RobloxStudioInstaller[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
RobloxStudioInstaller.exe
Size 9.6MB
Sample260929-3pmhdat1et
SHA256 7a3cc75779e5d17e093e9e6e249c1022af0339fb9bb59030efd3a7b7ed7c4088
MD5 44b95492bd8693f310fc4b2c4fbabe53
SHA1 cda7cb64accacb9170ebdc6d7d876a6b46d29bbc
SHA512 47c612d2ec39fba90c732ff5160ec290499e59f7c578c1d45d5d205abc9c28514681a0bb98d0320334ce649a047e0ca99137dc3ac9a7eeebacde82797701ac42
SSDEEP 196608:fU9iHrHJbgONLiZ3V1ZbmsxvqfkIu0akVZzZC4qJv:fNHqOUbbmsxSfNu0akTI4qJv
TLSH
T149A6BF22BA00C032E8D200B2D6BD9FFA993D59350B3954D3A7D45DB95A305D33B3AB5B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
RobloxStudioInstaller.exe

File Explorer

RobloxStudioInstaller.exe

.exe 9.6MB

RobloxStudioInstaller.exe

IMPHASH 8e2eb8a9c8ef872de343672a9a5ae96b
SHA256 7a3cc75779e5d17e093e9e6e249c1022af0339fb9bb59030efd3a7b7ed7c4088
MD5 44b95492bd8693f310fc4b2c4fbabe53
SHA1 cda7cb64accacb9170ebdc6d7d876a6b46d29bbc
SHA512 47c612d2ec39fba90c732ff5160ec290499e59f7c578c1d45d5d205abc9c28514681a0bb98d0320334ce649a047e0ca99137dc3ac9a7eeebacde82797701ac42
SSDEEP 196608:fU9iHrHJbgONLiZ3V1ZbmsxvqfkIu0akVZzZC4qJv:fNHqOUbbmsxSfNu0akTI4qJv
TLSH
T149A6BF22BA00C032E8D200B2D6BD9FFA993D59350B3954D3A7D45DB95A305D33B3AB5B
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

b6:1d:4b:55:02:d1:a8:68:46:55:f6:be:cc:3e:87:5e:1f:77:9c:1b:ca:53:cc:ea:a5:2a:96:32:5f:c9:03:35

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jan 1, 0001

Subject

Serial Number

01:97:20:58:e4:2c:9c:ca:bd:73:0a:b1:26:7f:15:ed

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 19, 2025 - Dec 18, 2026

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

7085822

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\buildAgent\work\ci_deploy_ninja_boot-x86_git\build.ninja\common\vs2019\x86\release\Installer\Windows\RobloxStudioInstaller.pdb

comctl32

InitCommonControlsEx _TrackMouseEvent ord345

gdiplus

GdiplusShutdown GdipCreateBitmapFromStream GdiplusStartup GdipFree GdipDisposeImage GdipCloneImage GdipAlloc GdipCreateHBITMAPFromBitmap

uxtheme

SetWindowTheme

advapi32

RegEnumKeyExW IsValidSid ReportEventW RegisterEventSourceW DeregisterEventSource CryptEnumProvidersW CryptSignHashW CryptDecrypt CryptExportKey GetTokenInformation SystemFunction036 CryptGenRandom CryptSetHashParam CryptGetProvParam CryptGetUserKey GetUserNameW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash RegCloseKey RegCreateKeyExW RegDeleteValueW RegOpenKeyExW RegSetValueExW RegGetValueW RegOpenKeyExA RegQueryValueExA CryptDestroyKey GetLengthSid RegQueryInfoKeyW RegQueryValueExW RegDeleteTreeW OpenProcessToken AllocateAndInitializeSid CopySid EqualSid FreeSid

crypt32

CertDuplicateCertificateContext CertFindCertificateInStore CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreA CertOpenStore CertGetCertificateContextProperty CertOpenSystemStoreW

ws2_32

inet_addr getaddrinfo sendto gethostbyname getservbyport getservbyname shutdown gethostname getnameinfo WSASocketA freeaddrinfo inet_ntop htonl htons getsockopt send WSACloseEvent WSAGetLastError socket setsockopt ntohs ntohl closesocket gethostbyaddr WSACreateEvent ioctlsocket listen bind select __WSAFDIsSet WSAIoctl WSASetLastError recv getsockname getpeername connect accept WSACleanup WSAStartup recvfrom WSAWaitForMultipleEvents WSASetEvent WSAResetEvent WSAEventSelect WSAEnumNetworkEvents inet_ntoa

iphlpapi

GetAdaptersAddresses if_nametoindex

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress

dbghelp

SymFromAddr

shell32

SHGetKnownFolderPath ShellExecuteExW SHGetFolderPathAndSubDirW Shell_NotifyIconW ShellExecuteW

kernel32

InitializeSListHead IsProcessorFeaturePresent InitializeCriticalSectionAndSpinCount GetCPInfo UnhandledExceptionFilter GetStartupInfoW RtlUnwind LCMapStringEx EncodePointer GetLocaleInfoEx InitOnceComplete InitOnceBeginInitialize SwitchToThread SleepConditionVariableCS WakeAllConditionVariable GetStringTypeW GetCommandLineA ExitThread FreeLibraryAndExitThread SetStdHandle IsDebuggerPresent DebugBreak OutputDebugStringW CloseHandle GetLastError SetLastError HeapAlloc HeapFree GetProcessHeap ReleaseSemaphore ReleaseMutex WaitForSingleObject WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW CreateSemaphoreExW GetCurrentProcessId GetCurrentThreadId GetModuleFileNameA GetModuleHandleW GetModuleHandleExW GetProcAddress FormatMessageW SetSearchPathMode GetCommandLineW VerSetConditionMask FindClose FindFirstFileW FindNextFileW GetDiskFreeSpaceExW CreateFileMappingW VerifyVersionInfoW LocaleNameToLCID GetUserDefaultLocaleName SetWaitableTimer CancelWaitableTimer CreateWaitableTimerW Sleep CreateEventA SetEvent SetUnhandledExceptionFilter CreateEventW OpenEventW GetCurrentThread CreateProcessW SetThreadDescription GetSystemTime CreateFileW GetDriveTypeW GetVolumePathNameW GetFileInformationByHandleEx GetFileSize ReadFile MapViewOfFile ExitProcess DeleteFileW GetFileAttributesW SetFileAttributesW TerminateProcess InitializeProcThreadAttributeList UpdateProcThreadAttribute OpenProcess GetModuleFileNameW SystemTimeToFileTime CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW QueryPerformanceFrequency QueryPerformanceCounter GetCurrentProcessorNumber GetSystemInfo VirtualAlloc VirtualProtect VirtualFree CreateThread GetCurrentProcess GlobalMemoryStatusEx GetPhysicallyInstalledSystemMemory K32GetProcessMemoryInfo CreateSemaphoreA WaitForMultipleObjectsEx GetSystemTimeAsFileTime OutputDebugStringA LoadLibraryA GetVersionExA IsWow64Process GetExitCodeProcess MultiByteToWideChar K32GetProcessImageFileNameA Process32First Process32Next GetModuleHandleA SetEndOfFile SetFilePointer FlushViewOfFile WideCharToMultiByte FileTimeToSystemTime DecodePointer RaiseException InitializeCriticalSectionEx DeleteCriticalSection GetNativeSystemInfo LoadLibraryExW DuplicateHandle GetTickCount LoadLibraryW VirtualQuery LocalAlloc LocalFree FindResourceExW LoadResource LockResource SizeofResource FindResourceW GlobalAlloc GlobalFree GlobalUnlock GlobalLock CreateDirectoryW GetFileSizeEx RemoveDirectoryW WriteFile CopyFileW MoveFileW CompareStringEx GetSystemFirmwareTable FreeLibrary GetEnvironmentVariableW ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection SleepEx CreateFileA GetFullPathNameW MoveFileExA CompareFileTime GetEnvironmentVariableA FormatMessageA FlushFileBuffers LockFileEx UnlockFile HeapDestroy HeapCompact HeapReAlloc DeleteFileA GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate CreateMutexW GetTempPathW UnlockFileEx GetFullPathNameA LockFile GetDiskFreeSpaceW HeapCreate AreFileApisANSI InitializeCriticalSection TryEnterCriticalSection GetCurrentDirectoryW InitializeSRWLock InitializeConditionVariable WakeConditionVariable SleepConditionVariableSRW GetLogicalProcessorInformation GetFileInformationByHandle GetFileTime SetFilePointerEx SetFileTime DeviceIoControl MoveFileExW ResetEvent TlsAlloc TlsGetValue TlsSetValue TlsFree CreateWaitableTimerA WriteConsoleW GetStdHandle GetConsoleMode SetConsoleMode ReadConsoleA ReadConsoleW ReleaseSRWLockShared AcquireSRWLockShared SwitchToFiber DeleteFiber CreateFiberEx GetSystemDirectoryA GetExitCodeThread GetACP GetFileType ConvertFiberToThread ConvertThreadToFiberEx PeekNamedPipe SystemTimeToTzSpecificLocalTime GetConsoleOutputCP SetEnvironmentVariableW SetConsoleCtrlHandler GetTimeZoneInformation GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale InterlockedPushEntrySList GetUserDefaultLCID EnumSystemLocalesW HeapQueryInformation FindFirstFileExW IsValidCodePage GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW GetFinalPathNameByHandleW UnmapViewOfFile

user32

InvalidateRect EndPaint BeginPaint DrawTextW GetSystemMetrics EnumDisplayDevicesA GetUserObjectInformationW GetProcessWindowStation GetClientRect GetWindowRect GetWindowThreadProcessId SendMessageW MessageBoxW GetShellWindow TranslateAcceleratorW LoadAcceleratorsW DispatchMessageW TranslateMessage FillRect GetWindowLongW SetWindowLongW LoadBitmapW LoadIconW DefWindowProcW PostQuitMessage CallWindowProcW RegisterClassW GetMessageW DestroyIcon CreateWindowExW DestroyWindow ShowWindow GetDlgItem EnableWindow

gdi32

DeleteObject CreateSolidBrush SelectObject CreateFontW GetStockObject Rectangle SetDCPenColor SetBkMode SetDCBrushColor SetTextColor

ole32

CoCreateGuid StringFromGUID2 CoTaskMemFree CoTaskMemAlloc CoUninitialize CoInitialize CoCreateInstance CoInitializeEx

shlwapi

PathFindFileNameW PathFindExtensionW ord12

powrprof

CallNtPowerInformation

winmm

timeGetTime timeSetEvent timeGetDevCaps timeBeginPeriod timeEndPeriod

Sharing

General

Malware Config

Signatures

File Explorer

RobloxStudioInstaller.exe

PE Signature issue

comctl32

gdiplus

uxtheme

advapi32

crypt32

ws2_32

iphlpapi

api-ms-win-core-synch-l1-2-0

dbghelp

shell32

kernel32

user32

gdi32

ole32

shlwapi

powrprof

winmm

generic