RobloxPlayerLauncher[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
RobloxPlayerLauncher.exe
Size 986KB
Sample261011-xzcs2aff42
SHA256 a1ae454fd84522dab3418e7b56fe7523886dd2bbabab93801e1807c2ba752c7c
MD5 d921a3b46479f6c8aa9d2973f5be5561
SHA1 9ce6bec4f1797e2c17cde90232cec5d4f1faf61f
SHA512 6fdd9758314f19828d75849d75ec5308db17eb93576e61abc198f04265742b4c2cc829c7c2373758da19cd0004abc0da72c9c8c6302a0807547d84b4a373f713
SSDEEP 12288:CX+9Akl1GloaMHdox0OerESl2vzNNTs/xIFVMMZxb:CX+hl1GlCHdoxmH2ZNTiIf1xb
TLSH
T15E255A52BE6FA8F9D07211F0D92886A891AF6C70B92105C323A577CD0B74D87B731E5E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
RobloxPlayerLauncher.exe

File Explorer

RobloxPlayerLauncher.exe

.exe 986KB

RobloxPlayerLauncher.exe

IMPHASH 91a091282d93ad56e9bfe594cd1e8deb
SHA256 a1ae454fd84522dab3418e7b56fe7523886dd2bbabab93801e1807c2ba752c7c
MD5 d921a3b46479f6c8aa9d2973f5be5561
SHA1 9ce6bec4f1797e2c17cde90232cec5d4f1faf61f
SHA512 6fdd9758314f19828d75849d75ec5308db17eb93576e61abc198f04265742b4c2cc829c7c2373758da19cd0004abc0da72c9c8c6302a0807547d84b4a373f713
SSDEEP 12288:CX+9Akl1GloaMHdox0OerESl2vzNNTs/xIFVMMZxb:CX+hl1GlCHdoxmH2ZNTiIf1xb
TLSH
T15E255A52BE6FA8F9D07211F0D92886A891AF6C70B92105C323A577CD0B74D87B731E5E
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

300996

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

D:\Trunk2012\Client\Installer\BootstrapperClient\bin\Release\BootstrapperClient.pdb

kernel32

OpenEventA ResumeThread CreateWaitableTimerA GetTempPathW DeleteFileW GetVersionExW lstrcmpW GetProcAddress GetModuleHandleW GetModuleFileNameW WaitForSingleObject InterlockedDecrement ReleaseMutex CreateMutexW SetEvent ResetEvent OpenEventW CreateEventW CloseHandle CreateEventA SetEndOfFile WriteConsoleW SetStdHandle OutputDebugStringW SetFilePointer ReadConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter FlushFileBuffers SetFilePointerEx GetConsoleMode GetConsoleCP GetFileType GetStdHandle GetOEMCP GetACP IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo ReadFile GetCurrentProcessId AreFileApisANSI GetSystemTime GetLastError MultiByteToWideChar GetModuleHandleExW ExitProcess InitializeCriticalSectionAndSpinCount WideCharToMultiByte LocalFree FormatMessageA InterlockedIncrement DeleteCriticalSection EnterCriticalSection LeaveCriticalSection TlsAlloc InterlockedExchange InterlockedExchangeAdd WaitForMultipleObjects TerminateThread QueueUserAPC SleepEx PostQueuedCompletionStatus CreateIoCompletionPort SetWaitableTimer GetQueuedCompletionStatus InterlockedCompareExchange SetLastError VerSetConditionMask VerifyVersionInfoW Sleep TlsGetValue TlsSetValue SizeofResource LockResource LoadResource FindResourceW FindResourceExW TlsFree GetTickCount GetModuleHandleA CreateSemaphoreA DuplicateHandle HeapAlloc GetProcessHeap HeapFree GetSystemTimeAsFileTime ReleaseSemaphore lstrlenW GetCurrentThreadId LoadLibraryW FreeLibrary CreateProcessW RaiseException GetCurrentProcess GetCurrentThread TerminateProcess GetUserGeoID GetGeoInfoW CompareFileTime FindFirstFileW FindNextFileW FindClose GetLocalTime OpenProcess CreateDirectoryW GetDiskFreeSpaceExW SetFileAttributesW RemoveDirectoryW CreateFileMappingW MapViewOfFile UnmapViewOfFile GetShortPathNameW FormatMessageW CreateFileW GetFileAttributesW GetFileAttributesExW GetFileSizeEx MulDiv WaitForSingleObjectEx GetExitCodeProcess lstrcpyW lstrcatW WriteFile GetFileTime DosDateTimeToFileTime LocalFileTimeToFileTime SetFileTime HeapDestroy HeapReAlloc HeapSize EncodePointer DecodePointer GetStringTypeW RtlUnwind GetCommandLineW IsDebuggerPresent IsProcessorFeaturePresent CreateThread ExitThread LoadLibraryExW SystemTimeToFileTime

user32

CreateWindowExW SetWindowLongW ShowWindow InvalidateRect CallWindowProcW GetParent SetWindowTextW LoadAcceleratorsW GetMessageW TranslateAcceleratorW TranslateMessage DispatchMessageW SetFocus GetWindowRect MessageBoxW PostThreadMessageW GetWindowThreadProcessId LoadBitmapW GetDlgItem PostQuitMessage BeginPaint FillRect EndPaint LoadIconW RegisterClassW GetSystemMetrics SendMessageW ReleaseDC SetTimer KillTimer DestroyWindow EnableWindow IsWindowVisible SetForegroundWindow PostMessageW GetDC EnumWindows DefWindowProcW GetWindowLongW AllowSetForegroundWindow CharNextW CharUpperW MessageBoxA SetWindowPos GetWindowTextW

gdi32

Rectangle SelectObject CreatePen GetStockObject SetTextColor CreateSolidBrush DeleteObject GetDeviceCaps CreateFontW SetBkMode

advapi32

GetLengthSid RegQueryValueExW RegOpenKeyExW RegCloseKey GetUserNameW RegDeleteKeyW RegEnumKeyExW RegDeleteValueW RegFlushKey CryptAcquireContextW CryptCreateHash CryptReleaseContext CryptDestroyHash GetSidLengthRequired InitializeSid GetSidSubAuthority CopySid CryptHashData IsValidSid CheckTokenMembership DuplicateToken OpenProcessToken OpenThreadToken RegSetValueExW GetTokenInformation CryptGetHashParam RegCreateKeyExW

shell32

ShellExecuteW ShellExecuteExW SHGetFolderPathAndSubDirW

ole32

StringFromGUID2 CoCreateInstance CoCreateGuid CoInitialize CoUninitialize

oleaut32

VariantClear VariantInit RegisterTypeLi SysFreeString SysAllocString

shlwapi

StrRChrW StrCpyW StrDupW StrCmpNW PathAddBackslashW StrCmpW PathFileExistsW StrStrW SHDeleteKeyW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

ws2_32

WSASend WSARecv setsockopt WSAGetLastError getaddrinfo getsockopt WSASetLastError select ioctlsocket closesocket WSACleanup freeaddrinfo connect WSAStartup WSASocketW

wininet

HttpSendRequestExW InternetReadFile InternetConnectW InternetOpenW InternetQueryDataAvailable InternetCloseHandle HttpOpenRequestW HttpAddRequestHeadersW HttpSendRequestW HttpQueryInfoW HttpEndRequestW InternetWriteFile InternetSetOptionW

sensapi

IsNetworkAlive

userenv

UnloadUserProfile

comctl32

InitCommonControlsEx _TrackMouseEvent

psapi

GetProcessImageFileNameW EnumProcesses

iphlpapi

GetAdaptersInfo

Name

.text

Size

431KB

Virtual Size

430KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

150KB

Virtual Size

150KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

39KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

292KB

Virtual Size

292KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

71KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

RobloxPlayerLauncher.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

version

ws2_32

wininet

sensapi

userenv

comctl32

psapi

iphlpapi

generic