RobloxPlayerInstaller.exe Malware Gen Analysis

Malware Gen

Updated on 2024-07-07 (3 months ago)

Online Virus Checker	v.1.0.181.174
DB Version:	2024-07-07 22:00:26

Malware.Win32.Gen.tr

This is a generic detection name used to identify a potentially harmful or suspicious file or program that exhibits characteristics of a Trojan horse. It is malware that disguises itself as a legitimate or benign program but contains malicious code or functions.

File	RobloxPlayerInstaller.exe
Checked	2024-07-07 20:01:05
MD5	84e67989f7ccd11c2b7db38f3d3443b8
SHA1	c3e821de715aa7508b3273de16c9156014d81922
SHA256	5eac06573fb9289a5ad1dfa8b88d2d7b79f1bd89e61c53247f8cae50143e7a2c
SHA512	d0ea7235f591f31edeb7183c91fb0bb1347a9386c170c43b21e2c5fd93b7040e73e1a1a9f3ef6f83d097b1af0f9e2a9938dd59ae47588940491da25248eb7d99
Imphash	84dfdbf12a79f153655e14db9a4225d7
File Size	5641112 bytes

Malware.Win32.Gen.tr Removal

Gridinsoft has the capability to identify and eliminate Malware.Win32.Gen.tr without requiring further user intervention.

Start by downloading Gridinsoft Anti-Malware to your computer.
Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
Click on the "Standard Scan" button.
After the scanning process is finished, click on "Clean Now" to remove any detected threats.
If prompted, restart your system to complete the removal process.

File Version Information

CompanyName	Roblox Corporation
FileDescription	Roblox
FileVersion	1, 6, 0, 6280391
LegalCopyright	Copyright © 2020 Roblox Corporation. All rights reserved.
OriginalFilename	Roblox.exe
ProductName	Roblox Bootstrapper
ProductVersion	1, 6, 0, 6280391
Translation	0x0409 0x04b0

Portable Executable Info

	b423ca67aaea047fe3295fc7c4dc1efd e77261c35382a2126a491c6a691a1197 3cf0a4cccedac0c0
Image Base:	0x00400000
Entry Point:	0x006e2ef0
Compilation:	2097-07-11 21:38:22
Checksum:	0x00564241 (Actual: 0x00564241)
OS Version:	6.0
PDB Path:	C:\buildAgent\work\ci_deploy_ninja_boot-x86_git\build.ninja\common\vs2019\x86\release\Installer\Windows\RobloxPlayerInstaller.pdb
PEiD:	PE32 executable (GUI) Intel 80386, for MS Windows
Sign:	OK
Sections:	5
Imports:	COMCTL32, gdiplus, WININET, bcrypt, ADVAPI32, SHELL32, IPHLPAPI, WS2_32, CRYPT32, KERNEL32, USER32, GDI32, ole32, SHLWAPI, POWRPROF, WINMM,
Exports:	0
Resources:	60

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Entropy
.text	0x00001000	0x00335b36	0x00335c00	480f01a383f10160a83239fc877992c5	6.73
.rdata	0x00337000	0x000e528a	0x000e5400	c161e67ceec688ac5c0aefd4fd673b3e	6.16
.data	0x0041d000	0x007ef060	0x000c2400	44c7e3fbb86afc92247767fbd12c21da	0.76
.rsrc	0x00c0d000	0x0005c0a0	0x0005c200	1477efef2ca662829fd14ef0fdccd445	7.05
.reloc	0x00c6a000	0x00024ff4	0x00025000	d90a23eefc966e34c1c4638eb8d0ef34	6.65