PisiValorant[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
PisiValorant.exe
Size 1.2MB
Sample240601-py1jpscf2t
SHA256 c3f0be28bca238d8351dd5de0e57927b9f883559caf4dc9853f8214449e1e652
MD5 35872c580af25caa3c3c33cc310415c3
SHA1 cc5f09820581d06f66af0c080093ef80068421e7
SHA512 177e460fdb70dfb1ccb8bd6915abf7d3e08bcb4be5499b180700d06819ffc1ba35d6cbf4cbe40b8965f173a6f94ee77f4e8e45395e1c07bf8c83c8bb053140d4
SSDEEP 24576:tFOyqcZsptl7Ko60OegX7AojnSXnMvQo:tF72dM0Ervjn
MD5 SHA1 SHA512 SSDEEP

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
PisiValorant.exe

File Explorer

PisiValorant.exe

.exe 1.2MB

PisiValorant.exe

IMPHASH bace0bd2e9744a69e6fe6d64c3bef23d
SHA256 c3f0be28bca238d8351dd5de0e57927b9f883559caf4dc9853f8214449e1e652
MD5 35872c580af25caa3c3c33cc310415c3
SHA1 cc5f09820581d06f66af0c080093ef80068421e7
SHA512 177e460fdb70dfb1ccb8bd6915abf7d3e08bcb4be5499b180700d06819ffc1ba35d6cbf4cbe40b8965f173a6f94ee77f4e8e45395e1c07bf8c83c8bb053140d4
SSDEEP 24576:tFOyqcZsptl7Ko60OegX7AojnSXnMvQo:tF72dM0Ervjn
MD5 SHA1 SHA512 SSDEEP

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

304064

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

C:\Users\MJMOD\Downloads\nightflex\x64\Release\nightflex.pdb

kernel32

GlobalUnlock QueryPerformanceFrequency QueryPerformanceCounter SetConsoleTitleA GetCurrentProcess SetConsoleScreenBufferSize GetStdHandle WriteFile DeviceIoControl SetConsoleWindowInfo CreateFileW OpenProcess CreateToolhelp32Snapshot Sleep GetLastError Process32NextW DeleteFileW Process32FirstW CloseHandle CreateThread GetWindowsDirectoryW SystemTimeToFileTime GlobalMemoryStatusEx GetSystemTime lstrcmpiW FormatMessageA GetLocaleInfoEx CreateDirectoryW FindClose FindFirstFileW GlobalFree GetFileAttributesExW AreFileApisANSI GetModuleHandleW GetFileInformationByHandleEx MultiByteToWideChar WideCharToMultiByte ReleaseSRWLockExclusive AcquireSRWLockExclusive WakeAllConditionVariable SleepConditionVariableSRW RtlCaptureContext RtlLookupFunctionEntry RtlVirtualUnwind UnhandledExceptionFilter SetUnhandledExceptionFilter TerminateProcess IsProcessorFeaturePresent IsDebuggerPresent GetCurrentProcessId GetCurrentThreadId GetSystemTimeAsFileTime InitializeSListHead GlobalLock GlobalAlloc VirtualAlloc LocalFree

user32

EmptyClipboard CloseClipboard OpenClipboard GetCursorPos SetCursorPos ReleaseCapture SetClipboardData SetCursor SetCapture LoadCursorW ClientToScreen GetCapture GetActiveWindow ScreenToClient GetClipboardData GetClientRect GetKeyState GetWindowThreadProcessId DefWindowProcW GetWindow DestroyWindow SetWindowPos CreateWindowExW GetSystemMetrics UnregisterClassW RegisterClassExW ShowWindow GetAsyncKeyState DispatchMessageW PeekMessageW GetWindowTextA GetForegroundWindow TranslateMessage mouse_event SetWindowLongW PostQuitMessage FindWindowA UpdateWindow

shell32

ShellExecuteW

msvcp140

?_Winerror_map@std@@YAHH@Z ?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A ?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z ?_Xlength_error@std@@YAXPEBD@Z ?_Syserror_map@std@@YAPEBDH@Z _Cnd_do_broadcast_at_thread_exit _Thrd_detach ?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z ?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z ?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z ??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ ?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ ?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z ?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z ?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z ?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ ??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ ??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ ?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ ??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z ?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z ?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z ??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ ?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ ?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z ?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z ??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ ??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_N@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z ??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z ??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEA_N@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAH@Z ??5?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@AEAM@Z ?always_noconv@codecvt_base@std@@QEBA_NXZ ??Bid@locale@std@@QEAA_KXZ ?_Xout_of_range@std@@YAXPEBD@Z ?uncaught_exception@std@@YA_NXZ ?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ ?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A ?_Throw_Cpp_error@std@@YAXH@Z ??1_Lockit@std@@QEAA@XZ ??0_Lockit@std@@QEAA@H@Z

imm32

ImmSetCompositionWindow ImmGetContext ImmReleaseContext

dwmapi

DwmExtendFrameIntoClientArea

d3d9

Direct3DCreate9Ex

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memmove memcpy __std_terminate memcmp _CxxThrowException memset __C_specific_handler __current_exception_context __current_exception __std_exception_copy __std_exception_destroy strstr memchr

api-ms-win-crt-stdio-l1-1-0

_get_stream_buffer_pointers _fseeki64 _set_fmode __stdio_common_vsscanf fputc __p__commode __stdio_common_vsprintf _wfopen fwrite fsetpos ungetc __stdio_common_vfprintf fseek fclose fflush __acrt_iob_func setvbuf fread __stdio_common_vsprintf_s fgetpos ftell fgetc

api-ms-win-crt-string-l1-1-0

strcmp strncpy isprint

api-ms-win-crt-utility-l1-1-0

qsort

api-ms-win-crt-heap-l1-1-0

free malloc _callnewh _set_new_mode

api-ms-win-crt-convert-l1-1-0

atof

api-ms-win-crt-runtime-l1-1-0

abort _configure_narrow_argv _invalid_parameter_noinfo_noreturn _initialize_narrow_environment _initialize_onexit_table _register_onexit_function _crt_atexit _cexit _seh_filter_exe _set_app_type terminate system _get_initial_narrow_environment _initterm _initterm_e _register_thread_local_exe_atexit_callback _beginthreadex _c_exit __p___argv __p___argc exit _exit

api-ms-win-crt-math-l1-1-0

atanf ceilf tanf cosf __setusermatherr floorf fmodf pow powf sinf atan2f sqrtf asinf

api-ms-win-crt-conio-l1-1-0

_getch

api-ms-win-crt-filesystem-l1-1-0

_unlock_file _lock_file

api-ms-win-crt-locale-l1-1-0

___lc_codepage_func _configthreadlocale

api-ms-win-crt-environment-l1-1-0

_dupenv_s