Valorant External[.]exe

Sharing

Copy URL Twitter E-mail

General

Target
Valorant External.exe
Size 4.1MB
Sample261107-2rvfbsgd63
SHA256 f4844536b7b54dea60efb84a1952a3f2a8ae7754bb665e2a9fe87c98873cb8f6
MD5 f8a8b72f86ec88f7284cac40b1034feb
SHA1 7efe1d4bbd0c203b75c671467aa2fa9a98bc9b57
SHA512 402eebfac79c9f39bbe9bea55dc974222448aef0948b2818a90ea80534573b091e8294298cb2f079c28e862d93c56704679c0c065920c4dbe432b58146b0700b
SSDEEP 98304:4C7bOjqd48ab1aQxfrDDXvpKoNEonbw7Kn:37Gb8ab1aQxfrDbvqEs7K
TLSH
T14716BE56A3A5D6E8C8239238C512A567EBF5B8094734E6CF22C44D19BF63EF04EBD701
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
Valorant External.exe

File Explorer

Valorant External.exe

.exe 4.1MB

Valorant External.exe

IMPHASH e7e4b27f77cf964f7b735e1b7caeced2
SHA256 f4844536b7b54dea60efb84a1952a3f2a8ae7754bb665e2a9fe87c98873cb8f6
MD5 f8a8b72f86ec88f7284cac40b1034feb
SHA1 7efe1d4bbd0c203b75c671467aa2fa9a98bc9b57
SHA512 402eebfac79c9f39bbe9bea55dc974222448aef0948b2818a90ea80534573b091e8294298cb2f079c28e862d93c56704679c0c065920c4dbe432b58146b0700b
SSDEEP 98304:4C7bOjqd48ab1aQxfrDDXvpKoNEonbw7Kn:37Gb8ab1aQxfrDbvqEs7K
TLSH
T14716BE56A3A5D6E8C8239238C512A567EBF5B8094734E6CF22C44D19BF63EF04EBD701
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

1664892

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

d3d11

D3D11CreateDeviceAndSwapChain

d3dx11_43

D3DX11CreateShaderResourceViewFromMemory

kernel32

GetTickCount WaitForSingleObjectEx GetEnvironmentVariableA GetFileType ReadFile PeekNamedPipe WaitForMultipleObjects GetCurrentProcessId VerifyVersionInfoW GetFileSizeEx GetOEMCP GetACP IsValidCodePage SetEndOfFile SetStdHandle GetTimeZoneInformation CreatePipe FlushFileBuffers EnumSystemLocalesW GetUserDefaultLCID IsValidLocale GetLocaleInfoW LCMapStringW CompareStringW GetTimeFormatW GetDateFormatW FlsFree FlsSetValue FlsGetValue FlsAlloc GetExitCodeProcess WaitForSingleObject GetConsoleOutputCP ReadConsoleW GetCommandLineW GetCommandLineA WriteFile SetFilePointerEx FileTimeToSystemTime SystemTimeToTzSpecificLocalTime GetDriveTypeW VirtualQuery CreateProcessW DuplicateHandle FreeLibraryAndExitThread ExitThread VirtualAlloc ExitProcess LoadLibraryExW LeaveCriticalSection TlsSetValue TlsGetValue TlsAlloc InitializeCriticalSectionAndSpinCount RtlUnwind EnterCriticalSection InitializeCriticalSection AcquireSRWLockExclusive ReleaseSRWLockExclusive FormatMessageW SetLastError QueryFullProcessImageNameW GetModuleFileNameW GetModuleFileNameA UnmapViewOfFile MapViewOfFile CreateFileMappingW VirtualProtect CreateThread GetCurrentProcess DeleteCriticalSection InitializeCriticalSectionEx GetProcessHeap HeapSize HeapFree HeapReAlloc HeapAlloc HeapDestroy AddVectoredExceptionHandler DecodePointer GetLocaleInfoA LoadLibraryA GetProcAddress GetModuleHandleA FreeLibrary QueryPerformanceFrequency QueryPerformanceCounter VerSetConditionMask MultiByteToWideChar GlobalFree GlobalLock GlobalUnlock GlobalAlloc Process32NextW RtlUnwindEx RtlPcToFileHeader RaiseException GetSystemInfo LoadLibraryW GetSystemDirectoryW GetModuleHandleExW LocalFree Process32FirstW CreateToolhelp32Snapshot OutputDebugStringW InitializeSListHead GetStartupInfoW IsDebuggerPresent IsProcessorFeaturePresent GetConsoleWindow SetConsoleTitleA SetConsoleTextAttribute WriteConsoleW SetConsoleCtrlHandler SetConsoleMode GetConsoleMode WideCharToMultiByte MoveFileExW GetModuleHandleW GetWindowsDirectoryW Sleep SleepEx DeviceIoControl GetLastError CloseHandle TerminateProcess SetUnhandledExceptionFilter UnhandledExceptionFilter RtlVirtualUnwind RtlLookupFunctionEntry RtlCaptureContext GetCPInfo GetStringTypeW LCMapStringEx EncodePointer WakeAllConditionVariable GetSystemTimeAsFileTime GetFileInformationByHandleEx AreFileApisANSI SetFileInformationByHandle GetFullPathNameW GetFileInformationByHandle RemoveDirectoryW DeleteFileW CreateFileW GetStdHandle GetEnvironmentStringsW FreeEnvironmentStringsW SetEnvironmentVariableW TlsFree GetFileAttributesExW FindNextFileW FindFirstFileExW FindFirstFileW FindClose FormatMessageA GetLocaleInfoEx GetCurrentThreadId TryAcquireSRWLockExclusive SleepConditionVariableSRW GetCurrentDirectoryW CreateDirectoryW

user32

SetLayeredWindowAttributes GetAsyncKeyState GetSystemMetrics UpdateWindow GetClientRect MessageBoxA GetCursorPos ScreenToClient GetDesktopWindow MonitorFromPoint BlockInput OpenClipboard CloseClipboard SetClipboardData GetClipboardData DestroyWindow GetKeyboardLayout TrackMouseEvent GetMessageExtraInfo GetKeyState GetCapture SetCapture ReleaseCapture IsWindowUnicode GetForegroundWindow GetDC ReleaseDC SetCursorPos SetCursor ClientToScreen LoadCursorW SetProcessDPIAware GetKeyNameTextA MapVirtualKeyA CreateWindowExW ShowWindow EmptyClipboard TranslateMessage DispatchMessageW PeekMessageW DefWindowProcW PostQuitMessage UnregisterClassW RegisterClassExW

gdi32

GetDeviceCaps

advapi32

CryptHashData CloseServiceHandle ControlService CreateServiceW DeleteService OpenSCManagerA OpenSCManagerW OpenProcessToken AddAccessAllowedAce GetLengthSid GetTokenInformation InitializeAcl IsValidSid RegCreateKeyExA RegDeleteKeyA SetSecurityInfo CopySid ConvertSidToStringSidA CryptAcquireContextW CryptReleaseContext CryptGetHashParam OpenServiceW QueryServiceStatusEx CryptCreateHash CryptEncrypt CryptImportKey CryptDestroyKey SystemFunction036 CryptDestroyHash StartServiceW

shell32

ShellExecuteA ShellExecuteW

urlmon

URLDownloadToFileA

imm32

ImmSetCompositionWindow ImmReleaseContext ImmGetContext ImmSetCandidateWindow

d3dcompiler_43

D3DCompile

dwmapi

DwmExtendFrameIntoClientArea

crypt32

CertOpenStore CertCloseStore CertEnumCertificatesInStore CertFreeCertificateContext CryptStringToBinaryW PFXImportCertStore CryptDecodeObjectEx CertAddCertificateContextToStore CertFindExtension CertGetNameStringW CryptQueryObject CertCreateCertificateChainEngine CertFreeCertificateChainEngine CertGetCertificateChain CertFreeCertificateChain CertFindCertificateInStore

ws2_32

WSACloseEvent WSACreateEvent WSAEnumNetworkEvents WSAEventSelect WSAResetEvent WSAWaitForMultipleEvents closesocket WSAGetLastError inet_pton ntohs WSASetLastError inet_ntop WSAStartup WSACleanup bind send getpeername getsockname htons recv setsockopt socket WSAIoctl __WSAFDIsSet select accept htonl listen getaddrinfo freeaddrinfo recvfrom sendto ioctlsocket gethostname connect getsockopt

shlwapi

PathFindFileNameW

psapi

GetModuleInformation

userenv

UnloadUserProfile

bcrypt

BCryptGenRandom

Name

.text

Size

1.8MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

494KB

Virtual Size

493KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.7MB

Virtual Size

1.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

84KB

Virtual Size

84KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.fptable

Size

512B

Virtual Size

256B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.rsrc

Size

512B

Virtual Size

488B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.reloc

Size

8KB

Virtual Size

8KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

File Explorer

Valorant External.exe

d3d11

d3dx11_43

kernel32

user32

gdi32

advapi32

shell32

urlmon

imm32

d3dcompiler_43

dwmapi

crypt32

ws2_32

shlwapi

psapi

userenv

bcrypt

generic