Roblox-External[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Roblox-External.exe
Size 1.4MB
Sample261113-dbm5bafv4m
SHA256 633992ab1b7346333f925b4c35a647ab863539667b44aa1e0eded40fc3553581
MD5 0b31ba5a2dce1a69d5e5f9cc48d62120
SHA1 e9a3f989026128195ce2c5e43c8a5430fd8f69c3
SHA512 abcd245096bd93756fd1af7acd406d34f90a321c7f8b4c4e00d253a1e7d43fda8036b270b6465109fc8bea8d5c718cc8f5b75ba8bb3c8886ac46b3d7371ecfb6
SSDEEP 24576:DZnmVlM9kz4uq4skRtP6rS+8PZonYOKvqQttFEkLFr4GzvsGBMEYFn0DbK8kBo+n:sVlP4uq9kRtP8S+qZjOKvqQ49n0Db+Hn
TLSH
T18C65AE4BF6A505FCD47BC178C95AAA17EA76340C033099EF13E00A952F637E45A7BB12
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Roblox-External.exe

File Explorer

Roblox-External.exe

.exe 1.4MB

Roblox-External.exe

IMPHASH 6b3aa4ea01daf1733f31e0040c9013b2
SHA256 633992ab1b7346333f925b4c35a647ab863539667b44aa1e0eded40fc3553581
MD5 0b31ba5a2dce1a69d5e5f9cc48d62120
SHA1 e9a3f989026128195ce2c5e43c8a5430fd8f69c3
SHA512 abcd245096bd93756fd1af7acd406d34f90a321c7f8b4c4e00d253a1e7d43fda8036b270b6465109fc8bea8d5c718cc8f5b75ba8bb3c8886ac46b3d7371ecfb6
SSDEEP 24576:DZnmVlM9kz4uq4skRtP6rS+8PZonYOKvqQttFEkLFr4GzvsGBMEYFn0DbK8kBo+n:sVlP4uq9kRtP8S+qZjOKvqQ49n0Db+Hn
TLSH
T18C65AE4BF6A505FCD47BC178C95AAA17EA76340C033099EF13E00A952F637E45A7BB12
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

948320

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

kernel32

Module32NextW GetModuleFileNameW GetCurrentThreadId Sleep GetTickCount64 K32GetModuleInformation GetLocalTime AddVectoredExceptionHandler ExitProcess CreateProcessW GetModuleHandleW SetUnhandledExceptionFilter GetExitCodeProcess GetProcAddress Module32FirstW CloseHandle Process32FirstW Process32NextW MultiByteToWideChar SetEndOfFile WriteConsoleW HeapSize CreateFileW SetStdHandle GetProcessHeap SetEnvironmentVariableW CreateToolhelp32Snapshot GetEnvironmentStringsW HeapReAlloc GetOEMCP GetACP IsValidCodePage ReadConsoleW GetConsoleMode GetConsoleOutputCP FlushFileBuffers SetFilePointerEx GetFileSizeEx EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW LoadLibraryExW GetFileType HeapAlloc HeapFree GetCommandLineW GetCommandLineA WriteFile GetStdHandle OpenProcess GetModuleHandleA ReadFile SetConsoleCtrlHandler TerminateProcess UnhandledExceptionFilter GetProcessId CheckRemoteDebuggerPresent IsDebuggerPresent FreeEnvironmentStringsW GetCurrentProcess QueryPerformanceCounter QueryPerformanceFrequency FreeLibrary LoadLibraryA GetLocaleInfoA IsDBCSLeadByte OutputDebugStringA GlobalAlloc GlobalUnlock GlobalLock GlobalFree WideCharToMultiByte InitializeCriticalSection EnterCriticalSection LeaveCriticalSection GetSystemInfo VirtualProtect GetSystemTimePreciseAsFileTime ReleaseSRWLockExclusive AcquireSRWLockExclusive LocalFree FormatMessageA GetLocaleInfoEx GetCurrentDirectoryW FindClose FindFirstFileW FindFirstFileExW FindNextFileW GetFileAttributesExW GetFileInformationByHandle SetFileInformationByHandle CreateFile2 AreFileApisANSI GetLastError CopyFile2 GetFileInformationByHandleEx WaitForSingleObjectEx SwitchToThread GetExitCodeThread InitOnceComplete InitOnceBeginInitialize SleepConditionVariableSRW WakeAllConditionVariable InitializeCriticalSectionEx DeleteCriticalSection EncodePointer DecodePointer LCMapStringEx GetStringTypeW GetCPInfo GetStartupInfoW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead IsProcessorFeaturePresent RtlLookupFunctionEntry RtlUnwindEx RtlPcToFileHeader RaiseException SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibraryAndExitThread GetModuleHandleExW RtlCaptureContext RtlVirtualUnwind RtlUnwind

user32

GetCursorPos SetForegroundWindow UpdateWindow PostQuitMessage SetWindowsHookExW EmptyClipboard GetClipboardData SetClipboardData CloseClipboard OpenClipboard LoadCursorA ClientToScreen SetCursor SetCursorPos GetClientRect GetWindowThreadProcessId DefWindowProcW DestroyWindow SetWindowLongPtrW CreateWindowExW ScreenToClient CallNextHookEx GetSystemMetrics UnregisterClassW GetWindowLongPtrW RegisterClassExW ShowWindow GetAsyncKeyState DispatchMessageW PeekMessageW SetWindowDisplayAffinity MessageBoxA GetForegroundWindow UnhookWindowsHookEx SetLayeredWindowAttributes TranslateMessage mouse_event GetKeyboardLayout TrackMouseEvent GetMessageExtraInfo GetKeyState GetCapture SetCapture ReleaseCapture IsWindowUnicode

d3d11

D3D11CreateDeviceAndSwapChain

winhttp

WinHttpReceiveResponse WinHttpOpen WinHttpAddRequestHeaders WinHttpQueryHeaders WinHttpQueryDataAvailable WinHttpConnect WinHttpSetTimeouts WinHttpSendRequest WinHttpCloseHandle WinHttpOpenRequest WinHttpReadData

d3dcompiler_47

D3DCompile

imm32

ImmGetContext ImmSetCompositionWindow ImmReleaseContext ImmSetCandidateWindow

advapi32

SystemFunction036

shell32

ShellExecuteW

Name

.text

Size

1.1MB

Virtual Size

1.1MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

262KB

Virtual Size

261KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8KB

Virtual Size

20KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

45KB

Virtual Size

45KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

1024B

Virtual Size

688B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

3KB

Virtual Size

3KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Roblox-External.exe

kernel32

user32

d3d11

winhttp

d3dcompiler_47

imm32

advapi32

shell32

generic