General

Malware Config

Signatures

Files

• RobloxPlayerInstaller.exe

  .exe windows:6 windows x86 arch:x86

  5295d4393de99b832561ab019b899e1b

  
  

  Code Sign

  0d:af:ec:46:d2:b7:34:a6:7f:4e:ad:75:7c:0b:c9:6b

  Certificate

  Issuer

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Not Before

  13-02-2024 00:00

  Not After

  12-02-2025 23:59

  Subject

  SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  29-04-2021 00:00

  Not After

  28-04-2036 23:59

  Subject

  CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageCodeSigning

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  05:44:af:f3:94:9d:08:39:a6:bf:db:3f:5f:e5:61:16

  Certificate

  Issuer

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Not Before

  14-07-2023 00:00

  Not After

  13-10-2034 23:59

  Subject

  CN=DigiCert Timestamp 2023,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b

  Certificate

  Issuer

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  23-03-2022 00:00

  Not After

  22-03-2037 23:59

  Subject

  CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

  Extended Key Usages

  ExtKeyUsageTimeStamping

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

  Certificate

  Issuer

  CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

  Not Before

  01-08-2022 00:00

  Not After

  09-11-2031 23:59

  Subject

  CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

  Key Usages

  KeyUsageDigitalSignature

  KeyUsageCertSign

  KeyUsageCRLSign

  36:9a:af:6f:14:56:d1:1e:4b:37:9b:da:f4:d2:f3:63:75:e1:8a:f4:07:ea:93:0b:31:dc:15:58:56:27:bc:66

  Signer

  Actual PE Digest

  36:9a:af:6f:14:56:d1:1e:4b:37:9b:da:f4:d2:f3:63:75:e1:8a:f4:07:ea:93:0b:31:dc:15:58:56:27:bc:66

  Digest Algorithm

  sha256

  PE Digest Matches

  true

  Headers

  DLL Characteristics

  IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE

  IMAGE_DLLCHARACTERISTICS_NX_COMPAT

  IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

  File Characteristics

  IMAGE_FILE_EXECUTABLE_IMAGE

  IMAGE_FILE_LARGE_ADDRESS_AWARE

  IMAGE_FILE_32BIT_MACHINE

  PDB Paths

  C:\buildAgent\work\ci_deploy_ninja_boot-x86_git\build.ninja\common\vs2019\x86\release\Installer\Windows\RobloxPlayerInstaller.pdb

  Imports

  comctl32

  _TrackMouseEvent

  InitCommonControlsEx

  gdiplus

  GdiplusShutdown

  GdipCloneImage

  GdiplusStartup

  GdipCreateHBITMAPFromBitmap

  GdipDisposeImage

  GdipCreateBitmapFromStream

  GdipAlloc

  GdipFree

  wininet

  InternetReadFile

  InternetQueryDataAvailable

  InternetQueryOptionW

  HttpOpenRequestW

  HttpAddRequestHeadersW

  HttpSendRequestW

  InternetOpenW

  HttpQueryInfoW

  InternetCloseHandle

  InternetConnectW

  shell32

  SHGetFolderPathAndSubDirW

  ShellExecuteExW

  SHGetKnownFolderPath

  Shell_NotifyIconW

  iphlpapi

  GetAdaptersAddresses

  bcrypt

  BCryptGenRandom

  advapi32

  CopySid

  RegDeleteValueW

  AllocateAndInitializeSid

  OpenProcessToken

  RegCreateKeyExW

  RegDeleteTreeW

  RegQueryValueExW

  RegQueryInfoKeyW

  RegEnumKeyExW

  IsValidSid

  GetTokenInformation

  GetLengthSid

  SystemFunction036

  DeregisterEventSource

  RegisterEventSourceW

  ReportEventW

  CryptSetHashParam

  CryptGetProvParam

  FreeSid

  CryptGetUserKey

  CryptExportKey

  CryptDecrypt

  CryptSignHashW

  CryptEnumProvidersW

  EqualSid

  RegCloseKey

  CryptDestroyKey

  RegQueryValueExA

  RegOpenKeyExA

  RegGetValueW

  RegSetValueExW

  GetUserNameW

  CryptAcquireContextW

  CryptReleaseContext

  CryptGetHashParam

  CryptCreateHash

  CryptHashData

  CryptDestroyHash

  RegOpenKeyExW

  ws2_32

  connect

  __WSAFDIsSet

  WSAIoctl

  inet_pton

  getaddrinfo

  freeaddrinfo

  WSACreateEvent

  WSACloseEvent

  getsockopt

  htonl

  WSASetLastError

  WSACleanup

  WSAStartup

  setsockopt

  send

  select

  recv

  listen

  htons

  getsockname

  closesocket

  bind

  accept

  inet_ntop

  socket

  ntohs

  ntohl

  ioctlsocket

  getnameinfo

  gethostname

  WSAGetLastError

  crypt32

  CertEnumCertificatesInStore

  CertFreeCertificateContext

  CertGetEnhancedKeyUsage

  CertGetIntendedKeyUsage

  CertOpenSystemStoreA

  CertOpenStore

  CertFindCertificateInStore

  CertGetCertificateContextProperty

  CertCloseStore

  CertDuplicateCertificateContext

  kernel32

  GetStringTypeW

  GetLocaleInfoEx

  GetCPInfo

  InitializeSListHead

  LCMapStringEx

  EncodePointer

  InitOnceComplete

  InitOnceBeginInitialize

  SleepConditionVariableSRW

  SleepConditionVariableCS

  WakeAllConditionVariable

  WakeConditionVariable

  InitializeConditionVariable

  GetStartupInfoW

  RtlUnwind

  InterlockedPushEntrySList

  GetCommandLineA

  CreateThread

  ExitThread

  FreeLibraryAndExitThread

  GetConsoleOutputCP

  SetStdHandle

  HeapSize

  IsProcessorFeaturePresent

  TryEnterCriticalSection

  InitializeSRWLock

  GetExitCodeThread

  GetDriveTypeW

  PeekNamedPipe

  SystemTimeToTzSpecificLocalTime

  SetConsoleCtrlHandler

  ExitProcess

  IsDebuggerPresent

  DebugBreak

  OutputDebugStringW

  CloseHandle

  GetLastError

  SetLastError

  HeapAlloc

  HeapFree

  GetProcessHeap

  ReleaseSemaphore

  ReleaseMutex

  WaitForSingleObject

  WaitForSingleObjectEx

  OpenSemaphoreW

  CreateMutexExW

  CreateSemaphoreExW

  GetCurrentProcessId

  GetCurrentThreadId

  GetModuleFileNameA

  GetModuleHandleW

  GetModuleHandleExW

  GetProcAddress

  FormatMessageW

  SetSearchPathMode

  GetCommandLineW

  VerSetConditionMask

  GetDiskFreeSpaceExW

  CreateFileMappingW

  VerifyVersionInfoW

  GetTimeZoneInformation

  LocaleNameToLCID

  GetUserDefaultLocaleName

  Sleep

  FindClose

  FindFirstFileW

  FindNextFileW

  SetUnhandledExceptionFilter

  SetEvent

  CreateEventW

  OpenEventW

  CreateProcessW

  GetSystemTime

  CreateFileW

  GetFileSize

  MapViewOfFile

  UnmapViewOfFile

  DeleteFileW

  TerminateProcess

  InitializeProcThreadAttributeList

  UpdateProcThreadAttribute

  OpenProcess

  GetModuleFileNameW

  SystemTimeToFileTime

  CreateToolhelp32Snapshot

  Process32FirstW

  Process32NextW

  K32GetModuleFileNameExW

  GetCurrentProcess

  GetCurrentProcessorNumber

  GlobalMemoryStatusEx

  GetSystemInfo

  GetSystemTimeAsFileTime

  GetVersionExA

  IsWow64Process

  LoadLibraryA

  K32GetProcessMemoryInfo

  GetModuleHandleA

  OutputDebugStringA

  QueryPerformanceCounter

  QueryPerformanceFrequency

  CreateEventA

  SwitchToThread

  MultiByteToWideChar

  WideCharToMultiByte

  GetNativeSystemInfo

  LoadLibraryExW

  FileTimeToSystemTime

  VirtualQuery

  RaiseException

  GetCurrentThread

  LoadLibraryW

  DecodePointer

  InitializeCriticalSectionEx

  DeleteCriticalSection

  CreateSemaphoreA

  DuplicateHandle

  GetTickCount

  WaitForMultipleObjectsEx

  GetExitCodeProcess

  LocalAlloc

  LocalFree

  FindResourceExW

  LoadResource

  LockResource

  SizeofResource

  FindResourceW

  GlobalAlloc

  GlobalFree

  GlobalUnlock

  GlobalLock

  CreateDirectoryW

  GetFileAttributesW

  GetFileSizeEx

  ReadFile

  RemoveDirectoryW

  SetFileAttributesW

  WriteFile

  CopyFileW

  CompareStringEx

  FreeLibrary

  GetEnvironmentVariableW

  VirtualAlloc

  ReleaseSRWLockExclusive

  ReleaseSRWLockShared

  AcquireSRWLockExclusive

  AcquireSRWLockShared

  EnterCriticalSection

  LeaveCriticalSection

  GetSystemDirectoryA

  MoveFileExA

  CompareFileTime

  GetEnvironmentVariableA

  SleepEx

  FormatMessageA

  GetCurrentDirectoryW

  GetFileAttributesExW

  GetFileInformationByHandle

  GetFileTime

  GetFullPathNameW

  SetEndOfFile

  SetFilePointerEx

  SetFileTime

  GetTempPathW

  DeviceIoControl

  MoveFileExW

  ResetEvent

  SetWaitableTimer

  ResumeThread

  TlsAlloc

  TlsGetValue

  TlsSetValue

  TlsFree

  CreateWaitableTimerA

  AreFileApisANSI

  InitializeCriticalSection

  GetStdHandle

  GetConsoleMode

  SetConsoleMode

  ReadConsoleA

  ReadConsoleW

  InitializeCriticalSectionAndSpinCount

  SwitchToFiber

  DeleteFiber

  CreateFiber

  GetFileType

  ConvertFiberToThread

  ConvertThreadToFiber

  GetDateFormatW

  GetTimeFormatW

  CompareStringW

  LCMapStringW

  GetLocaleInfoW

  IsValidLocale

  GetUserDefaultLCID

  UnhandledExceptionFilter

  EnumSystemLocalesW

  FlushFileBuffers

  HeapReAlloc

  FindFirstFileExW

  IsValidCodePage

  GetACP

  GetOEMCP

  GetEnvironmentStringsW

  FreeEnvironmentStringsW

  SetEnvironmentVariableW

  WriteConsoleW

  GetFinalPathNameByHandleW

  MulDiv

  user32

  GetWindowRect

  InvalidateRect

  EndPaint

  BeginPaint

  GetDC

  DrawTextW

  GetSystemMetrics

  EnableWindow

  KillTimer

  SetTimer

  DispatchMessageW

  GetUserObjectInformationW

  ShowWindow

  DestroyWindow

  CreateWindowExW

  GetProcessWindowStation

  LoadBitmapW

  EnumDisplayDevicesA

  FillRect

  TranslateMessage

  MessageBoxW

  SendMessageW

  DefWindowProcW

  GetMessageW

  DestroyIcon

  LoadIconW

  SetWindowLongW

  GetWindowLongW

  GetWindowThreadProcessId

  GetShellWindow

  TranslateAcceleratorW

  GetDlgItem

  PostQuitMessage

  CallWindowProcW

  RegisterClassW

  LoadAcceleratorsW

  GetDlgCtrlID

  gdi32

  SetTextColor

  SetBkMode

  SetDCPenColor

  SetDCBrushColor

  SelectObject

  RoundRect

  CreateFontW

  GetStockObject

  GetDeviceCaps

  DeleteObject

  DeleteDC

  CreateSolidBrush

  CreatePen

  Rectangle

  ole32

  CoInitializeEx

  CoTaskMemAlloc

  CoCreateInstance

  CoUninitialize

  CoInitialize

  CoCreateGuid

  CoTaskMemFree

  StringFromGUID2

  shlwapi

  ord12

  PathFindFileNameW

  PathFindExtensionW

  powrprof

  CallNtPowerInformation

  winmm

  timeGetTime

  timeGetDevCaps

  timeBeginPeriod

  timeSetEvent

  Sections

  .text

  Size: 3.3MB - Virtual size: 3.3MB

  IMAGE_SCN_CNT_CODE

  IMAGE_SCN_MEM_EXECUTE

  IMAGE_SCN_MEM_READ

  .rdata

  Size: 925KB - Virtual size: 925KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .data

  Size: 778KB - Virtual size: 13.1MB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  IMAGE_SCN_MEM_WRITE

  .rsrc

  Size: 368KB - Virtual size: 368KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_READ

  .reloc

  Size: 151KB - Virtual size: 150KB

  IMAGE_SCN_CNT_INITIALIZED_DATA

  IMAGE_SCN_MEM_DISCARDABLE

  IMAGE_SCN_MEM_READ