RobloxStudioInstaller[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
RobloxStudioInstaller.exe
Size 9.7MB
Sample260905-31dplsbm4y
SHA256 fb34893244fe4fb1ad194fd915f38d8cefcbe905284b543bcfc98dcfb345bee8
MD5 d061bf4e94278c7304abe9dbead26ff1
SHA1 c1202ab6546e649441642c0d921660bb1f86f44b
SHA512 e4c5fd63570a4998360dae18c3780a74bb917f38708a29c57cb5cd4c98e6b731725acc199d03b541d88d83d98ca6eaf0690c4f890b9debbc397470be017fc9d9
SSDEEP 196608:YlL4wq8I49KfLvr5tJ9msxHOX7jGzeBEcf4ZnZAVzr:YQEKp9msxH07jGyBEcf6C
TLSH
T1D5A6AF22B900C032E8D100B297BDAFFA993D5A345B3954D3A7D45DB95A305D33B39B2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
RobloxStudioInstaller.exe

File Explorer

RobloxStudioInstaller.exe

.exe 9.7MB

RobloxStudioInstaller.exe

IMPHASH 4088a2fd8fe0f6236e79d50e6104c50e
SHA256 fb34893244fe4fb1ad194fd915f38d8cefcbe905284b543bcfc98dcfb345bee8
MD5 d061bf4e94278c7304abe9dbead26ff1
SHA1 c1202ab6546e649441642c0d921660bb1f86f44b
SHA512 e4c5fd63570a4998360dae18c3780a74bb917f38708a29c57cb5cd4c98e6b731725acc199d03b541d88d83d98ca6eaf0690c4f890b9debbc397470be017fc9d9
SSDEEP 196608:YlL4wq8I49KfLvr5tJ9msxHOX7jGzeBEcf4ZnZAVzr:YQEKp9msxH07jGyBEcf6C
TLSH
T1D5A6AF22B900C032E8D100B297BDAFFA993D5A345B3954D3A7D45DB95A305D33B39B2B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

e7:b7:4f:cf:ec:b4:d1:a7:63:7c:32:8c:83:61:65:af:65:4a:0c:fe:98:a3:70:cc:c3:fd:7c:98:4b:9a:ec:d9

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jan 1, 0001

Subject

Serial Number

01:97:20:58:e4:2c:9c:ca:bd:73:0a:b1:26:7f:15:ed

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 19, 2025 - Dec 18, 2026

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

7091710

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\buildAgent\work\ci_deploy_ninja_boot-x86_git\build.ninja\common\vs2019\x86\release\Installer\Windows\RobloxStudioInstaller.pdb

comctl32

InitCommonControlsEx _TrackMouseEvent ord345

gdiplus

GdiplusShutdown GdipCreateBitmapFromStream GdiplusStartup GdipFree GdipDisposeImage GdipCloneImage GdipAlloc GdipCreateHBITMAPFromBitmap

uxtheme

SetWindowTheme

advapi32

RegEnumKeyExW IsValidSid ReportEventW RegisterEventSourceW DeregisterEventSource CryptEnumProvidersW CryptSignHashW CryptDecrypt CryptExportKey GetTokenInformation SystemFunction036 CryptGenRandom CryptSetHashParam CryptGetProvParam CryptGetUserKey GetUserNameW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash RegCloseKey RegCreateKeyExW RegDeleteValueW RegOpenKeyExW RegSetValueExW RegGetValueW RegOpenKeyExA RegQueryValueExA CryptDestroyKey GetLengthSid RegQueryInfoKeyW RegQueryValueExW RegDeleteTreeW OpenProcessToken AllocateAndInitializeSid CopySid EqualSid FreeSid

crypt32

CertDuplicateCertificateContext CertFindCertificateInStore CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreA CertOpenStore CertGetCertificateContextProperty CertOpenSystemStoreW

ws2_32

inet_addr getaddrinfo sendto gethostbyname getservbyport getservbyname shutdown gethostname getnameinfo WSASocketA freeaddrinfo inet_ntop htonl htons getsockopt send WSACloseEvent WSAGetLastError socket setsockopt ntohs ntohl closesocket gethostbyaddr WSACreateEvent ioctlsocket listen bind select __WSAFDIsSet WSAIoctl WSASetLastError recv getsockname getpeername connect accept WSACleanup WSAStartup recvfrom WSAWaitForMultipleEvents WSASetEvent WSAResetEvent WSAEventSelect WSAEnumNetworkEvents inet_ntoa

iphlpapi

GetAdaptersAddresses if_nametoindex

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress

dbghelp

SymFromAddr

shell32

SHGetKnownFolderPath ShellExecuteExW SHGetFolderPathAndSubDirW Shell_NotifyIconW ShellExecuteW

kernel32

InitializeSListHead IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount GetCPInfo UnhandledExceptionFilter GetStartupInfoW RtlUnwind LCMapStringEx EncodePointer GetLocaleInfoEx InitOnceComplete InitOnceBeginInitialize SwitchToThread SleepConditionVariableCS WakeAllConditionVariable GetStringTypeW GetCommandLineA ExitThread FreeLibraryAndExitThread SetStdHandle IsDebuggerPresent DebugBreak OutputDebugStringW CloseHandle GetLastError SetLastError HeapAlloc HeapFree GetProcessHeap ReleaseSemaphore ReleaseMutex WaitForSingleObject WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW CreateSemaphoreExW GetCurrentProcessId GetCurrentThreadId GetModuleFileNameA GetModuleHandleW GetModuleHandleExW GetProcAddress FormatMessageW SetSearchPathMode GetCommandLineW VerSetConditionMask FindClose FindFirstFileW FindNextFileW GetDiskFreeSpaceExW CreateFileMappingW VerifyVersionInfoW LocaleNameToLCID GetUserDefaultLocaleName SetWaitableTimer CancelWaitableTimer CreateWaitableTimerW Sleep CreateEventA SetEvent SetUnhandledExceptionFilter CreateEventW OpenEventW GetExitCodeProcess GetCurrentThread CreateProcessW SetThreadDescription GetSystemTime CreateFileW GetDriveTypeW GetVolumePathNameW GetFileInformationByHandleEx GetFileSize ReadFile ExitProcess UnmapViewOfFile DeleteFileW GetFileAttributesW SetFileAttributesW TerminateProcess InitializeProcThreadAttributeList UpdateProcThreadAttribute OpenProcess GetModuleFileNameW SystemTimeToFileTime CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW QueryPerformanceFrequency QueryPerformanceCounter GetCurrentProcessorNumber GetSystemInfo VirtualAlloc VirtualProtect VirtualFree CreateThread GetCurrentProcess GlobalMemoryStatusEx GetPhysicallyInstalledSystemMemory K32GetProcessMemoryInfo CreateSemaphoreA WaitForMultipleObjectsEx GetSystemTimeAsFileTime OutputDebugStringA LoadLibraryA GetVersionExA IsWow64Process MultiByteToWideChar K32GetProcessImageFileNameA Process32First Process32Next GetModuleHandleA SetEndOfFile SetFilePointer FlushViewOfFile WideCharToMultiByte FileTimeToSystemTime DecodePointer RaiseException InitializeCriticalSectionEx DeleteCriticalSection GetNativeSystemInfo LoadLibraryExW DuplicateHandle GetTickCount LoadLibraryW VirtualQuery LocalAlloc LocalFree FindResourceExW LoadResource LockResource SizeofResource FindResourceW GlobalAlloc GlobalFree GlobalUnlock GlobalLock CreateDirectoryW GetFileSizeEx RemoveDirectoryW WriteFile CopyFileW MoveFileW CompareStringEx GetSystemFirmwareTable FreeLibrary GetEnvironmentVariableW ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection SleepEx CreateFileA GetFullPathNameW MoveFileExA CompareFileTime GetEnvironmentVariableA FormatMessageA FlushFileBuffers LockFileEx UnlockFile HeapDestroy HeapCompact HeapReAlloc DeleteFileA GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate CreateMutexW GetTempPathW UnlockFileEx GetFullPathNameA LockFile GetDiskFreeSpaceW HeapCreate AreFileApisANSI InitializeCriticalSection TryEnterCriticalSection GetCurrentDirectoryW InitializeSRWLock InitializeConditionVariable WakeConditionVariable SleepConditionVariableSRW GetLogicalProcessorInformation GetFileInformationByHandle GetFileTime SetFilePointerEx SetFileTime DeviceIoControl MoveFileExW ResetEvent TlsAlloc TlsGetValue TlsSetValue TlsFree CreateWaitableTimerA WriteConsoleW GetStdHandle GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW ReleaseSRWLockShared AcquireSRWLockShared SwitchToFiber DeleteFiber CreateFiberEx GetSystemDirectoryA GetExitCodeThread GetACP GetFileType ConvertFiberToThread ConvertThreadToFiberEx PeekNamedPipe SystemTimeToTzSpecificLocalTime GetConsoleOutputCP SetEnvironmentVariableW SetConsoleCtrlHandler GetTimeZoneInformation GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale InterlockedPushEntrySList GetUserDefaultLCID EnumSystemLocalesW HeapQueryInformation FindFirstFileExW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW GetFinalPathNameByHandleW MapViewOfFile

user32

InvalidateRect EndPaint BeginPaint DrawTextW GetSystemMetrics EnumDisplayDevicesA GetUserObjectInformationW GetProcessWindowStation GetClientRect GetWindowRect GetWindowThreadProcessId SendMessageW MessageBoxW GetShellWindow TranslateAcceleratorW LoadAcceleratorsW DispatchMessageW TranslateMessage FillRect GetWindowLongW SetWindowLongW LoadBitmapW LoadIconW DefWindowProcW PostQuitMessage CallWindowProcW RegisterClassW GetMessageW DestroyIcon CreateWindowExW DestroyWindow ShowWindow GetDlgItem EnableWindow

gdi32

DeleteObject CreateSolidBrush SelectObject CreateFontW GetStockObject Rectangle SetDCPenColor SetBkMode SetDCBrushColor SetTextColor

ole32

CoCreateGuid StringFromGUID2 CoTaskMemFree CoTaskMemAlloc CoUninitialize CoInitialize CoCreateInstance CoInitializeEx

shlwapi

PathFindFileNameW PathFindExtensionW ord12

powrprof

CallNtPowerInformation

winmm

timeGetTime timeSetEvent timeGetDevCaps timeBeginPeriod timeEndPeriod

Sharing

General

Malware Config

Signatures

File Explorer

RobloxStudioInstaller.exe

PE Signature issue

comctl32

gdiplus

uxtheme

advapi32

crypt32

ws2_32

iphlpapi

api-ms-win-core-synch-l1-2-0

dbghelp

shell32

kernel32

user32

gdi32

ole32

shlwapi

powrprof

winmm

generic