcpy_s strcat_s

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

_set_new_mode free _callnewh realloc malloc

api-ms-win-crt-convert-l1-1-0

strtol strtoll

api-ms-win-crt-runtime-l1-1-0

_configure_narrow_argv _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type _errno _get_narrow_winmain_command_line _initterm _initterm_e exit _exit _beginthreadex _c_exit _register_thread_local_exe_atexit_callback terminate

api-ms-win-crt-time-l1-1-0

strftime _time64 _localtime64_s

api-ms-win-crt-filesystem-l1-1-0

_lock_file _unlock_file

api-ms-win-crt-math-l1-1-0

ceilf cosf floorf acosf sqrtf fmodf __setusermatherr sinf ldexp powf

api-ms-win-crt-environment-l1-1-0

_dupenv_s

api-ms-win-crt-locale-l1-1-0

_configthreadlocale