RobloxPlayerInstaller (3)[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
RobloxPlayerInstaller (3).exe
Size 12.8MB
Sample261011-rd2mdaws9k
SHA256 70f7b1248fa829a6be5c7af852e7f4be44d2ac710f1d3505b4383cf0b97704db
MD5 75d64f7255417033aa4709757cda4c4f
SHA1 60374e7cf20ddb812dc154881b9b1b96b3088416
SHA512 1de5d4fbddeb36f17f730a655cc5f1c05b92785c51c52e3f05cc130e9d12829b5c84ea44258314920de8aa59451b33ac2cf7288b299a1599962909893aca85b3
SSDEEP 196608:zF83SVNvrVUwr8WjxpcLcyXVG/YP/wP5Dq5uaJ:zFdDVPxpcQylIYP+qoaJ
TLSH
T1DDD69D6AB2B800E8D4BBD178C6565613EBB1B41603709BDF16A046FA1F63BE41F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
RobloxPlayerInstaller (3).exe

File Explorer

RobloxPlayerInstaller (3).exe

.exe 12.8MB

RobloxPlayerInstaller (3).exe

IMPHASH bda5def9131db0064643d71a690e8a6c
SHA256 70f7b1248fa829a6be5c7af852e7f4be44d2ac710f1d3505b4383cf0b97704db
MD5 75d64f7255417033aa4709757cda4c4f
SHA1 60374e7cf20ddb812dc154881b9b1b96b3088416
SHA512 1de5d4fbddeb36f17f730a655cc5f1c05b92785c51c52e3f05cc130e9d12829b5c84ea44258314920de8aa59451b33ac2cf7288b299a1599962909893aca85b3
SSDEEP 196608:zF83SVNvrVUwr8WjxpcLcyXVG/YP/wP5Dq5uaJ:zFdDVPxpcQylIYP+qoaJ
TLSH
T1DDD69D6AB2B800E8D4BBD178C6565613EBB1B41603709BDF16A046FA1F63BE41F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

c9:9e:15:f4:01:84:52:8f:9f:7c:82:36:70:c0:5d:3a:e7:a2:4b:ab:7d:06:be:cd:98:6f:7e:87:21:f9:b7:0f

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jan 1, 0001

Subject

Serial Number

01:97:20:58:e4:2c:9c:ca:bd:73:0a:b1:26:7f:15:ed

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 19, 2025 - Dec 18, 2026

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

6274672

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\buildAgent\work\gameenginebuck2------43\buck-out\v2\art\root\05cea60d29778238\Client\Installer\Windows\___RobloxPlayerInstaller.exe__\RobloxPlayerInstaller.pdb

kernel32

OutputDebugStringA LoadLibraryA GetSystemTimeAsFileTime GetVersionExA GetExitCodeProcess MultiByteToWideChar K32GetProcessImageFileNameA Process32First Process32Next GetModuleHandleA SetEndOfFile SetFilePointer FlushViewOfFile WriteConsoleW LocalFree FormatMessageA GetCurrentDirectoryW CreateDirectoryW GetFileAttributesExW GetFileInformationByHandle GetFileTime GetFullPathNameW RemoveDirectoryW SetFilePointerEx SetFileTime GetTempPathW DeviceIoControl CopyFileW MoveFileExW AreFileApisANSI WideCharToMultiByte FileTimeToSystemTime DecodePointer RaiseException InitializeCriticalSectionEx DeleteCriticalSection GetNativeSystemInfo LoadLibraryExW LoadLibraryW VirtualQuery FlushFileBuffers GetTickCount LockFileEx UnlockFile HeapDestroy HeapCompact HeapReAlloc DeleteFileA CreateFileA GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate CreateMutexW UnlockFileEx GetFullPathNameA LockFile GetDiskFreeSpaceW WriteFile HeapCreate InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepEx MoveFileExA CompareFileTime GetEnvironmentVariableA GetTickCount64 InitializeSRWLock InitializeConditionVariable WakeConditionVariable SleepConditionVariableSRW FreeLibrary FindResourceExW LoadResource LockResource SizeofResource FindResourceW GlobalAlloc GlobalFree LocalAlloc GlobalUnlock K32GetProcessMemoryInfo GetFileSizeEx CompareStringEx GetSystemFirmwareTable GetDriveTypeW CreateFile2 InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind ReadFile GetStartupInfoW GetStringTypeW SwitchToThread GetExitCodeThread RtlPcToFileHeader GetLocaleInfoEx EncodePointer LCMapStringEx WakeAllConditionVariable SleepConditionVariableCS FlsAlloc FlsGetValue FlsSetValue FlsFree GetCPInfo RtlUnwindEx InterlockedPushEntrySList InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetCommandLineA ExitThread FreeLibraryAndExitThread SetStdHandle GetFileType ExitProcess PeekNamedPipe SystemTimeToTzSpecificLocalTime GetConsoleOutputCP GetConsoleMode SetEnvironmentVariableW ReadConsoleW GetStdHandle GetTimeZoneInformation GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapQueryInformation SetConsoleCtrlHandler FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW CreateFileW GetSystemTime SetThreadDescription CreateThread VirtualFree VirtualProtect VirtualAlloc GetSystemInfo GetCurrentProcessorNumber QueryPerformanceCounter QueryPerformanceFrequency SetSearchPathMode GlobalMemoryStatusEx GlobalLock CreateProcessW GetCurrentThread OpenEventW CreateEventW SetUnhandledExceptionFilter SetEvent Sleep K32GetModuleFileNameExW Process32NextW Process32FirstW CreateToolhelp32Snapshot SystemTimeToFileTime RtlUnwind GetFinalPathNameByHandleW InitOnceComplete InitOnceBeginInitialize ConvertThreadToFiberEx ConvertFiberToThread CreateSemaphoreA GetSystemDirectoryA CreateFiberEx DeleteFiber SwitchToFiber AcquireSRWLockShared ReleaseSRWLockShared ReadConsoleA SetConsoleMode GetLogicalProcessorInformation GetCurrentProcess GetModuleFileNameW GetFileSize GetFileInformationByHandleEx OpenProcess UpdateProcThreadAttribute InitializeProcThreadAttributeList TerminateProcess SetFileAttributesW GetFileAttributesW DeleteFileW UnmapViewOfFile IsProcessorFeaturePresent MapViewOfFile UnhandledExceptionFilter GetVolumePathNameW CreateWaitableTimerW CancelWaitableTimer SetWaitableTimer GetUserDefaultLocaleName LocaleNameToLCID VerifyVersionInfoW CreateFileMappingW GetDiskFreeSpaceExW FindNextFileW FindFirstFileW FindClose VerSetConditionMask FormatMessageW GetProcAddress GetModuleHandleExW GetModuleHandleW GetModuleFileNameA GetCurrentThreadId GetCurrentProcessId CreateSemaphoreExW CreateMutexExW OpenSemaphoreW WaitForSingleObjectEx WaitForSingleObject ReleaseMutex ReleaseSemaphore GetProcessHeap HeapFree HeapAlloc SetLastError GetLastError CloseHandle OutputDebugStringW DebugBreak IsDebuggerPresent GetEnvironmentVariableW GetCommandLineW

crypt32

CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreA CertOpenSystemStoreW CertDuplicateCertificateContext CertOpenStore CertFindCertificateInStore CertGetCertificateContextProperty

iphlpapi

GetAdaptersAddresses if_nametoindex

ole32

CoInitializeEx CoUninitialize CoCreateInstance StringFromGUID2 CoCreateGuid CoTaskMemAlloc CoTaskMemFree

powrprof

CallNtPowerInformation

user32

CreateWindowExW DestroyWindow ShowWindow GetDlgItem EnableWindow GetSystemMetrics DrawTextW RegisterClassW EndPaint InvalidateRect GetClientRect GetWindowRect FillRect GetWindowLongW CallWindowProcW PostQuitMessage GetWindowLongPtrW DefWindowProcW MessageBoxW BeginPaint SendMessageW LoadIconW DestroyIcon GetProcessWindowStation GetUserObjectInformationW GetMessageW TranslateMessage LoadBitmapW EnumDisplayDevicesA GetWindowThreadProcessId GetShellWindow TranslateAcceleratorW LoadAcceleratorsW DispatchMessageW SetWindowLongPtrW

ws2_32

connect accept WSACleanup WSAStartup recvfrom getsockname getpeername WSAIoctl getservbyname getservbyport gethostbyaddr htons inet_ntoa inet_addr gethostbyname getnameinfo gethostname shutdown sendto select bind listen WSASocketA __WSAFDIsSet closesocket ntohl ntohs setsockopt socket WSAGetLastError getaddrinfo freeaddrinfo inet_ntop htonl getsockopt send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSASetEvent WSAWaitForMultipleEvents recv WSASetLastError ioctlsocket

advapi32

ReportEventW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash RegCloseKey RegCreateKeyExW RegDeleteValueW RegOpenKeyExW RegSetValueExW RegGetValueW RegOpenKeyExA RegQueryValueExA CryptDestroyKey RegEnumKeyExW RegQueryInfoKeyW RegQueryValueExW RegDeleteTreeW OpenProcessToken AllocateAndInitializeSid CopySid EqualSid FreeSid GetLengthSid GetTokenInformation IsValidSid SystemFunction036 CryptGenRandom CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptSignHashW CryptEnumProvidersW DeregisterEventSource RegisterEventSourceW GetUserNameW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress

comctl32

InitCommonControlsEx _TrackMouseEvent TaskDialogIndirect

shell32

SHGetKnownFolderPath ShellExecuteExW SHGetFolderPathAndSubDirW Shell_NotifyIconW ShellExecuteW

gdi32

SetTextColor SetBkMode SetDCPenColor SetDCBrushColor SelectObject Rectangle GetStockObject DeleteObject CreateFontW CreateSolidBrush

shlwapi

ord12 PathFindFileNameW PathFindExtensionW

winmm

timeBeginPeriod timeGetTime timeGetDevCaps timeEndPeriod timeSetEvent

dbghelp

SymFromAddr

gdiplus

GdipAlloc GdiplusStartup GdiplusShutdown GdipCreateBitmapFromStream GdipCreateHBITMAPFromBitmap GdipDisposeImage GdipCloneImage GdipFree

uxtheme

SetWindowTheme

Name

.text

Size

9.3MB

Virtual Size

9.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.4MB

Virtual Size

2.4MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

230KB

Virtual Size

3.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

406KB

Virtual Size

406KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

293KB

Virtual Size

293KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

82KB

Virtual Size

81KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

RobloxPlayerInstaller (3).exe

PE Signature issue

kernel32

crypt32

iphlpapi

ole32

powrprof

user32

ws2_32

advapi32

api-ms-win-core-synch-l1-2-0

comctl32

shell32

gdi32

shlwapi

winmm

dbghelp

gdiplus

uxtheme

generic