Roblox_External[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Roblox_External.exe
Size 14.6MB
Sample261015-1n1x9sdw21
SHA256 847798984a282138ec517412cdbc1f7b25c099234fa7c1a18dd54e605419f26c
MD5 89aab7a61be490b8cd94579bedf70df4
SHA1 34234a5f0aa38a73a48e6e58c52884bc01ca3265
SHA512 714b29e94e0700e6783638d03905c3a4de7081d12acd879351c793fb0e274add54c4c19fabad9863ece8e1d0b45ef69b707aa2a3b6fbe52b342d4c088dd6159a
SSDEEP 393216:eoe9Cc6XorYq9iPQsMQMX8kT+o4IDmonw6KySJHGBowYobEkoN:XPQ68cIDf3SJHE+7
TLSH
T127F6E11CA1A719ACDFB1D5F8992A2117F216B8CC0BB45EE3578405E11E927EC1BBDF02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Roblox_External.exe

File Explorer

Roblox_External.exe

.exe 14.6MB

Roblox_External.exe

IMPHASH b5ed5af3145c0b0c970e13f8409be2c8
SHA256 847798984a282138ec517412cdbc1f7b25c099234fa7c1a18dd54e605419f26c
MD5 89aab7a61be490b8cd94579bedf70df4
SHA1 34234a5f0aa38a73a48e6e58c52884bc01ca3265
SHA512 714b29e94e0700e6783638d03905c3a4de7081d12acd879351c793fb0e274add54c4c19fabad9863ece8e1d0b45ef69b707aa2a3b6fbe52b342d4c088dd6159a
SSDEEP 393216:eoe9Cc6XorYq9iPQsMQMX8kT+o4IDmonw6KySJHGBowYobEkoN:XPQ68cIDf3SJHE+7
TLSH
T127F6E11CA1A719ACDFB1D5F8992A2117F216B8CC0BB45EE3578405E11E927EC1BBDF02
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4703616

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\User\Downloads\bladeball\bin\Roblox_External.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

CreateFileW QueryDosDeviceW SetThreadExecutionState TerminateProcess GetModuleFileNameW K32GetModuleFileNameExW LocalFree GetVolumeInformationA Sleep QueryFullProcessImageNameW CreateThread SetConsoleTitleA FreeConsole ReadProcessMemory WriteProcessMemory VirtualQueryEx CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CreateDirectoryA LoadLibraryW SleepEx FormatMessageW MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetFileType PeekNamedPipe WaitForMultipleObjects GetCurrentProcessId AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetFileInformationByHandleEx FormatMessageA GetLocaleInfoEx SleepConditionVariableSRW GetCurrentThreadId GetModuleHandleW K32GetModuleBaseNameW K32EnumProcessModules K32GetDeviceDriverBaseNameW K32EnumDeviceDrivers GetLastError OutputDebugStringA SetLastError GetCurrentProcess ExitProcess CreateProcessW VirtualProtect OpenProcess Module32NextW Module32FirstW WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead VerifyVersionInfoW SetFileAttributesA GetProcessId CloseHandle Process32NextW Process32FirstW CreateToolhelp32Snapshot GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA MultiByteToWideChar GetLocaleInfoA GetModuleHandleA GetConsoleWindow GetTickCount GetModuleFileNameA GetCurrentThread SetThreadPriority SetConsoleTextAttribute GetStdHandle GetSystemDirectoryW

user32

GetKeyboardLayout TrackMouseEvent GetCapture SetCursor GetClientRect SetProcessDPIAware LoadCursorW ReleaseCapture SetCursorPos SetWindowDisplayAffinity ShowWindow SendMessageW GetForegroundWindow IsWindowUnicode ScreenToClient DefWindowProcW PostQuitMessage SendInput GetCursorPos DestroyWindow DispatchMessageW ClientToScreen FindWindowA GetMessageExtraInfo mouse_event GetKeyState keybd_event SetClipboardData TranslateMessage PeekMessageW UpdateWindow UnregisterClassW SetLayeredWindowAttributes CreateWindowExW GetAsyncKeyState GetClipboardData EmptyClipboard SetCapture CloseClipboard OpenClipboard FindWindowW IsWindowVisible GetWindowLongW GetParent GetWindowThreadProcessId GetWindowTextW PostMessageW EnumWindows SetWindowLongW RegisterClassExW GetSystemMetrics

advapi32

RegCreateKeyExA CryptEncrypt RegOpenKeyExA RegSetValueExA CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW FreeSid CheckTokenMembership AllocateAndInitializeSid GetCurrentHwProfileA ConvertSidToStringSidA GetTokenInformation OpenProcessToken RegQueryValueExA RegCloseKey

shell32

ShellExecuteExW ShellExecuteA

msvcp140

?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ??Bios_base@std@@QEBA_NXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exceptions@std@@YAHXZ ?good@ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z _Query_perf_counter _Query_perf_frequency ?_Xbad_function_call@std@@YAXXZ _Xtime_get_ticks ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Mtx_unlock _Thrd_detach _Cnd_do_broadcast_at_thread_exit ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?id@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEBD4@Z ?_Random_device@std@@YAIXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?tolower@?$ctype@D@std@@QEBADD@Z _Strxfrm _Strcoll ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??7ios_base@std@@QEBA_NXZ _Thrd_yield ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z __crtLCMapStringA ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

winhttp

WinHttpReceiveResponse WinHttpSendRequest WinHttpQueryDataAvailable WinHttpConnect WinHttpCloseHandle WinHttpOpenRequest WinHttpSetTimeouts WinHttpReadData WinHttpOpen

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow

bcrypt

BCryptOpenAlgorithmProvider BCryptGenRandom BCryptDestroyKey BCryptDecrypt BCryptGenerateSymmetricKey BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptGetProperty BCryptCloseAlgorithmProvider BCryptSetProperty

ws2_32

WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError inet_pton ntohs WSASetLastError inet_ntop WSAStartup WSACleanup bind connect getpeername getsockname WSAEnumNetworkEvents gethostname ioctlsocket sendto recvfrom freeaddrinfo getaddrinfo listen htonl accept select __WSAFDIsSet WSACreateEvent getsockopt send WSAIoctl socket WSACloseEvent setsockopt recv htons

crypt32

CertFreeCertificateContext CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CryptDecodeObjectEx CryptStringToBinaryW PFXImportCertStore CertAddCertificateContextToStore

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_copy strstr strchr __RTtypeid __std_type_info_compare __C_specific_handler wcsstr __std_exception_destroy strrchr longjmp _CxxThrowException __intrinsic_setjmp __current_exception_context __current_exception wcschr memcmp memchr memset memmove memcpy __std_terminate

api-ms-win-crt-heap-l1-1-0

free realloc calloc _callnewh malloc _set_new_mode

api-ms-win-crt-math-l1-1-0

ceilf roundf _fdopen sqrtf cos ceil _dsign sinf cosf fmodf acosf logf pow asinf powf sin __setusermatherr

api-ms-win-crt-convert-l1-1-0

strtol atoi strtof wcstombs atof strtoul strtod strtoll strtoull

api-ms-win-crt-runtime-l1-1-0

_initialize_wide_environment _wassert _register_thread_local_exe_atexit_callback exit __sys_errlist __sys_nerr _c_exit _exit _initterm_e system _initterm _get_wide_winmain_command_line _configure_wide_argv terminate abort _set_app_type _seh_filter_exe _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _beginthreadex _errno

api-ms-win-crt-stdio-l1-1-0

ftell fseek feof _lseeki64 _wfopen _popen fgets _set_fmode _pclose _wopen __stdio_common_vfprintf __stdio_common_vsprintf_s __p__commode freopen_s fclose _read _write _get_stream_buffer_pointers _fileno _close fputc fputs ungetc __acrt_iob_func fgetc fread fwrite fgetpos _fseeki64 fsetpos setvbuf fflush __stdio_common_vsprintf __stdio_common_vsscanf

api-ms-win-crt-filesystem-l1-1-0

_wstat64 _lock_file _unlink _unlock_file remove _fstat64

api-ms-win-crt-time-l1-1-0

strftime _mktime64 _gmtime64 _time64 _localtime64_s

api-ms-win-crt-locale-l1-1-0

localeconv _configthreadlocale ___lc_codepage_func ___lc_collate_cp_func ___lc_locale_name_func

api-ms-win-crt-string-l1-1-0

_strdup wcsncpy strpbrk wcsncmp strspn wcspbrk strcspn _wcsdup strncmp strcmp strncpy isspace isalnum _wcsicmp _stricmp isdigit tolower strlen wcslen

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-environment-l1-1-0

getenv _dupenv_s