RobloxStudioInstaller[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
RobloxStudioInstaller.exe
Size 9.7MB
Sample260925-tp8aeass5j
SHA256 f3c6e3cae5c790bd87050cfe95f4e6df5c1d75cd9cda745d94ef88f953a11884
MD5 1af32d57481feea13059c4a5e4a88ad4
SHA1 5cb4ecb9f5455a037a47c97ca88e246e91029f9d
SHA512 80a79ff4071a16d2b9d8fda93eedaa198b5682f9e27e005c384fabd12491041b03c0adf6f1fd4a0e0bc890f7e7c5870ad534176591195891f7d08fb28ad8c849
SSDEEP 196608:QjpoO6empKfLco4G97msxy3Sd23X+dccBfHYlUBUTSMn:Q2eQKL7msxzd23X+dZBfHYdL
TLSH
T1EAA6AF22B900C032E9C200B2D6BDAFFA997D99341B7954D3A7D41DB959305D33B3AB1B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
RobloxStudioInstaller.exe

File Explorer

RobloxStudioInstaller.exe

.exe 9.7MB

RobloxStudioInstaller.exe

IMPHASH 87e48b35fbdf146feed751f285ff2b84
SHA256 f3c6e3cae5c790bd87050cfe95f4e6df5c1d75cd9cda745d94ef88f953a11884
MD5 1af32d57481feea13059c4a5e4a88ad4
SHA1 5cb4ecb9f5455a037a47c97ca88e246e91029f9d
SHA512 80a79ff4071a16d2b9d8fda93eedaa198b5682f9e27e005c384fabd12491041b03c0adf6f1fd4a0e0bc890f7e7c5870ad534176591195891f7d08fb28ad8c849
SSDEEP 196608:QjpoO6empKfLco4G97msxy3Sd23X+dccBfHYlUBUTSMn:Q2eQKL7msxzd23X+dZBfHYdL
TLSH
T1EAA6AF22B900C032E9C200B2D6BDAFFA997D99341B7954D3A7D41DB959305D33B3AB1B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

ec:b1:92:7f:96:55:43:82:3a:4b:85:08:b5:09:c4:d7:07:f4:9e:ee:c7:62:d1:14:83:e1:3b:6e:ce:f5:39:fb

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jan 1, 0001

Subject

Serial Number

01:97:20:58:e4:2c:9c:ca:bd:73:0a:b1:26:7f:15:ed

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 19, 2025 - Dec 18, 2026

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

7103134

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\buildAgent\work\ci_deploy_ninja_boot-x86_git\build.ninja\common\vs2019\x86\release\Installer\Windows\RobloxStudioInstaller.pdb

comctl32

InitCommonControlsEx _TrackMouseEvent ord345

gdiplus

GdiplusShutdown GdipCreateBitmapFromStream GdiplusStartup GdipFree GdipDisposeImage GdipCloneImage GdipAlloc GdipCreateHBITMAPFromBitmap

uxtheme

SetWindowTheme

advapi32

RegEnumKeyExW IsValidSid ReportEventW RegisterEventSourceW DeregisterEventSource CryptEnumProvidersW CryptSignHashW CryptDecrypt CryptExportKey GetTokenInformation SystemFunction036 CryptGenRandom CryptSetHashParam CryptGetProvParam CryptGetUserKey GetUserNameW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash RegCloseKey RegCreateKeyExW RegDeleteValueW RegOpenKeyExW RegSetValueExW RegGetValueW RegOpenKeyExA RegQueryValueExA CryptDestroyKey GetLengthSid RegQueryInfoKeyW RegQueryValueExW RegDeleteTreeW OpenProcessToken AllocateAndInitializeSid CopySid EqualSid FreeSid

crypt32

CertDuplicateCertificateContext CertFindCertificateInStore CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreA CertOpenStore CertGetCertificateContextProperty CertOpenSystemStoreW

ws2_32

inet_addr getaddrinfo sendto gethostbyname getservbyport getservbyname shutdown gethostname getnameinfo WSASocketA freeaddrinfo inet_ntop htonl htons getsockopt send WSACloseEvent WSAGetLastError socket setsockopt ntohs ntohl closesocket gethostbyaddr WSACreateEvent ioctlsocket listen bind select __WSAFDIsSet WSAIoctl WSASetLastError recv getsockname getpeername connect accept WSACleanup WSAStartup recvfrom WSAWaitForMultipleEvents WSASetEvent WSAResetEvent WSAEventSelect WSAEnumNetworkEvents inet_ntoa

iphlpapi

GetAdaptersAddresses if_nametoindex

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress

dbghelp

SymFromAddr

shell32

SHGetKnownFolderPath ShellExecuteExW SHGetFolderPathAndSubDirW Shell_NotifyIconW ShellExecuteW

kernel32

InitializeSListHead IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount GetCPInfo UnhandledExceptionFilter GetStartupInfoW RtlUnwind LCMapStringEx EncodePointer GetLocaleInfoEx InitOnceComplete InitOnceBeginInitialize SwitchToThread SleepConditionVariableCS WakeAllConditionVariable GetStringTypeW GetCommandLineA ExitThread FreeLibraryAndExitThread SetStdHandle IsDebuggerPresent DebugBreak OutputDebugStringW CloseHandle GetLastError SetLastError HeapAlloc HeapFree GetProcessHeap ReleaseSemaphore ReleaseMutex WaitForSingleObject WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW CreateSemaphoreExW GetCurrentProcessId GetCurrentThreadId GetModuleFileNameA GetModuleHandleW GetModuleHandleExW GetProcAddress FormatMessageW SetSearchPathMode GetCommandLineW VerSetConditionMask FindClose FindFirstFileW FindNextFileW GetDiskFreeSpaceExW CreateFileMappingW VerifyVersionInfoW LocaleNameToLCID GetUserDefaultLocaleName SetWaitableTimer CancelWaitableTimer CreateWaitableTimerW Sleep CreateEventA SetEvent SetUnhandledExceptionFilter CreateEventW OpenEventW TerminateProcess GetExitCodeProcess GetCurrentThread CreateProcessW SetThreadDescription GetSystemTime CreateFileW GetDriveTypeW GetVolumePathNameW GetFileInformationByHandleEx GetFileSize ExitProcess MapViewOfFile UnmapViewOfFile DeleteFileW GetFileAttributesW SetFileAttributesW InitializeProcThreadAttributeList UpdateProcThreadAttribute OpenProcess GetModuleFileNameW SystemTimeToFileTime CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW QueryPerformanceFrequency QueryPerformanceCounter GetCurrentProcessorNumber GetSystemInfo VirtualAlloc VirtualProtect VirtualFree CreateThread GetCurrentProcess GlobalMemoryStatusEx GetPhysicallyInstalledSystemMemory K32GetProcessMemoryInfo CreateSemaphoreA WaitForMultipleObjectsEx GetSystemTimeAsFileTime GetVersionExA IsWow64Process LoadLibraryA OutputDebugStringA GetModuleHandleA MultiByteToWideChar K32GetProcessImageFileNameA Process32First Process32Next SetEndOfFile SetFilePointer FlushViewOfFile WideCharToMultiByte FileTimeToSystemTime DecodePointer RaiseException InitializeCriticalSectionEx DeleteCriticalSection GetNativeSystemInfo LoadLibraryExW DuplicateHandle GetTickCount LoadLibraryW VirtualQuery LocalAlloc LocalFree FindResourceExW LoadResource LockResource SizeofResource FindResourceW GlobalAlloc GlobalFree GlobalUnlock GlobalLock CreateDirectoryW GetFileSizeEx RemoveDirectoryW WriteFile CopyFileW MoveFileW CompareStringEx GetSystemFirmwareTable FreeLibrary GetEnvironmentVariableW ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection SleepEx CreateFileA GetFullPathNameW MoveFileExA CompareFileTime GetEnvironmentVariableA FormatMessageA FlushFileBuffers LockFileEx UnlockFile HeapDestroy HeapCompact HeapReAlloc DeleteFileA GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate CreateMutexW GetTempPathW UnlockFileEx GetFullPathNameA LockFile GetDiskFreeSpaceW HeapCreate AreFileApisANSI InitializeCriticalSection TryEnterCriticalSection GetCurrentDirectoryW InitializeSRWLock InitializeConditionVariable WakeConditionVariable SleepConditionVariableSRW GetLogicalProcessorInformation GetFileInformationByHandle GetFileTime SetFilePointerEx SetFileTime DeviceIoControl MoveFileExW ResetEvent TlsAlloc TlsGetValue TlsSetValue TlsFree CreateWaitableTimerA WriteConsoleW GetStdHandle GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW ReleaseSRWLockShared AcquireSRWLockShared SwitchToFiber DeleteFiber CreateFiberEx GetSystemDirectoryA GetExitCodeThread GetACP GetFileType ConvertFiberToThread ConvertThreadToFiberEx PeekNamedPipe SystemTimeToTzSpecificLocalTime GetConsoleOutputCP SetEnvironmentVariableW SetConsoleCtrlHandler GetTimeZoneInformation GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale InterlockedPushEntrySList GetUserDefaultLCID EnumSystemLocalesW FindFirstFileExW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW GetFinalPathNameByHandleW ReadFile

user32

InvalidateRect EndPaint BeginPaint DrawTextW GetSystemMetrics EnumDisplayDevicesA GetUserObjectInformationW GetProcessWindowStation GetClientRect GetWindowRect GetWindowThreadProcessId SendMessageW MessageBoxW GetShellWindow TranslateAcceleratorW LoadAcceleratorsW DispatchMessageW TranslateMessage FillRect GetWindowLongW SetWindowLongW LoadBitmapW LoadIconW DefWindowProcW PostQuitMessage CallWindowProcW RegisterClassW GetMessageW DestroyIcon CreateWindowExW DestroyWindow ShowWindow GetDlgItem EnableWindow

gdi32

DeleteObject CreateSolidBrush SelectObject CreateFontW GetStockObject Rectangle SetDCPenColor SetBkMode SetDCBrushColor SetTextColor

ole32

CoCreateGuid StringFromGUID2 CoTaskMemFree CoTaskMemAlloc CoUninitialize CoInitialize CoCreateInstance CoInitializeEx

shlwapi

PathFindFileNameW PathFindExtensionW ord12

powrprof

CallNtPowerInformation

winmm

timeGetTime timeSetEvent timeGetDevCaps timeBeginPeriod timeEndPeriod

Sharing

General

Malware Config

Signatures

File Explorer

RobloxStudioInstaller.exe

PE Signature issue

comctl32

gdiplus

uxtheme

advapi32

crypt32

ws2_32

iphlpapi

api-ms-win-core-synch-l1-2-0

dbghelp

shell32

kernel32

user32

gdi32

ole32

shlwapi

powrprof

winmm

generic