version-5c16dec2b086b1cb-RobloxPlayerLauncher[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
version-5c16dec2b086b1cb-RobloxPlayerLauncher.exe
Size 986KB
Sample261102-pk3rxaws2j
SHA256 84eefc779c55b88c1bd4118fc27a1bac2e412d05f0acc80a4815a1c8ee005a90
MD5 71e8195b052146899121a0222095c6d6
SHA1 27cbb675bd9c98980358d0e119d270e829919eb9
SHA512 f9006e8ce89bf85f0c5c0ebb104366d977b705506e25d917f34dbe3b3f748a248426222d68c386b7e96d8158cfa22148fe3051548228199726c189653f870202
SSDEEP 12288:WHddw0vUGm2KAf97WTqpb1AvLw/DIAuNzTs1kra4Y3KR:WHdFvUGm2B7WTqXDezTCQaK
TLSH
T156255A52BEAFA8F9D07251F1D528866891AF6C70B92106C323A477CD0B74D83B731E5E
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
version-5c16dec2b086b1cb-RobloxPlayerLauncher.exe

File Explorer

version-5c16dec2b086b1cb-RobloxPlayerLauncher.exe

.exe 986KB

version-5c16dec2b086b1cb-RobloxPlayerLauncher.exe

IMPHASH 72ba3ea8b6a91beebde3c966a81fdd0e
SHA256 84eefc779c55b88c1bd4118fc27a1bac2e412d05f0acc80a4815a1c8ee005a90
MD5 71e8195b052146899121a0222095c6d6
SHA1 27cbb675bd9c98980358d0e119d270e829919eb9
SHA512 f9006e8ce89bf85f0c5c0ebb104366d977b705506e25d917f34dbe3b3f748a248426222d68c386b7e96d8158cfa22148fe3051548228199726c189653f870202
SSDEEP 12288:WHddw0vUGm2KAf97WTqpb1AvLw/DIAuNzTs1kra4Y3KR:WHdFvUGm2B7WTqXDezTCQaK
TLSH
T156255A52BEAFA8F9D07251F1D528866891AF6C70B92106C323A477CD0B74D83B731E5E
MD5 SHA1 SHA512 SSDEEP TLSH

windows:5 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

301060

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

kernel32

OpenEventA ResumeThread CreateWaitableTimerA GetTempPathW DeleteFileW GetVersionExW lstrcmpW GetProcAddress GetModuleHandleW GetModuleFileNameW lstrlenW InterlockedDecrement WaitForSingleObject ReleaseMutex CreateMutexW SetEvent ResetEvent OpenEventW CreateEventW CloseHandle CreateEventA SetEndOfFile WriteConsoleW SetStdHandle OutputDebugStringW SetFilePointer ReadConsoleW FreeEnvironmentStringsW GetEnvironmentStringsW QueryPerformanceCounter FlushFileBuffers SetFilePointerEx GetConsoleMode GetConsoleCP GetFileType GetStdHandle GetOEMCP GetACP IsValidCodePage EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW GetStartupInfoW SetUnhandledExceptionFilter UnhandledExceptionFilter GetCPInfo ReadFile GetCurrentProcessId AreFileApisANSI GetSystemTime GetLastError MultiByteToWideChar GetModuleHandleExW ExitProcess WideCharToMultiByte lstrlenA LocalFree FormatMessageA InterlockedIncrement InitializeCriticalSectionAndSpinCount DeleteCriticalSection EnterCriticalSection LeaveCriticalSection TlsAlloc InterlockedExchange InterlockedExchangeAdd WaitForMultipleObjects TerminateThread QueueUserAPC SleepEx PostQueuedCompletionStatus CreateIoCompletionPort SetWaitableTimer GetQueuedCompletionStatus InterlockedCompareExchange SetLastError VerSetConditionMask VerifyVersionInfoW Sleep TlsGetValue TlsSetValue SizeofResource LockResource LoadResource FindResourceW FindResourceExW TlsFree GetTickCount GetModuleHandleA CreateSemaphoreA DuplicateHandle HeapAlloc GetProcessHeap HeapFree GetSystemTimeAsFileTime ReleaseSemaphore GetCurrentThreadId LoadLibraryW FreeLibrary CreateProcessW RaiseException GetCurrentProcess GetCurrentThread TerminateProcess GetUserGeoID GetGeoInfoW CompareFileTime FindFirstFileW FindNextFileW FindClose GetLocalTime OpenProcess CreateDirectoryW GetDiskFreeSpaceExW SetFileAttributesW RemoveDirectoryW CreateFileMappingW MapViewOfFile UnmapViewOfFile GetShortPathNameW FormatMessageW CreateFileW GetFileAttributesW GetFileAttributesExW GetFileSizeEx MulDiv GetExitCodeProcess lstrcpyW lstrcatW WriteFile GetFileTime DosDateTimeToFileTime LocalFileTimeToFileTime SetFileTime HeapDestroy HeapReAlloc HeapSize EncodePointer DecodePointer GetStringTypeW RtlUnwind GetCommandLineW IsDebuggerPresent IsProcessorFeaturePresent CreateThread ExitThread LoadLibraryExW SystemTimeToFileTime

user32

CreateWindowExW SetWindowLongW ShowWindow InvalidateRect CallWindowProcW GetParent SetWindowTextW LoadAcceleratorsW GetMessageW TranslateAcceleratorW TranslateMessage DispatchMessageW SetFocus GetWindowRect MessageBoxW PostThreadMessageW GetWindowThreadProcessId LoadBitmapW GetDlgItem PostQuitMessage BeginPaint FillRect EndPaint LoadIconW RegisterClassW GetSystemMetrics SendMessageW ReleaseDC SetTimer KillTimer DestroyWindow EnableWindow IsWindowVisible SetForegroundWindow PostMessageW GetDC EnumWindows DefWindowProcW GetWindowLongW AllowSetForegroundWindow CharNextW CharUpperW MessageBoxA SetWindowPos GetWindowTextW

gdi32

Rectangle SelectObject CreatePen GetStockObject SetTextColor GetDeviceCaps CreateSolidBrush DeleteObject CreateFontW SetBkMode

advapi32

GetLengthSid RegOpenKeyExW RegCloseKey GetUserNameW RegDeleteKeyW RegEnumKeyExW RegDeleteValueW RegFlushKey CryptAcquireContextW CryptCreateHash CryptReleaseContext CryptDestroyHash CryptHashData GetSidLengthRequired InitializeSid GetSidSubAuthority CopySid CryptGetHashParam IsValidSid CheckTokenMembership DuplicateToken OpenProcessToken OpenThreadToken RegSetValueExW RegCreateKeyExW GetTokenInformation RegQueryValueExW

shell32

ShellExecuteW ShellExecuteExW SHGetFolderPathAndSubDirW

ole32

StringFromGUID2 CoCreateInstance CoCreateGuid CoInitialize CoUninitialize

oleaut32

VariantClear VariantInit RegisterTypeLi SysFreeString SysAllocString

shlwapi

StrRChrW StrCpyW StrDupW StrCmpNW PathAddBackslashW StrCmpW PathFileExistsW StrStrW SHDeleteKeyW

version

VerQueryValueW GetFileVersionInfoW GetFileVersionInfoSizeW

ws2_32

WSASend WSARecv setsockopt WSAGetLastError getaddrinfo getsockopt WSASetLastError select ioctlsocket closesocket WSACleanup freeaddrinfo connect WSAStartup WSASocketW

wininet

HttpSendRequestExW InternetReadFile InternetConnectW InternetOpenW InternetQueryDataAvailable InternetCloseHandle HttpOpenRequestW HttpAddRequestHeadersW HttpSendRequestW HttpQueryInfoW HttpEndRequestW InternetWriteFile InternetSetOptionW

sensapi

IsNetworkAlive

userenv

UnloadUserProfile

comctl32

InitCommonControlsEx _TrackMouseEvent

psapi

GetProcessImageFileNameW EnumProcesses

iphlpapi

GetAdaptersInfo

Name

.text

Size

431KB

Virtual Size

430KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

150KB

Virtual Size

150KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

39KB

Virtual Size

48KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.tls

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

292KB

Virtual Size

292KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

71KB

Virtual Size

70KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

version-5c16dec2b086b1cb-RobloxPlayerLauncher.exe

kernel32

user32

gdi32

advapi32

shell32

ole32

oleaut32

shlwapi

version

ws2_32

wininet

sensapi

userenv

comctl32

psapi

iphlpapi

generic