EasyValorantCheats[.]rar

Sharing

Copy URL Twitter E-mail

General

Target

EasyValorantCheats.rar
Size

1.0MB
MD5

cd84274d6fa1d734fde822dcef49fdf2
SHA1

6021aec0c9008e13fb49d01139a2a086be3c07ad
SHA256

7a2720d9f81584e959fe192a251afc474cadf5f751001c4e536e7d8c636fc999
SHA512

0585334c5797a8082e88f5176c666ce1e4b4fc8196818fc39c9fc651078e8f4971863e5a854162a6db31fe8e719a946869a66ed632af84bd45600b51d4c5de7c
SSDEEP

24576:lB7A7csg7wrb4W1CRCx4lRvJIVy+9yx12oouU8RKa0:fjsg7wrUW1C48fIVy+9yvFU8RKa0

Score

3^/10

Malware Config

Signatures

Unsigned PE 2 IoCs

Checks for missing Authenticode signature.

resource
unpack001/OpenWH.dll
unpack001/aim.dll

Files

EasyValorantCheats.rar
.rar

Password: valorant
EasyValorant.exe
.exe windows x86

Password: valorant

6d70ccca5bcc9ea6afb43e9e044ecfa9

Code Sign

87:82:52:60:00:00:00:00:51:d3:73:d9
Certificate

Issuer

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

10/06/2015, 13:42

Not After

10/11/2030, 14:12

Subject

CN=Entrust Extended Validation Code Signing CA - EVCS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageCertSign
KeyUsageCRLSign

05:f9:7d:05:4a:9b:fc:bf:9d:5e:12:f8:d0:ab:be:07
Certificate

Issuer

CN=Entrust Extended Validation Code Signing CA - EVCS1,OU=See www.entrust.net/legal-terms+OU=(c) 2015 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Not Before

08/12/2020, 14:34

Not After

08/12/2023, 14:34

Subject

SERIALNUMBER=31 333 532,CN=ESET\, spol. s r.o.,O=ESET\, spol. s r.o.,L=Bratislava,C=SK,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.3=#1302534b

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

33:00:00:00:42:00:ba:5e:23:b0:a1:f3:99:00:00:00:00:00:42
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

07/07/2015, 20:55

Not After

07/07/2025, 20:55

Subject

CN=Entrust Root Certification Authority - G2,OU=See www.entrust.net/legal-terms+OU=(c) 2009 Entrust\, Inc. - for authorized use only,O=Entrust\, Inc.,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

52:0f:ba:3b:a4:6f:b7:4a:c4:45:0b:b4:98:75:2f:bc:4a:dc:bb:22
Certificate

Issuer

CN=ESET Code Signing CA 2020,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Not Before

19/07/2020, 00:00

Not After

19/07/2023, 00:00

Subject

CN=ESET\, spol. s r.o.,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

7d:90:d1:7c:6b:36:ca:f6:8f:b9:b7:2f:65:68:b8:22:3d:30:2d:a8
Certificate

Issuer

CN=ESET Root Certificate Authority 2020,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Not Before

17/07/2020, 00:00

Not After

17/07/2030, 00:00

Subject

CN=ESET Code Signing CA 2020,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

69:79:73:ba:c8:77:a9:31:6b:52:06:18:77:49:4b:9f:1a:b2:6c:bc
Certificate

Issuer

CN=ESET Timestamping CA 2020,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Not Before

18/07/2020, 00:00

Not After

18/07/2023, 00:00

Subject

CN=ESET Timestamp,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

76:79:fc:14:55:72:11:3a:f7:92:d1:f4:af:3c:4e:3a:8a:8a:6e:38
Certificate

Issuer

CN=ESET Root Certificate Authority 2020,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Not Before

16/07/2020, 00:00

Not After

16/07/2030, 00:00

Subject

CN=ESET Timestamping CA 2020,O=ESET\, spol. s r.o.,L=Bratislava,C=SK

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

61:1c:b2:8a:00:00:00:00:00:26
Certificate

Issuer

CN=Microsoft Code Verification Root,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Not Before

15/04/2011, 19:41

Not After

15/04/2021, 19:51

Subject

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01/08/2022, 00:00

Not After

09/11/2031, 23:59

Subject

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

Issuer

CN=DigiCert Trusted Root G4,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

23/03/2022, 00:00

Not After

22/03/2037, 23:59

Subject

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

Issuer

CN=DigiCert Trusted G4 RSA4096 SHA256 TimeStamping CA,O=DigiCert\, Inc.,C=US

Not Before

21/09/2022, 00:00

Not After

21/11/2033, 23:59

Subject

CN=DigiCert Timestamp 2022 - 2,O=DigiCert,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

f6:bc:ba:06:6b:b2:6b:5e:62:8d:65:97:f0:1f:6e:62:19:b1:87:72:8f:db:30:07:d0:7a:ae:90:b3:63:0e:83
Signer

Actual PE Digest

f6:bc:ba:06:6b:b2:6b:5e:62:8d:65:97:f0:1f:6e:62:19:b1:87:72:8f:db:30:07:d0:7a:ae:90:b3:63:0e:83

Digest Algorithm

sha256

PE Digest Matches

false

f6:bc:ba:06:6b:b2:6b:5e:62:8d:65:97:f0:1f:6e:62:19:b1:87:72:8f:db:30:07:d0:7a:ae:90:b3:63:0e:83
Signer

Actual PE Digest

f6:bc:ba:06:6b:b2:6b:5e:62:8d:65:97:f0:1f:6e:62:19:b1:87:72:8f:db:30:07:d0:7a:ae:90:b3:63:0e:83

Digest Algorithm

sha256

PE Digest Matches

false

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE

Imports

gdi32

GetColorAdjustment

user32

ReleaseDC
GetDC
ReleaseCapture
GetRawInputData

kernel32

CreateFileW
HeapSize
GetProcessHeap
SetStdHandle
SetEnvironmentVariableW
Sleep
GlobalAlloc
GlobalFree
FormatMessageA
LocalFree
GetLocaleInfoEx
EncodePointer
DecodePointer
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
MultiByteToWideChar
WideCharToMultiByte
LCMapStringEx
GetStringTypeW
CompareStringEx
GetCPInfo
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
GetCurrentProcess
TerminateProcess
FreeEnvironmentStringsW
RaiseException
RtlUnwind
InterlockedPushEntrySList
InterlockedFlushSList
GetLastError
SetLastError
InitializeCriticalSectionAndSpinCount
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
GetProcAddress
LoadLibraryExW
GetStdHandle
WriteFile
GetModuleFileNameW
ExitProcess
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
GetCurrentThread
HeapFree
HeapAlloc
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
CloseHandle
FlushFileBuffers
GetConsoleOutputCP
GetConsoleMode
ReadFile
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
SetConsoleCtrlHandler
HeapReAlloc
GetTimeZoneInformation
OutputDebugStringW
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetEnvironmentStringsW
WriteConsoleW

Sections

.text
Size: 721KB - Virtual size: 721KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 101KB - Virtual size: 100KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 419KB - Virtual size: 425KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.idata
Size: 3KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.00cfg
Size: 512B - Virtual size: 270B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 22KB - Virtual size: 21KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
OpenWH.dll
.dll windows x64

Password: valorant

1ba0e652faad426f7dfc63f720a7bbe0

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL

Imports

kernel32

CloseHandle
CreateEventW
CreateFileMappingW
CreateFileW
CreateSemaphoreA
CreateThread
DebugBreak
DeleteCriticalSection
EnterCriticalSection
ExitThread
FindClose
FindFirstFileW
FindNextFileW
FreeLibrary
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetExitCodeThread
GetLastError
GetModuleFileNameW
GetModuleHandleA
GetModuleHandleExW
GetProcAddress
GetSystemInfo
GetSystemTimeAsFileTime
GetTickCount
InitializeCriticalSection
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryW
MapViewOfFile
MultiByteToWideChar
QueryPerformanceCounter
ReleaseSemaphore
ResetEvent
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetEvent
SetThreadPriority
SetUnhandledExceptionFilter
Sleep
SwitchToThread
TerminateProcess
TlsAlloc
TlsFree
TlsGetValue
TlsSetValue
TryEnterCriticalSection
UnhandledExceptionFilter
UnmapViewOfFile
VirtualProtect
VirtualQuery
WaitForMultipleObjects
WaitForSingleObject
WaitForSingleObjectEx
WideCharToMultiByte

msvcrt

__dllonexit
__iob_func
__setusermatherr
_aligned_free
_aligned_malloc
_amsg_exit
_errno
_initterm
_lock
_onexit
_stricmp
_strnicmp
_unlock
_vsnprintf
_wfopen
_wgetcwd
_wgetenv
abort
atoi
calloc
clearerr
fclose
ferror
fflush
fgetc
fprintf
free
frexp
fseek
ftell
fwrite
getenv
isalnum
isalpha
isspace
localeconv
log10
malloc
memcmp
memcpy
memmove
memset
qsort
realloc
signal
sinh
sscanf
strchr
strcmp
strcpy
strerror
strlen
strncmp
strncpy
strpbrk
strrchr
strtol
strtoul
vfprintf
wcscmp
_strdup

ole32

CoCreateInstance
CoInitialize
CoInitializeEx
CoTaskMemFree
CoUninitialize
PropVariantClear
StringFromCLSID

shell32

SHGetSpecialFolderPathW

user32

GetForegroundWindow
GetMessageA
PeekMessageA
PostThreadMessageA

winmm

waveInAddBuffer
waveInClose
waveInGetDevCapsW
waveInGetNumDevs
waveInOpen
waveInPrepareHeader
waveInReset
waveInStart
waveInStop
waveInUnprepareHeader
waveOutClose
waveOutGetDevCapsW
waveOutGetNumDevs
waveOutOpen
waveOutPrepareHeader
waveOutUnprepareHeader
waveOutWrite

Exports

Exports

alAuxiliaryEffectSlotf
alAuxiliaryEffectSlotfv
alAuxiliaryEffectSloti
alAuxiliaryEffectSlotiv
alBuffer3f
alBuffer3i
alBufferData
alBufferSamplesSOFT
alBufferStorageSOFT
alBufferSubDataSOFT
alBufferSubSamplesSOFT
alBufferf
alBufferfv
alBufferi
alBufferiv
alDeferUpdatesSOFT
alDeleteAuxiliaryEffectSlots
alDeleteBuffers
alDeleteEffects
alDeleteFilters
alDeleteSources
alDisable
alDistanceModel
alDopplerFactor
alDopplerVelocity
alEffectf
alEffectfv
alEffecti
alEffectiv
alEnable
alEventCallbackSOFT
alEventControlSOFT
alFilterf
alFilterfv
alFilteri
alFilteriv
alFlushMappedBufferSOFT
alGenAuxiliaryEffectSlots
alGenBuffers
alGenEffects
alGenFilters
alGenSources
alGetAuxiliaryEffectSlotf
alGetAuxiliaryEffectSlotfv
alGetAuxiliaryEffectSloti
alGetAuxiliaryEffectSlotiv
alGetBoolean
alGetBooleanv
alGetBuffer3f
alGetBuffer3i
alGetBufferSamplesSOFT
alGetBufferf
alGetBufferfv
alGetBufferi
alGetBufferiv
alGetDouble
alGetDoublev
alGetEffectf
alGetEffectfv
alGetEffecti
alGetEffectiv
alGetEnumValue
alGetError
alGetFilterf
alGetFilterfv
alGetFilteri
alGetFilteriv
alGetFloat
alGetFloatv
alGetInteger
alGetInteger64SOFT
alGetInteger64vSOFT
alGetIntegerv
alGetListener3f
alGetListener3i
alGetListenerf
alGetListenerfv
alGetListeneri
alGetListeneriv
alGetPointerSOFT
alGetPointervSOFT
alGetProcAddress
alGetSource3dSOFT
alGetSource3f
alGetSource3i
alGetSource3i64SOFT
alGetSourcedSOFT
alGetSourcedvSOFT
alGetSourcef
alGetSourcefv
alGetSourcei
alGetSourcei64SOFT
alGetSourcei64vSOFT
alGetSourceiv
alGetString
alGetStringiSOFT
alIsAuxiliaryEffectSlot
alIsBuffer
alIsBufferFormatSupportedSOFT
alIsEffect
alIsEnabled
alIsExtensionPresent
alIsFilter
alIsSource
alListener3f
alListener3i
alListenerf
alListenerfv
alListeneri
alListeneriv
alMapBufferSOFT
alProcessUpdatesSOFT
alSource3dSOFT
alSource3f
alSource3i
alSource3i64SOFT
alSourcePause
alSourcePausev
alSourcePlay
alSourcePlayv
alSourceQueueBufferLayersSOFT
alSourceQueueBuffers
alSourceRewind
alSourceRewindv
alSourceStop
alSourceStopv
alSourceUnqueueBuffers
alSourcedSOFT
alSourcedvSOFT
alSourcef
alSourcefv
alSourcei
alSourcei64SOFT
alSourcei64vSOFT
alSourceiv
alSpeedOfSound
alUnmapBufferSOFT
alcCaptureCloseDevice
alcCaptureOpenDevice
alcCaptureSamples
alcCaptureStart
alcCaptureStop
alcCloseDevice
alcCreateContext
alcDestroyContext
alcDevicePauseSOFT
alcDeviceResumeSOFT
alcGetContextsDevice
alcGetCurrentContext
alcGetEnumValue
alcGetError
alcGetInteger64vSOFT
alcGetIntegerv
alcGetProcAddress
alcGetString
alcGetStringiSOFT
alcGetThreadContext
alcIsExtensionPresent
alcIsRenderFormatSupportedSOFT
alcLoopbackOpenDeviceSOFT
alcMakeContextCurrent
alcOpenDevice
alcProcessContext
alcRenderSamplesSOFT
alcResetDeviceSOFT
alcSetThreadContext
alcSuspendContext
alsoft_get_version

Sections

.text
Size: 441KB - Virtual size: 440KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 776B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.rdata
Size: 494KB - Virtual size: 494KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.pdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.xdata
Size: 12KB - Virtual size: 12KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.bss
Size: - Virtual size: 21KB

IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.edata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.idata
Size: 5KB - Virtual size: 5KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.CRT
Size: 512B - Virtual size: 88B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.tls
Size: 512B - Virtual size: 104B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.reloc
Size: 2KB - Virtual size: 2KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
aim.dll
.dll windows x64

Password: valorant

b45eb67729a0d59464c91e63f20b7cee

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

Imports

ws2_32

gethostbyaddr
send
socket
ntohs
inet_addr
inet_ntoa
gethostname
recvfrom
recv
WSAGetLastError
htons
sendto
ioctlsocket
setsockopt
getpeername
WSAStartup
listen
shutdown
select
gethostbyname
closesocket
bind
getsockname
accept
__WSAFDIsSet
connect

user32

GetActiveWindow
MessageBoxA
GetWindowThreadProcessId

kernel32

UnhandledExceptionFilter
IsProcessorFeaturePresent
SetUnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
DisableThreadLibraryCalls
VirtualProtect
TlsFree
TlsGetValue
CreateSemaphoreW
DeleteCriticalSection
CreateThread
RaiseException
TlsAlloc
GetCurrentThreadId
InitializeConditionVariable
InitializeCriticalSection
LeaveCriticalSection
WakeConditionVariable
WakeAllConditionVariable
ReleaseSemaphore
EnterCriticalSection
TlsSetValue
TryEnterCriticalSection
SleepConditionVariableCS
GetProcessTimes
QueryPerformanceCounter
VirtualFree
VirtualAlloc
GetTickCount
WriteProcessMemory
WaitForDebugEvent
Wow64SetThreadContext
Wow64GetThreadContext
DebugActiveProcessStop
ContinueDebugEvent
OpenProcess
CloseHandle
GetThreadContext
DebugActiveProcess
ReadProcessMemory
FlushInstructionCache
SetThreadContext
OpenThread
DebugBreakProcess
GetCurrentProcessId
GetConsoleWindow
IsDebuggerPresent
CreateFileW
AddVectoredExceptionHandler
SetThreadStackGuarantee
ReadFile
GetCurrentProcess
WriteFile
TerminateProcess
CreatePipe
WaitForSingleObject
DuplicateHandle
CreateProcessW
GetExitCodeProcess
FindFirstFileW
GetFullPathNameW
FindNextFileW
GetModuleFileNameW
FindClose
GetSystemDefaultLocaleName
Sleep
GetCurrentThread
QueryPerformanceFrequency
GetCurrentDirectoryW
SetCurrentDirectoryW
GetThreadTimes
GetSystemTimeAsFileTime

vcruntime140

memcpy
memmove
__intrinsic_setjmp
__std_type_info_destroy_list
__C_specific_handler
wcschr
longjmp
memset
memcmp

api-ms-win-crt-string-l1-1-0

_wcsdup
isdigit

api-ms-win-crt-heap-l1-1-0

malloc
free

api-ms-win-crt-stdio-l1-1-0

__acrt_iob_func
fclose
_fseeki64
__stdio_common_vfprintf
fread
_ftelli64
fwrite
_fileno
feof
_wfopen
_write
_setmode
fseek
__stdio_common_vswprintf
ftell
__stdio_common_vsprintf
__stdio_common_vfwprintf
fflush
__stdio_common_vsscanf
fopen

api-ms-win-crt-environment-l1-1-0

getenv
__p__wenviron
_wgetenv
_wputenv

api-ms-win-crt-convert-l1-1-0

atoi
wcstod
wcstol

api-ms-win-crt-time-l1-1-0

_localtime64
_gmtime64
strftime
_time64
_mktime64

api-ms-win-crt-runtime-l1-1-0

_errno
exit
_wsystem
_initterm
_initterm_e
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_execute_onexit_table
_cexit
_getpid

api-ms-win-crt-locale-l1-1-0

setlocale

api-ms-win-crt-filesystem-l1-1-0

_wrename
_wrmdir
_wstat32
_wunlink
_wmkdir

api-ms-win-crt-conio-l1-1-0

_getch
_getche

api-ms-win-crt-math-l1-1-0

atan
sqrt
atan2
tan
asin
ceil
acos
cos
exp
floor
fmod
log
sin
pow

Exports

Exports

hl_add_root
hl_alloc_array
hl_alloc_buffer
hl_alloc_bytes
hl_alloc_carray
hl_alloc_closure_ptr
hl_alloc_closure_void
hl_alloc_dynamic
hl_alloc_dynbool
hl_alloc_dynobj
hl_alloc_enum
hl_alloc_enum_dyn
hl_alloc_executable_memory
hl_alloc_init
hl_alloc_obj
hl_alloc_strbytes
hl_alloc_virtual
hl_array_blit
hl_array_type
hl_assert
hl_atomic_add32
hl_atomic_and32
hl_atomic_compare_exchange32
hl_atomic_compare_exchange_ptr
hl_atomic_exchange32
hl_atomic_exchange_ptr
hl_atomic_load32
hl_atomic_load_ptr
hl_atomic_or32
hl_atomic_store32
hl_atomic_store_ptr
hl_atomic_sub32
hl_atomic_xor32
hl_blocking
hl_breakpoint
hl_bsort_f64
hl_bsort_i32
hl_buffer_char
hl_buffer_content
hl_buffer_cstr
hl_buffer_length
hl_buffer_str
hl_buffer_str_sub
hl_buffer_val
hl_bytes_address
hl_bytes_blit
hl_bytes_compare
hl_bytes_compare16
hl_bytes_fill
hl_bytes_find
hl_bytes_from_address
hl_bytes_offset
hl_bytes_rfind
hl_bytes_subtract
hl_cache_free
hl_call_method
hl_call_stack_raw
hl_carray_get
hl_carray_length
hl_closure_stack_capture
hl_condition_acquire
hl_condition_alloc
hl_condition_broadcast
hl_condition_free
hl_condition_release
hl_condition_signal
hl_condition_timed_wait
hl_condition_try_acquire
hl_condition_wait
hl_copy_bytes
hl_date_from_string
hl_date_from_time
hl_date_get_inf
hl_date_get_time
hl_date_get_utc_inf
hl_date_new
hl_date_now
hl_date_to_string
hl_debug_breakpoint
hl_debug_call
hl_debug_flush
hl_debug_read
hl_debug_read_register
hl_debug_resume
hl_debug_start
hl_debug_stop
hl_debug_wait
hl_debug_write
hl_debug_write_register
hl_deque_add
hl_deque_alloc
hl_deque_pop
hl_deque_push
hl_detect_debugger
hl_dump_stack
hl_dyn_call
hl_dyn_call_obj
hl_dyn_call_safe
hl_dyn_castd
hl_dyn_castf
hl_dyn_casti
hl_dyn_casti64
hl_dyn_castp
hl_dyn_compare
hl_dyn_getd
hl_dyn_getf
hl_dyn_geti
hl_dyn_geti64
hl_dyn_getp
hl_dyn_op
hl_dyn_setd
hl_dyn_setf
hl_dyn_seti
hl_dyn_seti64
hl_dyn_setp
hl_enum_parameters
hl_exception_stack
hl_exception_stack_raw
hl_fatal_error
hl_fatal_fmt
hl_field_name
hl_file_close
hl_file_contents
hl_file_eof
hl_file_error_code
hl_file_flush
hl_file_is_locked
hl_file_open
hl_file_read
hl_file_read_char
hl_file_seek
hl_file_seek2
hl_file_stderr
hl_file_stdin
hl_file_stdout
hl_file_tell
hl_file_tell2
hl_file_write
hl_file_write_char
hl_flush_proto
hl_free
hl_free_executable_memory
hl_from_utf8
hl_ftos
hl_fun_compare
hl_gc_alloc_gen
hl_gc_dump_memory
hl_gc_enable
hl_gc_get_flags
hl_gc_get_memsize
hl_gc_get_page
hl_gc_major
hl_gc_mark_grow
hl_gc_profile
hl_gc_set_dump_types
hl_gc_set_flags
hl_gc_stats
hl_gc_threads_info
hl_get_closure_value
hl_get_obj_proto
hl_get_obj_rt
hl_get_thread
hl_get_thread_id
hl_get_virtual_value
hl_global_free
hl_global_init
hl_global_lock
hl_hash
hl_hash_gen
hl_hash_utf8
hl_hballoc
hl_hbclear
hl_hbexists
hl_hbget
hl_hbkeys
hl_hbremove
hl_hbset
hl_hbsize
hl_hbvalues
hl_hi64alloc
hl_hi64clear
hl_hi64exists
hl_hi64get
hl_hi64keys
hl_hi64remove
hl_hi64set
hl_hi64size
hl_hi64values
hl_hialloc
hl_hiclear
hl_hiexists
hl_higet
hl_hikeys
hl_hiremove
hl_hiset
hl_hisize
hl_hivalues
hl_hoalloc
hl_hoclear
hl_hoexists
hl_hoget
hl_hokeys
hl_horemove
hl_hoset
hl_hosize
hl_host_local
hl_host_resolve
hl_host_reverse
hl_host_to_string
hl_hovalues
hl_init_enum
hl_init_virtual
hl_is_blocking
hl_is_dynamic
hl_is_gc_ptr
hl_is_prim_loaded
hl_itos
hl_lock_create
hl_lock_release
hl_lock_wait
hl_lookup_find
hl_lookup_insert
hl_make_closure
hl_make_dyn
hl_make_fun_wrapper
hl_make_var_args
hl_malloc
hl_mark_size
hl_math_abs
hl_math_acos
hl_math_asin
hl_math_atan
hl_math_atan2
hl_math_ceil
hl_math_cos
hl_math_exp
hl_math_fceil
hl_math_ffloor
hl_math_floor
hl_math_fround
hl_math_isfinite
hl_math_isnan
hl_math_log
hl_math_pow
hl_math_round
hl_math_sin
hl_math_sqrt
hl_math_tan
hl_mem_compact
hl_mutex_acquire
hl_mutex_alloc
hl_mutex_free
hl_mutex_release
hl_mutex_try_acquire
hl_nan
hl_no_closure
hl_null_access
hl_obj_copy
hl_obj_delete_field
hl_obj_field_fetch
hl_obj_fields
hl_obj_get_field
hl_obj_has_field
hl_obj_set_field
hl_pad_struct
hl_parse_float
hl_parse_int
hl_prim_not_loaded
hl_process_close
hl_process_exit
hl_process_kill
hl_process_pid
hl_process_run
hl_process_stderr_read
hl_process_stdin_close
hl_process_stdin_write
hl_process_stdout_read
hl_ptr_compare
hl_regexp_match
hl_regexp_matched_num
hl_regexp_matched_pos
hl_regexp_new_options
hl_register_thread
hl_remove_root
hl_resolve_symbol
hl_rethrow
hl_rnd_alloc
hl_rnd_float
hl_rnd_init_system
hl_rnd_int
hl_rnd_set_seed
hl_safe_cast
hl_same_type
hl_semaphore_acquire
hl_semaphore_alloc
hl_semaphore_free
hl_semaphore_release
hl_semaphore_try_acquire
hl_set_error_handler
hl_setup_callbacks
hl_setup_callbacks2
hl_setup_exception
hl_setup_longjump
hl_setup_profiler
hl_setup_reload_check
hl_socket_accept
hl_socket_bind
hl_socket_close
hl_socket_connect
hl_socket_fd_size
hl_socket_host
hl_socket_init
hl_socket_listen
hl_socket_new
hl_socket_peer
hl_socket_recv
hl_socket_recv_char
hl_socket_recv_from
hl_socket_select
hl_socket_send
hl_socket_send_char
hl_socket_send_to
hl_socket_set_blocking
hl_socket_set_fast_send
hl_socket_set_timeout
hl_socket_shutdown
hl_string_compare
hl_sys_args
hl_sys_check_reload
hl_sys_command
hl_sys_cpu_time
hl_sys_create_dir
hl_sys_delete
hl_sys_env
hl_sys_exe_path
hl_sys_exists
hl_sys_exit
hl_sys_full_path
hl_sys_get_char
hl_sys_get_cwd
hl_sys_get_env
hl_sys_getpid
hl_sys_has_debugger
hl_sys_hl_file
hl_sys_init
hl_sys_is64
hl_sys_is_dir
hl_sys_locale
hl_sys_print
hl_sys_profile_event
hl_sys_put_env
hl_sys_read_dir
hl_sys_remove_dir
hl_sys_rename
hl_sys_set_cwd
hl_sys_set_flags
hl_sys_set_time_locale
hl_sys_sleep
hl_sys_stat
hl_sys_string
hl_sys_thread_cpu_time
hl_sys_time
hl_sys_utf8_path
hl_thread_create
hl_thread_current
hl_thread_get_name
hl_thread_id
hl_thread_set_name
hl_thread_start
hl_thread_yield
hl_throw
hl_throw_buffer
hl_tls_alloc
hl_tls_free
hl_tls_get
hl_tls_set
hl_to_string
hl_to_utf16
hl_to_utf8
hl_to_virtual
hl_track
hl_track_count
hl_track_entry
hl_track_get_bits
hl_track_init
hl_track_lock
hl_track_reset
hl_track_set_bits
hl_track_set_depth
hl_type_args_count
hl_type_enum_eq
hl_type_enum_fields
hl_type_enum_values
hl_type_get_global
hl_type_instance_fields
hl_type_name
hl_type_safe_cast
hl_type_set_global
hl_type_size
hl_type_str
hl_type_super
hl_ucs2_lower
hl_ucs2_upper
hl_ucs2length
hl_unregister_thread
hl_url_decode
hl_url_encode
hl_utf16_to_utf8
hl_utf8_length
hl_utf8_to_utf16
hl_value_cast
hl_value_to_string
hl_virtual_make_value
hl_wrapper_call
hl_write_dyn
hl_zalloc
hlp_alloc_array
hlp_alloc_bytes
hlp_alloc_carray
hlp_alloc_enum_dyn
hlp_alloc_obj
hlp_array_blit
hlp_array_type
hlp_atomic_add32
hlp_atomic_and32
hlp_atomic_compare_exchange32
hlp_atomic_compare_exchange_ptr
hlp_atomic_exchange32
hlp_atomic_exchange_ptr
hlp_atomic_load32
hlp_atomic_load_ptr
hlp_atomic_or32
hlp_atomic_store32
hlp_atomic_store_ptr
hlp_atomic_sub32
hlp_atomic_xor32
hlp_blocking
hlp_breakpoint
hlp_bsort_f64
hlp_bsort_i32
hlp_bytes_address
hlp_bytes_blit
hlp_bytes_compare
hlp_bytes_compare16
hlp_bytes_fill
hlp_bytes_find
hlp_bytes_from_address
hlp_bytes_offset
hlp_bytes_rfind
hlp_bytes_subtract
hlp_call_method
hlp_call_stack_raw
hlp_carray_get
hlp_carray_length
hlp_condition_acquire
hlp_condition_alloc
hlp_condition_broadcast
hlp_condition_release
hlp_condition_signal
hlp_condition_timed_wait
hlp_condition_try_acquire
hlp_condition_wait
hlp_date_from_string
hlp_date_from_time
hlp_date_get_inf
hlp_date_get_time
hlp_date_get_utc_inf
hlp_date_new
hlp_date_now
hlp_date_to_string
hlp_debug_breakpoint
hlp_debug_call
hlp_debug_flush
hlp_debug_read
hlp_debug_read_register
hlp_debug_resume
hlp_debug_start
hlp_debug_stop
hlp_debug_wait
hlp_debug_write
hlp_debug_write_register
hlp_deque_add
hlp_deque_alloc
hlp_deque_pop
hlp_deque_push
hlp_dyn_compare
hlp_dyn_op
hlp_enum_parameters
hlp_exception_stack
hlp_exception_stack_raw
hlp_field_name
hlp_file_close
hlp_file_contents
hlp_file_eof
hlp_file_error_code
hlp_file_flush
hlp_file_is_locked
hlp_file_open
hlp_file_read
hlp_file_read_char

Sections

.text
Size: 214KB - Virtual size: 214KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 140KB - Virtual size: 139KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 12KB - Virtual size: 34KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
readme.txt

Sharing

General

Malware Config

Signatures

Files

Password: valorant

Password: valorant

6d70ccca5bcc9ea6afb43e9e044ecfa9

Code Sign

87:82:52:60:00:00:00:00:51:d3:73:d9Certificate

Extended Key Usages

Key Usages

05:f9:7d:05:4a:9b:fc:bf:9d:5e:12:f8:d0:ab:be:07Certificate

Extended Key Usages

Key Usages

33:00:00:00:42:00:ba:5e:23:b0:a1:f3:99:00:00:00:00:00:42Certificate

Extended Key Usages

Key Usages

52:0f:ba:3b:a4:6f:b7:4a:c4:45:0b:b4:98:75:2f:bc:4a:dc:bb:22Certificate

Extended Key Usages

Key Usages

7d:90:d1:7c:6b:36:ca:f6:8f:b9:b7:2f:65:68:b8:22:3d:30:2d:a8Certificate

Extended Key Usages

Key Usages

69:79:73:ba:c8:77:a9:31:6b:52:06:18:77:49:4b:9f:1a:b2:6c:bcCertificate

Extended Key Usages

Key Usages

76:79:fc:14:55:72:11:3a:f7:92:d1:f4:af:3c:4e:3a:8a:8a:6e:38Certificate

Extended Key Usages

Key Usages

61:1c:b2:8a:00:00:00:00:00:26Certificate

Key Usages

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5aCertificate

Key Usages

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5bCertificate

Extended Key Usages

Key Usages

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5aCertificate

Extended Key Usages

Key Usages

f6:bc:ba:06:6b:b2:6b:5e:62:8d:65:97:f0:1f:6e:62:19:b1:87:72:8f:db:30:07:d0:7a:ae:90:b3:63:0e:83Signer

f6:bc:ba:06:6b:b2:6b:5e:62:8d:65:97:f0:1f:6e:62:19:b1:87:72:8f:db:30:07:d0:7a:ae:90:b3:63:0e:83Signer

Headers

DLL Characteristics

File Characteristics

Imports

gdi32

user32

kernel32

Sections

.text Size: 721KB - Virtual size: 721KB

.rdata Size: 101KB - Virtual size: 100KB

.data Size: 419KB - Virtual size: 425KB

.idata Size: 3KB - Virtual size: 3KB

.00cfg Size: 512B - Virtual size: 270B

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 22KB - Virtual size: 21KB

Password: valorant

1ba0e652faad426f7dfc63f720a7bbe0

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

msvcrt

ole32

shell32

user32

winmm

Exports

Exports

Sections

.text Size: 441KB - Virtual size: 440KB

.data Size: 1024B - Virtual size: 776B

.rdata Size: 494KB - Virtual size: 494KB

.pdata Size: 12KB - Virtual size: 12KB

.xdata Size: 12KB - Virtual size: 12KB

.bss Size: - Virtual size: 21KB

.edata Size: 4KB - Virtual size: 4KB

.idata Size: 5KB - Virtual size: 5KB

87:82:52:60:00:00:00:00:51:d3:73:d9
Certificate

05:f9:7d:05:4a:9b:fc:bf:9d:5e:12:f8:d0:ab:be:07
Certificate

33:00:00:00:42:00:ba:5e:23:b0:a1:f3:99:00:00:00:00:00:42
Certificate

52:0f:ba:3b:a4:6f:b7:4a:c4:45:0b:b4:98:75:2f:bc:4a:dc:bb:22
Certificate

7d:90:d1:7c:6b:36:ca:f6:8f:b9:b7:2f:65:68:b8:22:3d:30:2d:a8
Certificate

69:79:73:ba:c8:77:a9:31:6b:52:06:18:77:49:4b:9f:1a:b2:6c:bc
Certificate

76:79:fc:14:55:72:11:3a:f7:92:d1:f4:af:3c:4e:3a:8a:8a:6e:38
Certificate

61:1c:b2:8a:00:00:00:00:00:26
Certificate

0e:9b:18:8e:f9:d0:2d:e7:ef:db:50:e2:08:40:18:5a
Certificate

07:36:37:b7:24:54:7c:d8:47:ac:fd:28:66:2a:5e:5b
Certificate

0c:4d:69:72:4b:94:fa:3c:2a:4a:3d:29:07:80:3d:5a
Certificate

f6:bc:ba:06:6b:b2:6b:5e:62:8d:65:97:f0:1f:6e:62:19:b1:87:72:8f:db:30:07:d0:7a:ae:90:b3:63:0e:83
Signer

f6:bc:ba:06:6b:b2:6b:5e:62:8d:65:97:f0:1f:6e:62:19:b1:87:72:8f:db:30:07:d0:7a:ae:90:b3:63:0e:83
Signer

.text
Size: 721KB - Virtual size: 721KB

.rdata
Size: 101KB - Virtual size: 100KB

.data
Size: 419KB - Virtual size: 425KB

.idata
Size: 3KB - Virtual size: 3KB

.00cfg
Size: 512B - Virtual size: 270B

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 22KB - Virtual size: 21KB

.text
Size: 441KB - Virtual size: 440KB

.data
Size: 1024B - Virtual size: 776B

.rdata
Size: 494KB - Virtual size: 494KB

.pdata
Size: 12KB - Virtual size: 12KB

.xdata
Size: 12KB - Virtual size: 12KB

.bss
Size: - Virtual size: 21KB

.edata
Size: 4KB - Virtual size: 4KB

.idata
Size: 5KB - Virtual size: 5KB

.CRT
Size: 512B - Virtual size: 88B

.tls
Size: 512B - Virtual size: 104B

.reloc
Size: 2KB - Virtual size: 2KB

.text
Size: 214KB - Virtual size: 214KB

.rdata
Size: 140KB - Virtual size: 139KB

.data
Size: 12KB - Virtual size: 34KB

.pdata
Size: 8KB - Virtual size: 7KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 4KB - Virtual size: 4KB