RobloxPlayerInstaller-JWB432FP73[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
RobloxPlayerInstaller-JWB432FP73.exe
Size 9.2MB
Sample260910-wt52yswwet
SHA256 3971a55adbb0bce27e1fa90c4df5be475cb80410f50c7e819a10123f8210945b
MD5 39669a7a0361799d492af3ec60c1743e
SHA1 f301ac74248bc1bcea0b3d32c799dbf6e5cc0790
SHA512 c80e6a2d2b97c0b29617fceb0675543d648f22c21f7b346feae4ab0545c0707ad4cd0564ba5bcdf57a1a29fc2ab16cfbb39c5303e4612268bdbe4eee0a8311f5
SSDEEP 196608:fVsckR/57bLDoP8lgUmC6Q2TbNBXWDc/3z:fIc4XmRQ2TbrWS3
TLSH
T1C5A6BE22F941C021E5C201B2E6BD6FB65D7D89240B3848D7A7C45DB849716E33B3EB6B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
RobloxPlayerInstaller-JWB432FP73.exe

File Explorer

RobloxPlayerInstaller-JWB432FP73.exe

.exe 9.2MB

RobloxPlayerInstaller-JWB432FP73.exe

IMPHASH 5c5545ff1d452ca846b3af0a10155b1a
SHA256 3971a55adbb0bce27e1fa90c4df5be475cb80410f50c7e819a10123f8210945b
MD5 39669a7a0361799d492af3ec60c1743e
SHA1 f301ac74248bc1bcea0b3d32c799dbf6e5cc0790
SHA512 c80e6a2d2b97c0b29617fceb0675543d648f22c21f7b346feae4ab0545c0707ad4cd0564ba5bcdf57a1a29fc2ab16cfbb39c5303e4612268bdbe4eee0a8311f5
SSDEEP 196608:fVsckR/57bLDoP8lgUmC6Q2TbNBXWDc/3z:fIc4XmRQ2TbrWS3
TLSH
T1C5A6BE22F941C021E5C201B2E6BD6FB65D7D89240B3848D7A7C45DB849716E33B3EB6B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

fe:ec:4f:5c:97:5b:44:4d:a7:b4:ca:f8:72:00:59:fc:09:fd:35:76:ca:16:90:88:2c:00:63:30:e9:63:49:fa

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jan 1, 0001

Subject

Serial Number

01:97:20:58:e4:2c:9c:ca:bd:73:0a:b1:26:7f:15:ed

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 19, 2025 - Dec 18, 2026

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

6677918

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\buildAgent\work\ci_deploy_ninja_boot-x86_git\build.ninja\common\vs2019\x86\release\Installer\Windows\RobloxPlayerInstaller.pdb

comctl32

InitCommonControlsEx _TrackMouseEvent ord345

gdiplus

GdiplusStartup GdiplusShutdown GdipCloneImage GdipDisposeImage GdipCreateBitmapFromStream GdipFree GdipCreateHBITMAPFromBitmap GdipAlloc

wininet

HttpQueryInfoW HttpSendRequestW InternetOpenW InternetConnectW InternetCloseHandle HttpAddRequestHeadersW HttpOpenRequestW InternetSetStatusCallbackW InternetQueryOptionW InternetQueryDataAvailable InternetReadFile

uxtheme

SetWindowTheme

advapi32

CopySid RegCreateKeyExW RegCloseKey CryptDestroyHash IsValidSid GetTokenInformation GetLengthSid FreeSid EqualSid CryptHashData AllocateAndInitializeSid OpenProcessToken RegDeleteTreeW RegQueryValueExW RegQueryInfoKeyW RegEnumKeyExW CryptDestroyKey CryptAcquireContextA RegQueryValueExA RegOpenKeyExA RegGetValueW RegSetValueExW RegOpenKeyExW GetUserNameW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash RegDeleteValueW

iphlpapi

GetAdaptersAddresses

ws2_32

htons htonl WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSASetEvent WSAWaitForMultipleEvents ntohs ioctlsocket getsockopt freeaddrinfo getaddrinfo listen send WSASetLastError __WSAFDIsSet WSAIoctl recv getsockname setsockopt getpeername connect bind accept WSACleanup WSAStartup closesocket ntohl getnameinfo gethostname select WSACloseEvent socket WSAGetLastError inet_ntop getservbyname WSASocketA recvfrom sendto inet_addr inet_ntoa gethostbyaddr gethostbyname getservbyport shutdown

crypt32

CertOpenSystemStoreA CertGetIntendedKeyUsage CertGetEnhancedKeyUsage CertFreeCertificateContext CertEnumCertificatesInStore CertCloseStore CertOpenSystemStoreW CertGetCertificateContextProperty CertDuplicateCertificateContext CertFindCertificateInStore CertOpenStore

dbghelp

SymFromAddr

shell32

Shell_NotifyIconW SHGetFolderPathAndSubDirW ShellExecuteExW SHGetKnownFolderPath ShellExecuteW

kernel32

FreeEnvironmentStringsW InterlockedPushEntrySList RtlUnwind GetEnvironmentStringsW GetOEMCP IsValidCodePage FindFirstFileExW EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetTimeZoneInformation SetConsoleCtrlHandler GetConsoleOutputCP ConvertThreadToFiberEx ConvertFiberToThread GetFileType GetACP GetExitCodeThread CreateFiberEx DeleteFiber SwitchToFiber AcquireSRWLockShared ReleaseSRWLockShared ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode GetStdHandle WriteConsoleW SetEnvironmentVariableW SystemTimeToTzSpecificLocalTime PeekNamedPipe ExitProcess SetStdHandle FreeLibraryAndExitThread ExitThread GetCommandLineA CreateWaitableTimerA TlsFree TlsSetValue TlsGetValue TlsAlloc ResumeThread MoveFileExW DeviceIoControl SetFileTime SetFilePointerEx GetFileTime GetFileInformationByHandle GetLogicalProcessorInformation IsDebuggerPresent DebugBreak OutputDebugStringW CloseHandle GetLastError SetLastError HeapAlloc HeapFree GetProcessHeap ReleaseSemaphore ReleaseMutex WaitForSingleObject WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW CreateSemaphoreExW GetCurrentProcessId GetCurrentThreadId GetModuleFileNameA GetModuleHandleW GetModuleHandleExW GetProcAddress FormatMessageW SetSearchPathMode GetCommandLineW VerSetConditionMask GetDiskFreeSpaceExW CreateMutexW TerminateProcess OpenProcess CreateFileMappingW MapViewOfFile UnmapViewOfFile VerifyVersionInfoW LocaleNameToLCID GetUserDefaultLocaleName SetWaitableTimer CancelWaitableTimer CreateWaitableTimerW Sleep CreateEventA SetEvent FindClose FindFirstFileW FindNextFileW SetUnhandledExceptionFilter CreateEventW OpenEventW GetExitCodeProcess CreateProcessW GetSystemTime CreateFileW GetDriveTypeW GetVolumePathNameW GetFileInformationByHandleEx GetFileSize ReadFile DeleteFileW GetFileAttributesW SetFileAttributesW InitializeProcThreadAttributeList UpdateProcThreadAttribute GetModuleFileNameW SystemTimeToFileTime CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW GetCurrentProcessorNumber QueryPerformanceCounter QueryPerformanceFrequency VirtualFree GetSystemInfo CreateThread GetCurrentProcess GlobalMemoryStatusEx K32GetProcessMemoryInfo GetProcessTimes GetProcessHandleCount GetSystemTimeAsFileTime GetVersionExA IsWow64Process LoadLibraryA ResetEvent CreateSemaphoreA DuplicateHandle GetModuleHandleA GetTickCount OutputDebugStringA MultiByteToWideChar K32GetProcessImageFileNameA Process32First Process32Next WideCharToMultiByte FileTimeToSystemTime DecodePointer RaiseException InitializeCriticalSectionEx DeleteCriticalSection GetNativeSystemInfo LoadLibraryExW WaitForMultipleObjectsEx GetCurrentThread LoadLibraryW VirtualQuery LocalAlloc LocalFree FindResourceExW LoadResource LockResource SizeofResource FindResourceW CreateDirectoryW GetFileSizeEx RemoveDirectoryW WriteFile CopyFileW GlobalAlloc GlobalFree GlobalUnlock GlobalLock CompareStringEx GetSystemFirmwareTable FreeLibrary GetEnvironmentVariableW ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection GetSystemDirectoryA SleepEx GetFullPathNameW MoveFileExA GetEnvironmentVariableA CompareFileTime FlushFileBuffers FormatMessageA LockFileEx UnlockFile HeapDestroy HeapCompact HeapReAlloc DeleteFileA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW HeapCreate AreFileApisANSI InitializeCriticalSection TryEnterCriticalSection GetCurrentDirectoryW InitializeSRWLock InitializeConditionVariable WakeConditionVariable SleepConditionVariableSRW VirtualAlloc

user32

GetUserObjectInformationW LoadBitmapW EnumDisplayDevicesA GetWindowThreadProcessId GetShellWindow TranslateAcceleratorW LoadAcceleratorsW DispatchMessageW TranslateMessage GetMessageW DestroyIcon LoadIconW SetWindowLongW GetWindowLongW FillRect GetWindowRect GetProcessWindowStation SendMessageW MessageBoxW DefWindowProcW PostQuitMessage CallWindowProcW RegisterClassW CreateWindowExW DestroyWindow ShowWindow GetDlgItem SetTimer EnableWindow GetSystemMetrics DrawTextW BeginPaint EndPaint InvalidateRect GetClientRect

gdi32

SetDCBrushColor SetDCPenColor SetBkMode SetTextColor CreateFontW SelectObject GetStockObject DeleteObject CreateSolidBrush Rectangle

ole32

StringFromGUID2 CoTaskMemFree CoInitialize CoUninitialize CoTaskMemAlloc CoCreateInstance CoCreateGuid CoInitializeEx

shlwapi

PathFindExtensionW ord12 PathFindFileNameW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll InitOnceBeginInitialize InitOnceComplete SleepConditionVariableCS WakeAllConditionVariable WaitOnAddress

api-ms-win-core-memory-l1-1-3

VirtualProtectFromApp VirtualAllocFromApp

api-ms-win-power-base-l1-1-0

CallNtPowerInformation

api-ms-win-mm-time-l1-1-0

timeGetTime timeBeginPeriod timeGetDevCaps

api-ms-win-security-cryptoapi-l1-1-0

CryptSetHashParam CryptEnumProvidersW CryptGenRandom CryptSignHashW CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt

api-ms-win-security-systemfunctions-l1-1-0

SystemFunction036

api-ms-win-eventlog-legacy-l1-1-0

RegisterEventSourceW ReportEventW DeregisterEventSource

api-ms-win-core-string-l1-1-0

GetStringTypeW

api-ms-win-core-processthreads-l1-1-0

SwitchToThread GetStartupInfoW

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionAndSpinCount

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx GetCPInfo LCMapStringEx

api-ms-win-core-util-l1-1-0

EncodePointer

api-ms-win-core-file-l1-1-0

GetFinalPathNameByHandleW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter

winmm

timeSetEvent

Sharing

General

Malware Config

Signatures

File Explorer

RobloxPlayerInstaller-JWB432FP73.exe

PE Signature issue

comctl32

gdiplus

wininet

uxtheme

advapi32

iphlpapi

ws2_32

crypt32

dbghelp

shell32

kernel32

user32

gdi32

ole32

shlwapi

api-ms-win-core-synch-l1-2-0

api-ms-win-core-memory-l1-1-3

api-ms-win-power-base-l1-1-0

api-ms-win-mm-time-l1-1-0

api-ms-win-security-cryptoapi-l1-1-0

api-ms-win-security-systemfunctions-l1-1-0

api-ms-win-eventlog-legacy-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

winmm

generic