RobloxPlayerInstaller-BCWCVHT6D8[.]exe

Resubmissions

09/07/2026, 00:32

260709-av58fsbz8v

09/07/2026, 00:32

260709-avvfysbz8s3

Sharing

Copy URL Twitter E-mail

General

Target
RobloxPlayerInstaller-BCWCVHT6D8.exe
Size 9.5MB
Sample260709-av58fsbz8v
SHA256 450a0072c30912ea9f042ac3fc902bae63c31c64ee85aeb3fb9a8631d4ebc6ff
MD5 ddf3156f088625225c90dd9df4c309bb
SHA1 5f56eaa6364f68a5634cabd147a67ffc0ee65a54
SHA512 992909df1cd0c4edaa824869f8160ca2e7aea7c84935b9210a1246214897fa25a134235a3a41f93ec61af226941515b41601f85042d2d73971f7177150b8d0d5
SSDEEP 196608:uyhKjYMqt/Lpu5t6No7VkiliDmu5B4FP0qF:u3qgoo7miliDm5F8y
TLSH
T184A6BE22B941C021E5D201B2A6BE6FB55E7C9D341B3848C7A7C45DBC49715E33B3AB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
RobloxPlayerInstaller-BCWCVHT6D8.exe

File Explorer

RobloxPlayerInstaller-BCWCVHT6D8.exe

.exe 9.5MB

RobloxPlayerInstaller-BCWCVHT6D8.exe

IMPHASH 42a9bc961d3932e52d832c492eebe214
SHA256 450a0072c30912ea9f042ac3fc902bae63c31c64ee85aeb3fb9a8631d4ebc6ff
MD5 ddf3156f088625225c90dd9df4c309bb
SHA1 5f56eaa6364f68a5634cabd147a67ffc0ee65a54
SHA512 992909df1cd0c4edaa824869f8160ca2e7aea7c84935b9210a1246214897fa25a134235a3a41f93ec61af226941515b41601f85042d2d73971f7177150b8d0d5
SSDEEP 196608:uyhKjYMqt/Lpu5t6No7VkiliDmu5B4FP0qF:u3qgoo7miliDm5F8y
TLSH
T184A6BE22B941C021E5D201B2A6BE6FB55E7C9D341B3848C7A7C45DBC49715E33B3AB2B
MD5 SHA1 SHA512 SSDEEP TLSH

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

93:90:2b:9e:f5:21:bc:77:9a:31:e0:24:c0:22:0b:cb:a4:f5:e7:57:6b:3e:29:c2:8e:44:51:df:7b:14:10:08

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jan 1, 0001

Subject

Serial Number

01:97:20:58:e4:2c:9c:ca:bd:73:0a:b1:26:7f:15:ed

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 19, 2025 - Dec 18, 2026

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2025 1,O=DigiCert\, Inc.,C=US

Serial Number

0a:80:ef:18:4b:8d:f1:05:82:d1:c4:76:a7:95:74:68

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Jun 4, 2025 - Sep 3, 2036

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

6956334

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_32BIT_MACHINE

PDB paths

C:\buildAgent\work\ci_deploy_ninja_boot-x86_git\build.ninja\common\vs2019\x86\release\Installer\Windows\RobloxPlayerInstaller.pdb

comctl32

InitCommonControlsEx _TrackMouseEvent ord345

gdiplus

GdiplusStartup GdiplusShutdown GdipCloneImage GdipDisposeImage GdipCreateBitmapFromStream GdipFree GdipCreateHBITMAPFromBitmap GdipAlloc

wininet

HttpQueryInfoW HttpSendRequestW HttpAddRequestHeadersW InternetOpenW InternetCloseHandle InternetConnectW HttpOpenRequestW InternetSetStatusCallbackW InternetQueryOptionW InternetQueryDataAvailable InternetReadFile

uxtheme

SetWindowTheme

advapi32

EqualSid RegCreateKeyExW RegCloseKey CryptDestroyHash IsValidSid GetTokenInformation GetLengthSid FreeSid CryptHashData CopySid AllocateAndInitializeSid OpenProcessToken RegDeleteTreeW RegQueryValueExW RegQueryInfoKeyW RegEnumKeyExW CryptDestroyKey CryptAcquireContextA RegQueryValueExA RegOpenKeyExA RegGetValueW RegSetValueExW RegOpenKeyExW GetUserNameW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash RegDeleteValueW

iphlpapi

GetAdaptersAddresses

ws2_32

getsockopt htons htonl WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSASetEvent WSAWaitForMultipleEvents ntohs ioctlsocket freeaddrinfo send getaddrinfo listen select WSACloseEvent __WSAFDIsSet WSAIoctl recv getsockname getpeername setsockopt connect bind accept WSACleanup WSAStartup WSASetLastError closesocket ntohl getnameinfo gethostname recvfrom WSACreateEvent socket WSAGetLastError inet_ntop getservbyname WSASocketA sendto inet_addr inet_ntoa gethostbyaddr gethostbyname getservbyport shutdown

crypt32

CertOpenSystemStoreA CertGetIntendedKeyUsage CertGetEnhancedKeyUsage CertFreeCertificateContext CertEnumCertificatesInStore CertCloseStore CertOpenSystemStoreW CertGetCertificateContextProperty CertDuplicateCertificateContext CertFindCertificateInStore CertOpenStore

dbghelp

SymFromAddr

shell32

Shell_NotifyIconW SHGetFolderPathAndSubDirW ShellExecuteExW SHGetKnownFolderPath ShellExecuteW

kernel32

GetEnvironmentStringsW InterlockedPushEntrySList RtlUnwind GetOEMCP IsValidCodePage FindFirstFileExW EnumSystemLocalesW FreeEnvironmentStringsW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW GetTimeZoneInformation SetConsoleCtrlHandler SetEnvironmentVariableW ConvertThreadToFiberEx ConvertFiberToThread GetFileType GetACP GetExitCodeThread CreateFiberEx DeleteFiber SwitchToFiber AcquireSRWLockShared ReleaseSRWLockShared ReadConsoleW ReadConsoleA SetConsoleMode GetConsoleMode GetStdHandle WriteConsoleW GetConsoleOutputCP SystemTimeToTzSpecificLocalTime PeekNamedPipe ExitProcess SetStdHandle FreeLibraryAndExitThread ExitThread GetCommandLineA CreateWaitableTimerA TlsFree TlsSetValue TlsGetValue TlsAlloc ResumeThread MoveFileExW DeviceIoControl SetFileTime SetFilePointerEx GetFileTime GetFileInformationByHandle GetLogicalProcessorInformation IsDebuggerPresent DebugBreak OutputDebugStringW CloseHandle GetLastError SetLastError HeapAlloc HeapFree GetProcessHeap ReleaseSemaphore ReleaseMutex WaitForSingleObject WaitForSingleObjectEx OpenSemaphoreW CreateMutexExW CreateSemaphoreExW GetCurrentProcessId GetCurrentThreadId GetModuleFileNameA GetModuleHandleW GetModuleHandleExW GetProcAddress FormatMessageW SetSearchPathMode GetCommandLineW VerSetConditionMask GetDiskFreeSpaceExW CreateMutexW TerminateProcess OpenProcess CreateFileMappingW MapViewOfFile UnmapViewOfFile VerifyVersionInfoW LocaleNameToLCID GetUserDefaultLocaleName SetWaitableTimer CancelWaitableTimer CreateWaitableTimerW Sleep CreateEventA SetEvent FindClose FindFirstFileW FindNextFileW SetUnhandledExceptionFilter CreateEventW OpenEventW GetExitCodeProcess CreateProcessW GetSystemTime CreateFileW GetDriveTypeW GetVolumePathNameW GetFileInformationByHandleEx GetFileSize ReadFile DeleteFileW GetFileAttributesW SetFileAttributesW InitializeProcThreadAttributeList UpdateProcThreadAttribute GetModuleFileNameW SystemTimeToFileTime CreateToolhelp32Snapshot Process32FirstW Process32NextW K32GetModuleFileNameExW GetCurrentProcessorNumber QueryPerformanceCounter QueryPerformanceFrequency VirtualFree GetSystemInfo CreateThread GetCurrentProcess GlobalMemoryStatusEx K32GetProcessMemoryInfo GetProcessTimes GetProcessHandleCount GetSystemTimeAsFileTime GetVersionExA IsWow64Process LoadLibraryA ResetEvent OutputDebugStringA GetModuleHandleA CreateSemaphoreA DuplicateHandle MultiByteToWideChar K32GetProcessImageFileNameA Process32First Process32Next WideCharToMultiByte FileTimeToSystemTime DecodePointer RaiseException InitializeCriticalSectionEx DeleteCriticalSection GetNativeSystemInfo LoadLibraryExW WaitForMultipleObjectsEx GetTickCount GetCurrentThread LoadLibraryW VirtualQuery LocalAlloc LocalFree FindResourceExW LoadResource LockResource SizeofResource FindResourceW CreateDirectoryW GetFileSizeEx RemoveDirectoryW WriteFile CopyFileW GlobalAlloc GlobalFree GlobalUnlock GlobalLock CompareStringEx GetSystemFirmwareTable FreeLibrary GetEnvironmentVariableW ReleaseSRWLockExclusive AcquireSRWLockExclusive EnterCriticalSection LeaveCriticalSection GetSystemDirectoryA SleepEx GetFullPathNameW MoveFileExA GetEnvironmentVariableA CompareFileTime FlushFileBuffers FormatMessageA LockFileEx UnlockFile HeapDestroy HeapCompact HeapReAlloc DeleteFileA CreateFileA FlushViewOfFile GetFileAttributesExW GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate GetTempPathW UnlockFileEx SetEndOfFile GetFullPathNameA SetFilePointer LockFile GetDiskFreeSpaceW HeapCreate AreFileApisANSI InitializeCriticalSection TryEnterCriticalSection GetCurrentDirectoryW InitializeSRWLock InitializeConditionVariable WakeConditionVariable SleepConditionVariableSRW VirtualAlloc

user32

GetProcessWindowStation GetUserObjectInformationW EnumDisplayDevicesA GetWindowThreadProcessId GetShellWindow TranslateAcceleratorW LoadAcceleratorsW DispatchMessageW TranslateMessage GetMessageW DestroyIcon LoadIconW SetWindowLongW GetWindowLongW FillRect GetWindowRect GetClientRect LoadBitmapW SendMessageW MessageBoxW DefWindowProcW PostQuitMessage CallWindowProcW RegisterClassW CreateWindowExW DestroyWindow ShowWindow GetDlgItem SetTimer EnableWindow GetSystemMetrics DrawTextW BeginPaint EndPaint InvalidateRect

gdi32

SetDCBrushColor SetDCPenColor SetBkMode SetTextColor SelectObject Rectangle DeleteObject CreateSolidBrush CreateFontW GetStockObject

ole32

StringFromGUID2 CoTaskMemFree CoInitialize CoUninitialize CoTaskMemAlloc CoCreateInstance CoCreateGuid CoInitializeEx

shlwapi

PathFindExtensionW ord12 PathFindFileNameW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WakeByAddressAll InitOnceBeginInitialize InitOnceComplete SleepConditionVariableCS WakeAllConditionVariable WaitOnAddress

api-ms-win-core-memory-l1-1-3

VirtualProtectFromApp VirtualAllocFromApp

api-ms-win-power-base-l1-1-0

CallNtPowerInformation

api-ms-win-mm-time-l1-1-0

timeBeginPeriod timeGetDevCaps timeGetTime

api-ms-win-security-cryptoapi-l1-1-0

CryptEnumProvidersW CryptGenRandom CryptSetHashParam CryptSignHashW CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt

api-ms-win-security-systemfunctions-l1-1-0

SystemFunction036

api-ms-win-eventlog-legacy-l1-1-0

RegisterEventSourceW ReportEventW DeregisterEventSource

api-ms-win-core-string-l1-1-0

GetStringTypeW

api-ms-win-core-processthreads-l1-1-0

SwitchToThread GetStartupInfoW

api-ms-win-core-synch-l1-1-0

InitializeCriticalSectionAndSpinCount

api-ms-win-core-localization-l1-2-0

GetLocaleInfoEx GetCPInfo LCMapStringEx

api-ms-win-core-util-l1-1-0

EncodePointer

api-ms-win-core-file-l1-1-0

GetFinalPathNameByHandleW

api-ms-win-core-processthreads-l1-1-1

IsProcessorFeaturePresent

api-ms-win-core-interlocked-l1-1-0

InitializeSListHead

api-ms-win-core-errorhandling-l1-1-0

UnhandledExceptionFilter

winmm

timeSetEvent

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

RobloxPlayerInstaller-BCWCVHT6D8.exe

PE Signature issue

comctl32

gdiplus

wininet

uxtheme

advapi32

iphlpapi

ws2_32

crypt32

dbghelp

shell32

kernel32

user32

gdi32

ole32

shlwapi

api-ms-win-core-synch-l1-2-0

api-ms-win-core-memory-l1-1-3

api-ms-win-power-base-l1-1-0

api-ms-win-mm-time-l1-1-0

api-ms-win-security-cryptoapi-l1-1-0

api-ms-win-security-systemfunctions-l1-1-0

api-ms-win-eventlog-legacy-l1-1-0

api-ms-win-core-string-l1-1-0

api-ms-win-core-processthreads-l1-1-0

api-ms-win-core-synch-l1-1-0

api-ms-win-core-localization-l1-2-0

api-ms-win-core-util-l1-1-0

api-ms-win-core-file-l1-1-0

api-ms-win-core-processthreads-l1-1-1

api-ms-win-core-interlocked-l1-1-0

api-ms-win-core-errorhandling-l1-1-0

winmm

generic