RobloxPlayerInstaller-4R3CXWJ92R[.]exe

Resubmissions

24/10/2026, 17:41

261024-v9sk5ac13l7

24/10/2026, 17:35

261024-v6ceqsbt3v7

Sharing

Copy URL Twitter E-mail

General

Target
RobloxPlayerInstaller-4R3CXWJ92R.exe
Size 13.2MB
Sample261024-v6ceqsbt3v
SHA256 e514d4d57cc79a2a4f8fb21ec3bcdd956d05611ea86caeac17f19558ac806688
MD5 f33251e4d51275b841bd94db4455bbb8
SHA1 2ff097c002c518eaeaa273060c3619c3f97d39e8
SHA512 f144c0a30f0760006779886cda103d436892f6a59bb302f638b00a7900f2aa098f0d03595fc2b33b0eeb96c076065c93976de33732a512b1a26a39241d05b823
SSDEEP 196608:xRrD9AeeBFMAzvtRrWvtRrDqtGsCCk075LAVTwMen+6wNA:xR1A5BFDRrW1RrDqEdCHAZwh+lNA
TLSH
T184D69D6AA2B800E8D4BBD17CC6465613EBB1B41503709BDF1AA046FA1F63BE45F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Untrusted Codesign Signers 1 IoCs

Codesigned file was signed by an untrusted entity.

resource
RobloxPlayerInstaller-4R3CXWJ92R.exe

File Explorer

RobloxPlayerInstaller-4R3CXWJ92R.exe

.exe 13.2MB

RobloxPlayerInstaller-4R3CXWJ92R.exe

IMPHASH 61cc7898b8c189399bf2be9414f8d76f
SHA256 e514d4d57cc79a2a4f8fb21ec3bcdd956d05611ea86caeac17f19558ac806688
MD5 f33251e4d51275b841bd94db4455bbb8
SHA1 2ff097c002c518eaeaa273060c3619c3f97d39e8
SHA512 f144c0a30f0760006779886cda103d436892f6a59bb302f638b00a7900f2aa098f0d03595fc2b33b0eeb96c076065c93976de33732a512b1a26a39241d05b823
SSDEEP 196608:xRrD9AeeBFMAzvtRrWvtRrDqtGsCCk075LAVTwMen+6wNA:xR1A5BFDRrW1RrDqEdCHAZwh+lNA
TLSH
T184D69D6AA2B800E8D4BBD17CC6465613EBB1B41503709BDF1AA046FA1F63BE45F7E350
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Untrusted Codesign Signers

Codesigned file was signed by an untrusted entity.

PE Signature issue

Digest

48:b6:7c:2a:2a:51:00:e7:07:cf:30:77:c5:4a:02:c1:a9:53:71:3f:8d:fe:fa:7a:6a:58:a9:47:de:1f:b9:1d

Digest Algorithm

sha256

PE Digests Matches

Trusted

Not trusted

Signing Certificate

SERIALNUMBER=3780902,CN=Roblox Corporation,O=Roblox Corporation,L=San Mateo,ST=California,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Chains

Jan 1, 0001

Subject

Serial Number

01:97:20:58:e4:2c:9c:ca:bd:73:0a:b1:26:7f:15:ed

Issuer

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 19, 2025 - Dec 18, 2026

Subject

CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1,O=DigiCert\, Inc.,C=US

Serial Number

08:ad:40:b2:60:d2:9c:4c:9f:5e:cd:a9:bd:93:ae:d9

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Apr 29, 2021 - Apr 28, 2036

Subject

CN=DigiCert SHA256 RSA4096 Timestamp Responder 2026 1,O=DigiCert\, Inc.,C=US

Serial Number

08:4f:dc:33:4f:7e:45:4e:db:c3:0f:8f:f9:92:18:35

Issuer

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Aug 5, 2026 - Nov 4, 2037

Subject

CN=DigiCert Trusted G4 TimeStamping RSA4096 SHA256 2025 CA1,O=DigiCert\, Inc.,C=US

Serial Number

0d:c7:ac:57:05:ff:21:99:2e:40:43:22:0c:3a:49:86

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

May 7, 2025 - Jan 14, 2038

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Serial Number

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Aug 1, 2022 - Nov 9, 2031

Minor OS version

Major OS version

Entry point

6344384

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\buildAgent\work\gameenginebuck2------43\buck-out\v2\art\root\eccc66bb11a3e259\Client\Installer\Windows\___RobloxPlayerInstaller.exe__\RobloxPlayerInstaller.pdb

kernel32

OutputDebugStringA LoadLibraryA GetSystemTimeAsFileTime GetVersionExA GetExitCodeProcess MultiByteToWideChar K32GetProcessImageFileNameA Process32First Process32Next GetModuleHandleA SetEndOfFile SetFilePointer FlushViewOfFile WriteConsoleW LocalFree FormatMessageA GetCurrentDirectoryW CreateDirectoryW GetFileAttributesExW GetFileInformationByHandle GetFileTime GetFullPathNameW RemoveDirectoryW SetFilePointerEx SetFileTime GetTempPathW DeviceIoControl CopyFileW MoveFileExW AreFileApisANSI WideCharToMultiByte FileTimeToSystemTime DecodePointer RaiseException InitializeCriticalSectionEx DeleteCriticalSection GetNativeSystemInfo LoadLibraryExW LoadLibraryW VirtualQuery FlushFileBuffers GetTickCount LockFileEx UnlockFile HeapDestroy HeapCompact HeapReAlloc DeleteFileA CreateFileA GetFileAttributesA GetDiskFreeSpaceA GetTempPathA HeapSize HeapValidate CreateMutexW UnlockFileEx GetFullPathNameA LockFile GetDiskFreeSpaceW WriteFile HeapCreate InitializeCriticalSection EnterCriticalSection LeaveCriticalSection TryEnterCriticalSection ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepEx MoveFileExA CompareFileTime GetEnvironmentVariableA GetTickCount64 InitializeSRWLock InitializeConditionVariable WakeConditionVariable SleepConditionVariableSRW FreeLibrary FindResourceExW LoadResource LockResource SizeofResource FindResourceW GlobalAlloc GlobalFree LocalAlloc GlobalUnlock K32GetProcessMemoryInfo GetFileSizeEx CompareStringEx GetSystemFirmwareTable GetDriveTypeW CreateFile2 InitializeSListHead RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind ReadFile GetStartupInfoW GetStringTypeW SwitchToThread GetExitCodeThread WakeAllConditionVariable SleepConditionVariableCS RtlPcToFileHeader GetLocaleInfoEx EncodePointer LCMapStringEx FlsAlloc FlsGetValue FlsSetValue FlsFree GetCPInfo RtlUnwindEx InterlockedPushEntrySList InitializeCriticalSectionAndSpinCount TlsAlloc TlsGetValue TlsSetValue TlsFree GetCommandLineA ExitThread FreeLibraryAndExitThread SetStdHandle GetFileType ExitProcess PeekNamedPipe SystemTimeToTzSpecificLocalTime GetConsoleOutputCP GetConsoleMode SetEnvironmentVariableW ReadConsoleW GetStdHandle GetTimeZoneInformation GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW HeapQueryInformation SetConsoleCtrlHandler FindFirstFileExW IsValidCodePage GetACP GetOEMCP GetEnvironmentStringsW FreeEnvironmentStringsW CreateFileW GetSystemTime SetThreadDescription CreateThread VirtualFree VirtualProtect VirtualAlloc GetSystemInfo GetCurrentProcessorNumber QueryPerformanceCounter QueryPerformanceFrequency SetSearchPathMode GlobalMemoryStatusEx GlobalLock CreateProcessW GetCurrentThread OpenEventW CreateEventW SetUnhandledExceptionFilter SetEvent Sleep K32GetModuleFileNameExW Process32NextW Process32FirstW CreateToolhelp32Snapshot SystemTimeToFileTime RtlUnwind GetFinalPathNameByHandleW InitOnceComplete InitOnceBeginInitialize ConvertThreadToFiberEx ConvertFiberToThread CreateSemaphoreA GetSystemDirectoryA CreateFiberEx DeleteFiber SwitchToFiber AcquireSRWLockShared ReleaseSRWLockShared ReadConsoleA SetConsoleMode GetLogicalProcessorInformation GetCurrentProcess GetModuleFileNameW GetFileSize GetFileInformationByHandleEx OpenProcess UpdateProcThreadAttribute InitializeProcThreadAttributeList TerminateProcess SetFileAttributesW GetFileAttributesW DeleteFileW UnmapViewOfFile IsProcessorFeaturePresent MapViewOfFile UnhandledExceptionFilter GetVolumePathNameW CreateWaitableTimerW CancelWaitableTimer SetWaitableTimer GetUserDefaultLocaleName LocaleNameToLCID VerifyVersionInfoW CreateFileMappingW GetDiskFreeSpaceExW FindNextFileW FindFirstFileW FindClose VerSetConditionMask FormatMessageW GetProcAddress GetModuleHandleExW GetModuleHandleW GetModuleFileNameA GetCurrentThreadId GetCurrentProcessId CreateSemaphoreExW CreateMutexExW OpenSemaphoreW WaitForSingleObjectEx WaitForSingleObject ReleaseMutex ReleaseSemaphore GetProcessHeap HeapFree HeapAlloc SetLastError GetLastError CloseHandle OutputDebugStringW DebugBreak IsDebuggerPresent GetEnvironmentVariableW GetCommandLineW

crypt32

CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CertGetEnhancedKeyUsage CertGetIntendedKeyUsage CertOpenSystemStoreA CertOpenSystemStoreW CertDuplicateCertificateContext CertOpenStore CertFindCertificateInStore CertGetCertificateContextProperty

iphlpapi

GetAdaptersAddresses if_nametoindex

ole32

CoInitializeEx CoUninitialize CoCreateInstance StringFromGUID2 CoCreateGuid CoTaskMemAlloc CoTaskMemFree

powrprof

CallNtPowerInformation

user32

CreateWindowExW DestroyWindow ShowWindow GetDlgItem EnableWindow GetSystemMetrics CallWindowProcW BeginPaint EndPaint InvalidateRect GetClientRect GetWindowRect FillRect PostQuitMessage DefWindowProcW GetWindowLongPtrW MessageBoxW RegisterClassW DrawTextW SendMessageW GetWindowLongW LoadIconW DestroyIcon GetProcessWindowStation SetWindowLongPtrW GetUserObjectInformationW LoadBitmapW EnumDisplayDevicesA GetWindowThreadProcessId GetShellWindow TranslateAcceleratorW LoadAcceleratorsW DispatchMessageW TranslateMessage GetMessageW

ws2_32

connect accept WSACleanup WSAStartup recvfrom getsockname getpeername WSAIoctl getservbyname getservbyport gethostbyaddr htons inet_ntoa inet_addr gethostbyname getnameinfo gethostname WSAWaitForMultipleEvents shutdown select bind listen sendto WSASocketA __WSAFDIsSet closesocket ntohl ntohs setsockopt socket WSAGetLastError getaddrinfo freeaddrinfo inet_ntop htonl getsockopt send WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSASetEvent recv WSASetLastError ioctlsocket

advapi32

ReportEventW CryptAcquireContextW CryptReleaseContext CryptGetHashParam CryptCreateHash CryptHashData CryptDestroyHash RegCloseKey RegCreateKeyExW RegDeleteValueW RegOpenKeyExW RegSetValueExW RegGetValueW RegOpenKeyExA RegQueryValueExA CryptDestroyKey RegEnumKeyExW RegQueryInfoKeyW RegQueryValueExW RegDeleteTreeW OpenProcessToken AllocateAndInitializeSid CopySid EqualSid FreeSid GetLengthSid GetTokenInformation IsValidSid SystemFunction036 CryptGenRandom CryptSetHashParam CryptGetProvParam CryptGetUserKey CryptExportKey CryptDecrypt CryptSignHashW CryptEnumProvidersW DeregisterEventSource RegisterEventSourceW GetUserNameW

api-ms-win-core-synch-l1-2-0

WakeByAddressSingle WaitOnAddress

comctl32

InitCommonControlsEx _TrackMouseEvent TaskDialogIndirect

shell32

SHGetKnownFolderPath ShellExecuteExW SHGetFolderPathAndSubDirW Shell_NotifyIconW ShellExecuteW

gdi32

SetTextColor SetBkMode SetDCPenColor SetDCBrushColor SelectObject Rectangle GetStockObject DeleteObject CreateFontW CreateSolidBrush

shlwapi

ord12 PathFindExtensionW PathFindFileNameW

winmm

timeGetDevCaps timeGetTime timeEndPeriod timeSetEvent timeBeginPeriod

dbghelp

SymFromAddr

gdiplus

GdipAlloc GdiplusStartup GdiplusShutdown GdipCreateBitmapFromStream GdipCreateHBITMAPFromBitmap GdipDisposeImage GdipCloneImage GdipFree

uxtheme

SetWindowTheme

Name

.text

Size

9.4MB

Virtual Size

9.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

2.7MB

Virtual Size

2.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

230KB

Virtual Size

3.9MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

411KB

Virtual Size

410KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

_RDATA

Size

512B

Virtual Size

244B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.rsrc

Size

293KB

Virtual Size

293KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

82KB

Virtual Size

82KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Resubmissions

Sharing

General

Malware Config

Signatures

File Explorer

RobloxPlayerInstaller-4R3CXWJ92R.exe

PE Signature issue

kernel32

crypt32

iphlpapi

ole32

powrprof

user32

ws2_32

advapi32

api-ms-win-core-synch-l1-2-0

comctl32

shell32

gdi32

shlwapi

winmm

dbghelp

gdiplus

uxtheme

generic