version-478697a0a9b946b9-RobloxPlayerLauncher[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
version-478697a0a9b946b9-RobloxPlayerLauncher.exe
Size 1.1MB
Sample261009-pjezfset5j
SHA256 e9d133913687103c5244a5ba256eaaf2d908abf9d9545bd49944f91b3409edf5
MD5 afa72211946a099363aca8586b63e293
SHA1 75280dcbbb1a9527bc34a69c2da40e1f3ffcd32d
SHA512 2e5829b220889d0aa6f9e0150137d868a448dfadd429884fa8f0b1345628c1db8cbae818bac353d25c02c51ebd3f27a3584f67492943b53e51c83eec8717b0ca
SSDEEP 12288:f/F05vucSkrT8EQRHzwdc/p9q7iQkrTsJECMw9NO+5As+LZvY7CZZjCS+hEc:m5vucSkrT8EQ5rp9r/rTBNZjx+hE
TLSH
T1633549A2AD5F94F9D57111F0D425825978AF2CB0B521A6C363C237CC8A34D87B729E2F
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
version-478697a0a9b946b9-RobloxPlayerLauncher.exe

File Explorer

version-478697a0a9b946b9-RobloxPlayerLauncher.exe

.exe 1.1MB

version-478697a0a9b946b9-RobloxPlayerLauncher.exe

IMPHASH ccc83e95b4776abcc83a35e284a8d1e1
SHA256 e9d133913687103c5244a5ba256eaaf2d908abf9d9545bd49944f91b3409edf5
MD5 afa72211946a099363aca8586b63e293
SHA1 75280dcbbb1a9527bc34a69c2da40e1f3ffcd32d
SHA512 2e5829b220889d0aa6f9e0150137d868a448dfadd429884fa8f0b1345628c1db8cbae818bac353d25c02c51ebd3f27a3584f67492943b53e51c83eec8717b0ca
SSDEEP 12288:f/F05vucSkrT8EQRHzwdc/p9q7iQkrTsJECMw9NO+5As+LZvY7CZZjCS+hEc:m5vucSkrT8EQ5rp9r/rTBNZjx+hE
TLSH
T1633549A2AD5F94F9D57111F0D425825978AF2CB0B521A6C363C237CC8A34D87B729E2F
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

306589

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Playblox\Trunk2012\Build\Installer\BootstrapperClient\bin\Release\BootstrapperClient.pdb

kernel32

GetTempPathW DeleteFileW GetVersionExW GetSystemTime lstrcmpW GetProcAddress GetModuleHandleW GetModuleFileNameW MultiByteToWideChar WideCharToMultiByte WaitForSingleObject InterlockedDecrement ReleaseMutex CreateMutexW SetEvent ResetEvent SetEndOfFile WriteConsoleW SetStdHandle OutputDebugStringW SetFilePointer ReadConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter GetOEMCP GetACP IsValidCodePage FlushFileBuffers SetFilePointerEx GetConsoleMode GetConsoleCP GetFileType GetStdHandle EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo ReadFile LoadLibraryExW ExitThread CreateThread AreFileApisANSI GetModuleHandleExW ExitProcess OpenEventW CreateEventW CloseHandle IsProcessorFeaturePresent IsDebuggerPresent GetCommandLineW GetLastError CreateEventA FormatMessageA LocalFree GetTickCount GetModuleHandleA CreateSemaphoreA HeapAlloc GetProcessHeap HeapFree GetSystemTimeAsFileTime InitializeCriticalSectionAndSpinCount DeleteCriticalSection ReleaseSemaphore InterlockedIncrement lstrlenW GetCurrentThreadId GetCurrentProcess GetCurrentThread DuplicateHandle LoadLibraryW FreeLibrary CreateProcessW RaiseException TerminateProcess GetUserGeoID GetGeoInfoW CompareFileTime FindFirstFileW FindNextFileW FindClose Sleep GetLocalTime OpenProcess CreateDirectoryW VerSetConditionMask VerifyVersionInfoW GetDiskFreeSpaceExW SetFileAttributesW RemoveDirectoryW CreateFileMappingW MapViewOfFile UnmapViewOfFile SizeofResource LockResource LoadResource FindResourceW FindResourceExW GetShortPathNameW FormatMessageW CreateFileW GetFileAttributesW EnterCriticalSection LeaveCriticalSection TlsAlloc InterlockedExchange InterlockedExchangeAdd WaitForMultipleObjects TerminateThread QueueUserAPC SleepEx PostQueuedCompletionStatus CreateIoCompletionPort SetWaitableTimer GetQueuedCompletionStatus InterlockedCompareExchange SetLastError TlsGetValue TlsSetValue TlsFree GetFileAttributesExW GetFileSizeEx MulDiv SystemTimeToFileTime OpenEventA GetCurrentProcessId CreateWaitableTimerW ResumeThread WaitForSingleObjectEx GetExitCodeProcess lstrcpyW lstrcatW WriteFile GetFileTime DosDateTimeToFileTime LocalFileTimeToFileTime SetFileTime HeapDestroy HeapReAlloc HeapSize EncodePointer DecodePointer GetStringTypeW RtlUnwind

user32

InvalidateRect ShowWindow SetWindowLongW CreateWindowExW LoadBitmapW DefWindowProcW CallWindowProcW GetParent GetWindowRect SendMessageW GetWindowLongW AllowSetForegroundWindow SetWindowTextW CharNextW GetMessageW TranslateAcceleratorW TranslateMessage DispatchMessageW SetFocus SetWindowPos MessageBoxW PostThreadMessageW GetWindowThreadProcessId EnumWindows GetDlgItem PostQuitMessage BeginPaint CharUpperW EndPaint LoadIconW RegisterClassW GetSystemMetrics GetDC ReleaseDC SetTimer FillRect DestroyWindow EnableWindow IsWindowVisible SetForegroundWindow PostMessageW GetWindowTextW MessageBoxA LoadAcceleratorsW KillTimer

gdi32

Rectangle SelectObject CreatePen GetStockObject SetTextColor CreateFontW DeleteObject GetDeviceCaps SetBkMode CreateSolidBrush

advapi32

GetTokenInformation RegQueryValueExW RegOpenKeyExW RegCloseKey GetUserNameW GetSidSubAuthority CheckTokenMembership DuplicateToken RegDeleteKeyW RegEnumKeyExW RegDeleteValueW IsValidSid GetLengthSid CopySid OpenProcessToken OpenThreadToken GetSidLengthRequired InitializeSid RegSetValueExW RegCreateKeyExW CryptGetHashParam CryptHashData CryptDestroyHash CryptReleaseContext CryptCreateHash CryptAcquireContextW RegFlushKey

shell32

ShellExecuteW SHGetFolderPathAndSubDirW ShellExecuteExW

ole32

CoUninitialize CoCreateInstance CoCreateGuid CoInitialize StringFromGUID2

oleaut32

VariantClear VariantInit RegisterTypeLi SysAllocString SysFreeString

shlwapi

SHDeleteKeyW StrCmpW PathAddBackslashW StrRChrW StrCpyW StrCmpNW PathFileExistsW StrDupW StrStrW

version

GetFileVersionInfoW VerQueryValueW GetFileVersionInfoSizeW

sensapi

IsNetworkAlive

userenv

UnloadUserProfile

ws2_32

select ioctlsocket WSASend WSASocketW setsockopt WSAGetLastError getaddrinfo freeaddrinfo connect getsockopt WSARecv WSASetLastError WSAStartup closesocket WSACleanup

wininet

InternetSetOptionW HttpQueryInfoW HttpEndRequestW HttpSendRequestW HttpOpenRequestW HttpAddRequestHeadersW InternetCloseHandle InternetConnectW InternetWriteFile HttpSendRequestExW InternetReadFile InternetQueryDataAvailable InternetOpenW

comctl32

_TrackMouseEvent InitCommonControlsEx

psapi

GetProcessImageFileNameW EnumProcesses

iphlpapi

GetAdaptersInfo

Name

.text

Size

431KB

Virtual Size

431KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

152KB

Virtual Size

151KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

39KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

388KB

Virtual Size

388KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

62KB

Virtual Size

62KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

version-478697a0a9b946b9-RobloxPlayerLauncher.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

version

sensapi

userenv

ws2_32

wininet

comctl32

psapi

iphlpapi

generic