Roblox_External[.]exe

Resubmissions

04/06/2026, 19:52

260604-ylm8aadv3w8

04/06/2026, 19:46

260604-yhcmdadt3t7

Sharing

Copy URL Twitter E-mail

General

Target
Roblox_External.exe
Size 14.6MB
Sample260604-ylm8aadv3w
SHA256 f926fa387dfbe2cf3e9d08f50c034aa3d6a010d5f300e5aa627ac8b12ad6ac39
MD5 d9267619a0cc142702ee05a40f102f66
SHA1 2caa3b78844fb169c34fdeedd4941d828edc8be4
SHA512 9cb32dbafe54646531a1262943be55328a60b67366967319b166b747d4c042edcbf4686b4a6e5752eab2f89125c0b47431e100d3581624e88302a67b96519d37
SSDEEP 393216:J0u/flmNP6ly03E16+PQsMQMX8kT+olIDmonw6KySJHGBoXYobEkovI:JZqPQ68xIDf3SJHD+lI
TLSH
T197F6E10CA5B719ACDFB1D5F8592A2217F21678CC0BB45AE357C809E11E527EC1ABDF02
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Roblox_External.exe

File Explorer

Roblox_External.exe

.exe 14.6MB

Roblox_External.exe

IMPHASH 66ef9a05774115f216685b6dac1a42c3
SHA256 f926fa387dfbe2cf3e9d08f50c034aa3d6a010d5f300e5aa627ac8b12ad6ac39
MD5 d9267619a0cc142702ee05a40f102f66
SHA1 2caa3b78844fb169c34fdeedd4941d828edc8be4
SHA512 9cb32dbafe54646531a1262943be55328a60b67366967319b166b747d4c042edcbf4686b4a6e5752eab2f89125c0b47431e100d3581624e88302a67b96519d37
SSDEEP 393216:J0u/flmNP6ly03E16+PQsMQMX8kT+olIDmonw6KySJHGBoXYobEkovI:JZqPQ68xIDf3SJHD+lI
TLSH
T197F6E10CA5B719ACDFB1D5F8592A2217F21678CC0BB45AE357C809E11E527EC1ABDF02
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

4679936

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\User\Downloads\bladeball\bin\Roblox_External.pdb

d3d11

D3D11CreateDeviceAndSwapChain

d3dcompiler_43

D3DCompile

kernel32

CreateFileW QueryDosDeviceW SetThreadExecutionState TerminateProcess GetModuleFileNameW K32GetModuleFileNameExW LocalFree GetVolumeInformationA Sleep QueryFullProcessImageNameW CreateThread SetConsoleTitleA FreeConsole ReadProcessMemory WriteProcessMemory VirtualQueryEx CreateFileA GetFileSizeEx ReadFile HeapAlloc HeapFree MapViewOfFile UnmapViewOfFile CreateFileMappingA ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection CreateDirectoryA LoadLibraryW SleepEx FormatMessageW MoveFileExW WaitForSingleObjectEx GetEnvironmentVariableA GetFileType PeekNamedPipe WaitForMultipleObjects GetCurrentProcessId AreFileApisANSI CreateFile2 SetFileInformationByHandle GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose CreateDirectoryW GetFileInformationByHandleEx FormatMessageA GetLocaleInfoEx SleepConditionVariableSRW GetCurrentThreadId GetModuleHandleW K32GetModuleBaseNameW K32EnumProcessModules K32GetDeviceDriverBaseNameW K32EnumDeviceDrivers GetLastError OutputDebugStringA SetLastError GetCurrentProcess ExitProcess CreateProcessW VirtualProtect OpenProcess Module32NextW Module32FirstW WakeAllConditionVariable SetUnhandledExceptionFilter GetStartupInfoW GetSystemTimeAsFileTime InitializeSListHead VerifyVersionInfoW SetFileAttributesA GetProcessId CloseHandle Process32NextW Process32FirstW CreateToolhelp32Snapshot GlobalUnlock WideCharToMultiByte GlobalLock GlobalFree GlobalAlloc QueryPerformanceCounter FreeLibrary VerSetConditionMask GetProcAddress QueryPerformanceFrequency LoadLibraryA MultiByteToWideChar GetLocaleInfoA GetModuleHandleA GetConsoleWindow GetTickCount GetModuleFileNameA GetCurrentThread SetThreadPriority GetStdHandle SetConsoleTextAttribute GetSystemDirectoryW

user32

GetKeyboardLayout TrackMouseEvent GetCapture SetCursor GetClientRect SetProcessDPIAware LoadCursorW ReleaseCapture SetCursorPos SetWindowDisplayAffinity ShowWindow SendMessageW GetForegroundWindow IsWindowUnicode ScreenToClient DefWindowProcW PostQuitMessage SendInput GetCursorPos DestroyWindow DispatchMessageW ClientToScreen GetMessageExtraInfo FindWindowA mouse_event GetKeyState keybd_event SetClipboardData TranslateMessage PeekMessageW UpdateWindow UnregisterClassW SetLayeredWindowAttributes CreateWindowExW GetAsyncKeyState GetClipboardData EmptyClipboard SetCapture CloseClipboard OpenClipboard FindWindowW IsWindowVisible GetWindowLongW GetParent GetWindowThreadProcessId GetWindowTextW PostMessageW EnumWindows SetWindowLongW RegisterClassExW GetSystemMetrics

advapi32

RegCreateKeyExA CryptEncrypt RegOpenKeyExA RegSetValueExA CryptImportKey CryptDestroyKey CryptDestroyHash CryptHashData CryptCreateHash CryptGetHashParam CryptReleaseContext CryptAcquireContextW FreeSid CheckTokenMembership AllocateAndInitializeSid GetCurrentHwProfileA ConvertSidToStringSidA GetTokenInformation OpenProcessToken RegQueryValueExA RegCloseKey

shell32

ShellExecuteExW ShellExecuteA

msvcp140

_Query_perf_frequency ?_Xbad_alloc@std@@YAXXZ ?_Xlength_error@std@@YAXPEBD@Z _Query_perf_counter ?_Syserror_map@std@@YAPEBDH@Z ?_Winerror_map@std@@YAHH@Z ??Bios_base@std@@QEBA_NXZ ?_Xout_of_range@std@@YAXPEBD@Z ?_Xinvalid_argument@std@@YAXPEBD@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z ?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ ?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ ?sgetc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ??0_Lockit@std@@QEAA@H@Z ??1_Lockit@std@@QEAA@XZ ?_Id_cnt@id@locale@std@@0HA ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?uncaught_exceptions@std@@YAHXZ ?good@ios_base@std@@QEBA_NXZ ?always_noconv@codecvt_base@std@@QEBA_NXZ ?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?snextc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ?_Xbad_function_call@std@@YAXXZ _Xtime_get_ticks ?_Throw_Cpp_error@std@@YAXH@Z _Mtx_lock _Mtx_unlock _Thrd_detach _Cnd_do_broadcast_at_thread_exit ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ?getloc@ios_base@std@@QEBA?AVlocale@2@XZ ?id@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@2V0locale@2@A ?_Getcat@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?get@?$time_get@DV?$istreambuf_iterator@DU?$char_traits@D@std@@@std@@@std@@QEBA?AV?$istreambuf_iterator@DU?$char_traits@D@std@@@2@V32@0AEAVios_base@2@AEAHPEAUtm@@PEBD4@Z ?_Random_device@std@@YAIXZ ?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z ?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ ?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z ?_Incref@facet@locale@std@@UEAAXXZ ?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ??1_Locinfo@std@@QEAA@XZ ??0_Locinfo@std@@QEAA@PEBD@Z ??1facet@locale@std@@MEAA@XZ ??0facet@locale@std@@IEAA@_K@Z ?id@?$ctype@D@std@@2V0locale@2@A ?id@?$collate@D@std@@2V0locale@2@A ?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z ?tolower@?$ctype@D@std@@QEBADD@Z _Strxfrm _Strcoll ?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ ??7ios_base@std@@QEBA_NXZ _Thrd_yield ?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z __crtLCMapStringA ?cin@std@@3V?$basic_istream@DU?$char_traits@D@std@@@1@A ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?get@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAHXZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@K@Z ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

winhttp

WinHttpReceiveResponse WinHttpSendRequest WinHttpQueryDataAvailable WinHttpConnect WinHttpCloseHandle WinHttpOpenRequest WinHttpSetTimeouts WinHttpReadData WinHttpOpen

dwmapi

DwmExtendFrameIntoClientArea

imm32

ImmReleaseContext ImmGetContext ImmSetCompositionWindow ImmSetCandidateWindow

bcrypt

BCryptOpenAlgorithmProvider BCryptGenRandom BCryptDestroyKey BCryptDecrypt BCryptGenerateSymmetricKey BCryptDestroyHash BCryptFinishHash BCryptHashData BCryptCreateHash BCryptGetProperty BCryptCloseAlgorithmProvider BCryptSetProperty

ws2_32

WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError inet_pton ntohs WSASetLastError inet_ntop WSAStartup WSACleanup bind connect getpeername getsockname WSAEnumNetworkEvents gethostname ioctlsocket sendto recvfrom freeaddrinfo getaddrinfo listen htonl accept select __WSAFDIsSet WSACreateEvent getsockopt send WSAIoctl socket WSACloseEvent setsockopt recv htons

crypt32

CertFreeCertificateContext CertFreeCertificateChain CertGetCertificateChain CertFreeCertificateChainEngine CertCreateCertificateChainEngine CryptQueryObject CertGetNameStringW CertFindExtension CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFindCertificateInStore CryptDecodeObjectEx CryptStringToBinaryW PFXImportCertStore CertAddCertificateContextToStore

vcruntime140_1

__CxxFrameHandler4

vcruntime140

__std_exception_copy strstr strchr __RTtypeid __std_type_info_compare __C_specific_handler wcsstr __std_terminate strrchr longjmp _CxxThrowException __intrinsic_setjmp __current_exception_context __current_exception wcschr memcmp memchr memset memmove memcpy __std_exception_destroy

api-ms-win-crt-heap-l1-1-0

free _set_new_mode _callnewh calloc malloc realloc

api-ms-win-crt-math-l1-1-0

ceilf roundf ceil asinf _fdopen cos sinf sqrtf cosf fmodf _dsign logf pow acosf powf sin __setusermatherr

api-ms-win-crt-convert-l1-1-0

strtol atoi strtof wcstombs atof strtoul strtod strtoll strtoull

api-ms-win-crt-runtime-l1-1-0

_initialize_wide_environment _wassert _register_thread_local_exe_atexit_callback exit __sys_errlist __sys_nerr _c_exit _exit _initterm_e system _initterm _get_wide_winmain_command_line _configure_wide_argv terminate abort _set_app_type _seh_filter_exe _beginthreadex _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _errno

api-ms-win-crt-stdio-l1-1-0

ftell fseek feof _lseeki64 _wfopen _popen fgets _set_fmode _pclose _wopen __stdio_common_vfprintf __stdio_common_vsprintf_s __p__commode freopen_s fclose _read _write _get_stream_buffer_pointers _fileno _close fputc fputs ungetc __acrt_iob_func fgetc fread fwrite fgetpos _fseeki64 fsetpos setvbuf fflush __stdio_common_vsprintf __stdio_common_vsscanf

api-ms-win-crt-filesystem-l1-1-0

remove _unlock_file _fstat64 _unlink _wstat64 _lock_file

api-ms-win-crt-time-l1-1-0

strftime _mktime64 _gmtime64 _time64 _localtime64_s

api-ms-win-crt-locale-l1-1-0

_configthreadlocale ___lc_codepage_func ___lc_locale_name_func localeconv ___lc_collate_cp_func

api-ms-win-crt-string-l1-1-0

_strdup wcsncpy strpbrk wcsncmp strspn wcspbrk strcspn _wcsdup strncmp strcmp strncpy isspace isalnum _wcsicmp _stricmp isdigit tolower strlen wcslen

api-ms-win-crt-utility-l1-1-0

rand qsort

api-ms-win-crt-environment-l1-1-0

_dupenv_s getenv