zynova.zip
- SHA256 ef42c4fbbdb5f62815b6ce7d19d0c7428fa193e24ea1aae39e736c7e651395e3
Behavioral task
behavioral1
Sample
Injector.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral2
Sample
Zynova.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral3
Sample
ZynovaModule.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral4
Sample
bin/RobloxPlayerBeta.dll
Resource
win10v2004-20260911-en
windows10-2004-x64
5 signatures
150 seconds
General
- Target zynova.zip
- Size 88.2MB
- Sample261020-yr6a2set6x
- SHA256 ef42c4fbbdb5f62815b6ce7d19d0c7428fa193e24ea1aae39e736c7e651395e3
- MD5 e95d9b2d927d36bf374e3847c1a0e811
- SHA1 96b248a65ca0decbdc7b97ffcd2697b4bc63f19f
- SHA512 f5f99e97b4b163cc0f85f27dff98d4167f2631b23e7715d2fdaab2b4482c3d3b146d3e1df5115fc09ede094dd2f3aaa62dba976e7695af7055ce4fc6f8465dab
- SSDEEP 1572864:LqUA2jB65LRD8ILB/DiJ8dvyJzBka2oUW7A1bE6U0Ejat3tnab3:LqpSB69R9WJ8kJzjRH7pKEj4ts3
- TLSH T1D7183308398130D58A70026E200855DACD357BEDFBAF2D3279856233BD1E7FB655AC6B
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
7/10
Malware Config
Signatures
-
resource yara_rule static1/unpack001/bin/RobloxPlayerBeta.dll themida - Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/bin/RobloxPlayerBeta.dll - Untrusted Codesign Signers 3 IoCs
Codesigned file was signed by an untrusted entity.
resource unpack001/Injector.exe unpack001/Zynova.exe unpack001/ZynovaModule.dll
File Explorer
-
zynova.zip.zip 88.2MB
-
Injector.exe.exe 32.0MB
-
Zynova.exe.exe 34.2MB
-
ZynovaModule.dll.dll 3.2MB
-
bin/RobloxPlayerBeta.dll.dll 30.2MB
Injector.exe
- IMPHASH 1a6a59cd7bb335577fc9f8781ac0baa9
- SHA256 e136f752a1b0a80d15acbd0a91868616c7cc55ffe3111629dedf91bf4bc35666
- MD5 ef974c7131de66969124d755c3404121
- SHA1 d705ccdbcc5b21d1c7de121fa54853f39c03a848
- SHA512 279adf71c5f13b26ffda21f5b94e8d045209c9135bb4388d716b19d92aa290dcee04ffea46ef71fa473313ed81e05de1eff3a15def945af54fe2fe3d2adf5488
- SSDEEP 786432:zF5wqZgO6l0viFYhzgmXbiQo4Z5hT5NLP:fwqZnhzgmXI8R
- TLSH T1D6772396B5D6B1D44BC21984238E42DB21D2E5FE81FE45393BCB5C02A434EEB468DE73
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
2c:31:c1:ed:26:e0:91:49:9c:bf:5c:b9:ff:68:1a:92:50:9b:65:4e:da:ce:a5:0f:e9:89:4d:99:4f:3e:df:b6
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=SupQ Zynova Development
Chains
Oct 17, 2026
CN=SupQ Zynova Development
Subject
CN=SupQ Zynova Development
Serial Number
46:8b:2b:a8:b5:8f:17:95:43:b7:ff:76:1a:f8:86:88
Issuer
CN=SupQ Zynova Development
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 17, 2026 - Oct 17, 2031
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US
Serial Number
08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Aug 5, 2026 - Nov 4, 2037
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
2
Major OS version
5
Entry point
21965271
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
PDB paths
kernel32
CloseHandle
api-ms-win-crt-convert-l1-1-0
mbrtowc
api-ms-win-crt-environment-l1-1-0
__p__environ
api-ms-win-crt-filesystem-l1-1-0
_fstat64
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-locale-l1-1-0
___mb_cur_max_func
api-ms-win-crt-math-l1-1-0
__setusermatherr
api-ms-win-crt-private-l1-1-0
__C_specific_handler
api-ms-win-crt-runtime-l1-1-0
__p___argc
api-ms-win-crt-stdio-l1-1-0
__acrt_iob_func
api-ms-win-crt-string-l1-1-0
_strdup
api-ms-win-crt-time-l1-1-0
strftime
api-ms-win-crt-utility-l1-1-0
rand_s
user32
MessageBoxA
Name
.text
Size
Virtual Size
811KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
Virtual Size
70KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.eh_fram
Size
Virtual Size
4B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
47KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
Virtual Size
66KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.idata
Size
Virtual Size
6KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.tls
Size
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.e)h
Size
Virtual Size
19.1MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.1|[
Size
512B
Virtual Size
288B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.D3]
Size
32.0MB
Virtual Size
32.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
1024B
Virtual Size
687B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
Zynova.exe
- IMPHASH 6afa3edf31c10731c3b40634992779a0
- SHA256 81fe22bc65157970ec78978be80d0ab6c64d3cef33f38067758b6ce4a3906c46
- MD5 841448cf06e1ac1cf2b1b41be38738ea
- SHA1 a2bd7380216f4b3bcc519f824f8497c322e4539c
- SHA512 29ba63f578307335e6e4753af0512f2aedfa99a5e05084a4fef9932f1dc4ce028cd66686d8b512d27414a92cb1d9504c208a3380f5bdf3eb0a53a2408d64a3e6
- SSDEEP 786432:LSqlZXGX4zWIaWrzoWt/KwWALGy0d+EBO3yTdUcd/HA:5TXGcWIaWrERBMFEBiyTdZPA
- TLSH T1A37723A364D862D4C3C30544A24E43EB51C1A57D85FE982D2BC72C026E35DEB5A4EFBB
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
eb:21:6d:db:17:ac:9e:65:e1:00:67:fd:77:e0:8c:8e:ad:b2:51:81:3a:92:fe:e7:4e:e6:da:f6:1f:82:8b:28
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=Dct\, Ryxzve Zynova Development
Chains
Oct 17, 2026
CN=Dct\, Ryxzve Zynova Development
Subject
CN=Dct\, Ryxzve Zynova Development
Serial Number
31:a0:57:b9:8f:66:77:8e:46:ba:a6:4f:6a:52:31:00
Issuer
CN=Dct\, Ryxzve Zynova Development
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 17, 2026 - Oct 17, 2031
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US
Serial Number
08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Aug 5, 2026 - Nov 4, 2037
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
40671145
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
bcryptprimitives
ProcessPrng
ntdll
NtCreateNamedPipeFile
kernel32
GetProcessHeap
RtlUnwindEx
user32
GetMessageA
api-ms-win-core-synch-l1-2-0
WakeByAddressSingle
shell32
SHGetStockIconInfo
combase
CoCreateFreeThreadedMarshaler
comctl32
RemoveWindowSubclass
gdi32
DeleteDC
oleaut32
GetErrorInfo
imm32
ImmGetContext
ole32
RevokeDragDrop
advapi32
RegQueryValueExW
EventWriteTransfer
dwmapi
DwmEnableBlurBehindWindow
shlwapi
SHCreateMemStream
api-ms-win-core-winrt-error-l1-1-0
RoOriginateErrorW
ws2_32
WSACleanup
api-ms-win-crt-math-l1-1-0
floor
api-ms-win-crt-string-l1-1-0
strcpy_s
api-ms-win-crt-convert-l1-1-0
_ultow_s
api-ms-win-crt-runtime-l1-1-0
_register_thread_local_exe_atexit_callback
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
api-ms-win-crt-heap-l1-1-0
_set_new_mode
Name
.text
Size
Virtual Size
3.8MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
Virtual Size
740KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
Virtual Size
55KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.-&7
Size
Virtual Size
20.0MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.79n
Size
1024B
Virtual Size
872B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.[E:
Size
34.2MB
Virtual Size
34.2MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
12KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
512B
Virtual Size
252B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
ZynovaModule.dll
- IMPHASH cd30ffe237671993105fa560b1370a22
- SHA256 eb25c6eeff8d1761a8291677772e58038b64e4848350cb4fd6a2651ac773e740
- MD5 6abd865a57f49488161cff9391e7bd89
- SHA1 2bf32f288ff1b07615ba0816b8f7da897ea23442
- SHA512 e05be3699e79f618a4c9a0b24ac9c5fcfca6db01adc372f37411cf33ba0734d118b9ce24d077240efec69cc8caaa57d0975e5b568a786c7dfe96b13d3b204bcd
- SSDEEP 49152:iJ/yhp7KvGdCcLrhAPlLDthv1N0t8XY9BhrOOK/FYJ/nb0tsZvf:iB3oat/teBhh9
- TLSH T186F58D66A6A800ECD077C1BCCA9B9A17E772B4450360A7EF06E446652F67BF10F7E311
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Untrusted Codesign Signers
Codesigned file was signed by an untrusted entity.
PE Signature issue
Digest
f3:80:a8:bb:50:6d:55:bc:08:91:03:c1:2f:2b:4b:ad:fe:02:9b:98:48:f8:a9:49:7d:93:dc:2b:8d:85:ce:3b
Digest Algorithm
sha256
PE Digests Matches
Trusted
Not trusted
Signing Certificate
CN=SupQ Zynova Development
Chains
Oct 17, 2026
CN=SupQ Zynova Development
Subject
CN=SupQ Zynova Development
Serial Number
6c:ac:4c:1d:47:6f:8d:b3:46:73:48:fc:0b:63:6e:14
Issuer
CN=SupQ Zynova Development
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageCodeSigning
Timespan
Oct 17, 2026 - Oct 17, 2031
Subject
CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US
Serial Number
08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35
Issuer
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Key Usages
KeyUsageDigitalSignature
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
Aug 5, 2026 - Nov 4, 2037
Subject
CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US
Serial Number
0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86
Issuer
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Ext Key Usages
ExtKeyUsageTimeStamping
Revocation Status
Not revoked
Timespan
May 7, 2025 - Jan 14, 2038
Subject
CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US
Serial Number
0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Issuer
CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US
Key Usages
KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign
Revocation Status
Not revoked
Timespan
Aug 1, 2022 - Nov 9, 2031
Minor OS version
0
Major OS version
6
Entry point
1954632
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
C:\Users\Administrator\Downloads\zynova executor\build\ZynovaModule.pdb
ws2_32
inet_pton
WSASocketW
shutdown
getpeername
getsockname
ntohs
getsockopt
WSAPoll
ioctlsocket
getnameinfo
WSAGetLastError
accept
bind
closesocket
ntohl
listen
getaddrinfo
inet_addr
send
socket
connect
recv
htons
freeaddrinfo
setsockopt
WSACleanup
WSAStartup
crypt32
CertFreeCertificateContext
CertGetCertificateChain
CryptBinaryToStringA
CertOpenSystemStoreW
CertVerifyCertificateChainPolicy
CertFreeCertificateChain
CertCloseStore
CertEnumCertificatesInStore
CertCreateCertificateContext
winhttp
WinHttpSetTimeouts
WinHttpSendRequest
WinHttpCloseHandle
WinHttpSetOption
WinHttpOpenRequest
WinHttpReadData
WinHttpConnect
WinHttpOpen
WinHttpReceiveResponse
WinHttpQueryDataAvailable
WinHttpWebSocketCompleteUpgrade
WinHttpWebSocketClose
WinHttpWebSocketReceive
WinHttpWebSocketSend
WinHttpQueryHeaders
kernel32
RtlLookupFunctionEntry
RtlCaptureContext
WakeAllConditionVariable
RtlVirtualUnwind
AcquireSRWLockExclusive
ReleaseSRWLockExclusive
UnhandledExceptionFilter
IsProcessorFeaturePresent
IsDebuggerPresent
GetSystemTimeAsFileTime
MoveFileExA
InitOnceBeginInitialize
InitOnceComplete
GetFileInformationByHandleEx
AreFileApisANSI
CreateDirectoryW
GetModuleFileNameA
GetCurrentProcess
ExpandEnvironmentStringsW
OutputDebugStringA
TerminateProcess
InitializeCriticalSection
SetFilePointer
GetCurrentThreadId
GetModuleHandleA
GetModuleHandleExA
CreateFileA
DisableThreadLibraryCalls
GetLocalTime
ExitProcess
GetCurrentProcessId
SetUnhandledExceptionFilter
VirtualQuery
Sleep
ReadFile
FindFirstFileW
GetFileSizeEx
HeapFree
GetFullPathNameW
FindNextFileW
WriteFile
RemoveDirectoryW
FindClose
CreateFileW
GetFileAttributesW
SetFileAttributesW
MultiByteToWideChar
GetTickCount64
GetLastError
DeleteFileW
CloseHandle
HeapAlloc
MoveFileExW
GetProcessHeap
CopyFileW
WideCharToMultiByte
EnterCriticalSection
LeaveCriticalSection
GetVolumeInformationA
GetComputerNameA
FlushFileBuffers
GlobalAlloc
GlobalFree
GlobalLock
GlobalUnlock
IsBadReadPtr
GetModuleHandleExW
GetModuleFileNameW
CreateProcessW
VirtualFree
VirtualAlloc
FillConsoleOutputCharacterA
GetConsoleScreenBufferInfo
SetConsoleTextAttribute
SetConsoleTitleA
GetStdHandle
WriteConsoleA
SetConsoleMode
ReadConsoleA
GetConsoleMode
FreeConsole
FillConsoleOutputAttribute
GetConsoleWindow
SetConsoleOutputCP
SetConsoleCursorPosition
AllocConsole
FormatMessageA
LoadLibraryA
QueryPerformanceFrequency
GetProcAddress
VerSetConditionMask
GetModuleHandleW
QueryPerformanceCounter
GetFileInformationByHandle
GetFileAttributesExW
SleepConditionVariableSRW
GetLocaleInfoEx
AddVectoredExceptionHandler
LocalFree
InitializeSListHead
user32
GetWindowLongW
DefWindowProcW
AdjustWindowRectEx
GetKeyState
DestroyWindow
MonitorFromWindow
EnumDisplayMonitors
CreateWindowExW
ScreenToClient
SetWindowTextW
RegisterClassExW
WindowFromPoint
GetCapture
GetMonitorInfoW
ClientToScreen
IsChild
TrackMouseEvent
SetLayeredWindowAttributes
SetFocus
BringWindowToTop
LoadCursorW
SetCapture
SetCursor
SetWindowLongW
GetClientRect
ReleaseCapture
SetForegroundWindow
IsIconic
SetCursorPos
GetCursorPos
SetWindowPos
ShowWindow
GetWindowThreadProcessId
keybd_event
GetSystemMetrics
OpenClipboard
CloseClipboard
EmptyClipboard
MessageBoxA
GetForegroundWindow
GetClipboardData
mouse_event
SetClipboardData
FindWindowA
CallWindowProcW
GetDC
SetWindowLongPtrW
ReleaseDC
MessageBoxW
gdi32
GetDeviceCaps
comdlg32
GetSaveFileNameA
GetOpenFileNameA
advapi32
CryptAcquireContextW
GetCurrentHwProfileW
CryptDestroyKey
CryptEncrypt
CryptGenRandom
CryptReleaseContext
CryptGetHashParam
CryptImportKey
CryptSetKeyParam
CryptDecrypt
CryptDestroyHash
CryptHashData
CryptCreateHash
shell32
SHGetFolderPathW
SHBrowseForFolderA
ShellExecuteA
SHGetPathFromIDListA
ole32
CoTaskMemFree
msvcp140
_Xtime_get_ticks
_Thrd_join
?tolower@?$ctype@D@std@@QEBADD@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
??_D?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_K@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
?seekpos@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@V32@H@Z
?seekoff@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA?AV?$fpos@U_Mbstatet@@@2@_JHH@Z
?underflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?pbackfail@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
?overflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHH@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
_Thrd_id
?_Random_device@std@@YAIXZ
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
?_Xinvalid_argument@std@@YAXPEBD@Z
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
_Cnd_signal
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Throw_Cpp_error@std@@YAXH@Z
?_Xbad_alloc@std@@YAXXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Winerror_map@std@@YAHH@Z
?_Xlength_error@std@@YAXPEBD@Z
?_Syserror_map@std@@YAPEBDH@Z
_Mtx_lock
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
_Mtx_unlock
?_Xbad_function_call@std@@YAXXZ
_Query_perf_frequency
_Query_perf_counter
??_7_Facet_base@std@@6B@
_Strxfrm
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
?_Id_cnt@id@locale@std@@0HA
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
??_7facet@locale@std@@6B@
_Strcoll
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??1_Facet_base@std@@UEAA@XZ
?uncaught_exceptions@std@@YAHXZ
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?_Gninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
bcrypt
BCryptGetProperty
BCryptOpenAlgorithmProvider
BCryptHashData
BCryptDestroyHash
BCryptCreateHash
BCryptCloseAlgorithmProvider
BCryptFinishHash
BCryptGenRandom
d3dcompiler_47
D3DCompile
imm32
ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
ImmAssociateContextEx
ImmGetContext
vcruntime140_1
__CxxFrameHandler4
vcruntime140
_set_purecall_handler
__std_exception_copy
__std_exception_destroy
__C_specific_handler
_purecall
strchr
wcsrchr
strstr
memcpy
__std_type_info_destroy_list
memmove
memset
memcmp
memchr
__current_exception
__C_specific_handler_noexcept
__current_exception_context
strrchr
_CxxThrowException
api-ms-win-crt-runtime-l1-1-0
_set_invalid_parameter_handler
terminate
signal
abort
exit
_resetstkoflw
_invoke_watson
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
_initterm
_initterm_e
set_terminate
_beginthreadex
_errno
api-ms-win-crt-heap-l1-1-0
calloc
free
malloc
_callnewh
realloc
api-ms-win-crt-stdio-l1-1-0
_fseeki64
fwrite
__stdio_common_vswprintf_s
fgetpos
setbuf
fopen
fgetc
setvbuf
ungetc
fsetpos
fread
fflush
ftell
fputc
_wfopen
fclose
_get_stream_buffer_pointers
__stdio_common_vsnprintf_s
__stdio_common_vsscanf
__stdio_common_vsprintf
__acrt_iob_func
__stdio_common_vfprintf
__stdio_common_vsprintf_s
__stdio_common_vfwprintf
fseek
_wfopen_s
api-ms-win-crt-string-l1-1-0
strcspn
strncat
isgraph
strncpy_s
strcmp
strpbrk
islower
isdigit
_stricmp
_wcsicmp
wcscpy_s
strcpy_s
_wcsnicmp
tolower
wcscat_s
strncmp
isalnum
ispunct
iscntrl
isxdigit
isalpha
isupper
strspn
isblank
toupper
isspace
strncpy
api-ms-win-crt-math-l1-1-0
floor
cosh
floorf
llround
fmod
cosf
cos
fmodf
ceil
atan2f
atan2
log
atan
asin
acosf
acos
_dclass
log10
log2
logf
pow
powf
_dsign
ldexp
round
modf
frexp
sin
exp
sinf
sinh
sqrt
sqrtf
tanh
tan
ceilf
api-ms-win-crt-convert-l1-1-0
strtoul
atoi
strtol
strtoll
atof
strtod
strtoull
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
_lock_file
remove
api-ms-win-crt-locale-l1-1-0
localeconv
___lc_codepage_func
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-time-l1-1-0
_difftime64
strftime
_gmtime64_s
_time64
clock
_localtime64_s
Name
.text
Size
2.4MB
Virtual Size
2.4MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
670KB
Virtual Size
670KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
46KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
97KB
Virtual Size
97KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.rsrc
Size
512B
Virtual Size
248B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
14KB
Virtual Size
14KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=20, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=77, id=260, version=34809,
count=8, id=260, version=35207,
count=35, id=261, version=35207,
count=6, id=259, version=35207,
count=6, id=257, version=35207,
count=12, id=260, version=34120,
count=587, id=1, productName=Unmarked objects,
count=29, id=257, version=33145,
count=138, id=265, version=35225,
count=1, id=255, version=35225,
count=1, id=258, version=35225,
bin/RobloxPlayerBeta.dll
- SHA256 08f561caa37a08c50168afac9edcc8cfbe588b649249d07a71c0f69c3f70725c
- MD5 cb822a5b945f2c10dce49ace0dbbd9a1
- SHA1 8fb704f9ac6c8b08f37687d00628bb5ebf888fe0
- SHA512 c66ee059af9a50c75713b02879c65433db530673ba1474f50bfedd2939a4a1c95e5207516b68d84eeaa2fa4d943b0852c820d5156ff9d029527265f7d4da0e9c
- SSDEEP 393216:YqelaaEJLkK7TaZA3RquMVBp+OAawDTFlDGAdcyclwM3cv+n/iUkZ/0SPtUnCSs0:klaaQzyAh4pua2a4cGIsZcWtMcDrkr
- TLSH T1C667331937C75544CAB2443DAA2A00F6DF13AFDEDEA35B612CC64A272F0364F911E5CA
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
34336856
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_GUARD_CF
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB paths
run
Name
Size
84KB
Virtual Size
145KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
Size
35KB
Virtual Size
94KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
18KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
4KB
Virtual Size
7KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
Size
26.6MB
Virtual Size
26.6MB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
Size
3KB
Virtual Size
5KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.edata
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
3KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
1KB
Virtual Size
4KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.themida
Size
Virtual Size
5.9MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.boot
Size
3.5MB
Virtual Size
3.5MB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.reloc
Size
16B
Virtual Size
4KB
Characteristics
IMAGE_SCN_MEM_READ
generic
count=146, id=261, version=33145,
count=12, id=260, version=33145,
count=8, id=259, version=33145,
count=9, id=259, version=35721,
count=15, id=260, version=35721,
count=37, id=261, version=35721,
count=60, id=147, productName=VS2008 SP1 build 30729, version=30729,
count=7, id=257, version=33145,
count=132, id=1, productName=Unmarked objects,
count=24, id=265, version=36257,
count=1, id=256, version=36257,
count=1, id=255, version=36257,
count=1, id=151,
count=1, id=258, version=36257,