valorant[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
valorant.exe
Size 655KB
Sample260803-qctppsyfpc
SHA256 23b3b039cbfb06f5d2f6ba91af103559161dc5db495eaaadcddf1fb88415d64b
MD5 312d50625601b9063d4731e00234ca4c
SHA1 31e1410a55362a0917ed5b66e2f1e8bbf45970b6
SHA512 8f6a861522dc5a2e13d86834d44d927a586685887051863da343646bb6320b0fc4a21853e8b3d4e7d6de4270dfed49263fa7a4af8862f16f148648a2cff5940d
SSDEEP 6144:eYBmBMaO3dfL3bjA/eXMJEPf1op3ATF625amoJN3hTTZxj67NVzH+AIuRvIR:9BmWfL3uEFoYQN35b+rSXuRvI
TLSH
T163E43A0BEBB602F5D4BAC039C652612AFD7178A68370A7C757915B571B32BE4AB3D300
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
valorant.exe

File Explorer

valorant.exe

.exe 655KB

valorant.exe

IMPHASH a1b0898753b6482d02039623471d4373
SHA256 23b3b039cbfb06f5d2f6ba91af103559161dc5db495eaaadcddf1fb88415d64b
MD5 312d50625601b9063d4731e00234ca4c
SHA1 31e1410a55362a0917ed5b66e2f1e8bbf45970b6
SHA512 8f6a861522dc5a2e13d86834d44d927a586685887051863da343646bb6320b0fc4a21853e8b3d4e7d6de4270dfed49263fa7a4af8862f16f148648a2cff5940d
SSDEEP 6144:eYBmBMaO3dfL3bjA/eXMJEPf1op3ATF625amoJN3hTTZxj67NVzH+AIuRvIR:9BmWfL3uEFoYQN35b+rSXuRvI
TLSH
T163E43A0BEBB602F5D4BAC039C652612AFD7178A68370A7C757915B571B32BE4AB3D300
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

658432

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

winhttp

WinHttpCloseHandle WinHttpConnect WinHttpReadData WinHttpQueryDataAvailable WinHttpSetTimeouts WinHttpOpenRequest WinHttpAddRequestHeaders WinHttpSendRequest WinHttpOpen WinHttpReceiveResponse WinHttpQueryHeaders

bcrypt

BCryptGetProperty BCryptSetProperty BCryptCloseAlgorithmProvider BCryptGenerateSymmetricKey BCryptEncrypt BCryptDecrypt BCryptDestroyKey BCryptOpenAlgorithmProvider

crypt32

CryptStringToBinaryA CryptBinaryToStringA

advapi32

CryptDestroyHash CryptHashData CryptCreateHash CryptGenRandom CryptGetHashParam CryptReleaseContext CryptAcquireContextA LookupPrivilegeValueW AdjustTokenPrivileges OpenProcessToken

kernel32

IsValidCodePage ReadConsoleInputW GetACP SetConsoleMode GetFileAttributesExW CreateProcessW GetOEMCP FindClose FindFirstFileExW FindNextFileW GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW SetStdHandle HeapSize WriteConsoleW SetEndOfFile GetStdHandle CreateFileW DeleteFileA FlushFileBuffers ReadFile WriteFile CloseHandle GetLastError ConnectNamedPipe DisconnectNamedPipe CreateNamedPipeW HeapAlloc HeapFree GetProcessHeap CancelIoEx ReleaseMutex WaitForSingleObject CreateMutexA Sleep GetCurrentProcess OpenProcess GetSystemInfo GetTickCount VirtualQueryEx ReadProcessMemory GetModuleFileNameA CreateFileMappingA SetConsoleCtrlHandler GetConsoleScreenBufferInfo SetConsoleTextAttribute WriteConsoleOutputCharacterA SetConsoleTitleA GetConsoleWindow CreateToolhelp32Snapshot Process32FirstW Process32NextW QueryPerformanceCounter QueryPerformanceFrequency GetSystemTimePreciseAsFileTime GetCurrentThreadId ReleaseSRWLockExclusive AcquireSRWLockExclusive SleepConditionVariableSRW WideCharToMultiByte EnterCriticalSection LeaveCriticalSection InitializeCriticalSectionEx DeleteCriticalSection RtlUnwind WakeAllConditionVariable EncodePointer DecodePointer CompareStringEx MultiByteToWideChar GetCPInfo LCMapStringEx GetStringTypeW GetExitCodeProcess HeapReAlloc ReadConsoleW SetFilePointerEx SetUnhandledExceptionFilter GetStartupInfoW GetModuleHandleW GetCurrentProcessId GetSystemTimeAsFileTime InitializeSListHead RtlPcToFileHeader RaiseException RtlLookupFunctionEntry RtlUnwindEx SetLastError FlsAlloc FlsGetValue FlsSetValue FlsFree CreateThread ExitThread FreeLibrary FreeLibraryAndExitThread GetModuleHandleExW GetConsoleCP IsProcessorFeaturePresent ExitProcess TerminateProcess GetProcAddress GetModuleFileNameW GetCommandLineA GetCommandLineW RtlCaptureContext RtlVirtualUnwind IsDebuggerPresent UnhandledExceptionFilter GetTimeZoneInformation VirtualProtect LoadLibraryExW GetDateFormatW GetTimeFormatW CompareStringW LCMapStringW GetLocaleInfoW IsValidLocale GetUserDefaultLCID EnumSystemLocalesW GetFileType GetConsoleOutputCP GetConsoleMode GetFileSizeEx

user32

GetAsyncKeyState GetForegroundWindow

Name

.text

Size

471KB

Virtual Size

470KB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

105KB

Virtual Size

104KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

7KB

Virtual Size

17KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

30KB

Virtual Size

29KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

40KB

Virtual Size

91KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Sharing

General

Malware Config

Signatures

File Explorer

valorant.exe

winhttp

bcrypt

crypt32

advapi32

kernel32

user32

generic