ThoramiBot_[unknowncheats[.]me]_[.]dll

Sharing

Copy URL

Twitter E-mail

General

Target

ThoramiBot_[unknowncheats.me]_.dll
Size

3.7MB
MD5

ad4636cf3d8d701fd357a0ce6c609ded
SHA1

f859d9838263253ddbfa708185ef3fe02029e45c
SHA256

4fef4b65e245c9710bd85a88e13dc16a707d34c80cbc30841d306d6002c03895
SHA512

345b6c4b3433786c319b7aba80eb3f06988b153913c32d4bc79c7539e717a136e90fa814166a08343d9fed92d7de05056386004337a1c60d0d984cec900e200f
SSDEEP

98304:VRkPbVfUOLgwxN0Zq+5MIZ/gqlXwAk9C7ZYFucu3CJGKNi3VSz:VRkTVnjxs5MIhgYwAFZYFucjmA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ThoramiBot_[unknowncheats.me]_.dll

Files

ThoramiBot_[unknowncheats.me]_.dll
.dll windows:6 windows x64 arch:x64

787d05b656fd44d1d06523f727973d75

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Source\ThoramiBot\x64\Release\ThoramiBot.pdb

Imports

kernel32

SizeofResource
FreeResource
GetModuleHandleExW
GetCurrentProcess
GetModuleHandleW
K32GetModuleInformation
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SleepConditionVariableSRW
FreeLibraryAndExitThread
ExitThread
CreateThread
FormatMessageA
WideCharToMultiByte
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
InitOnceComplete
InitOnceBeginInitialize
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LocalFree
GetLocaleInfoEx
LCMapStringEx
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeSRWLock
TryAcquireSRWLockExclusive
WakeConditionVariable
GetSystemTimeAsFileTime
GetProcAddress
GetCPInfo
CloseHandle
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
LockResource
GetStartupInfoW
GetCurrentThreadId
InitializeSListHead
RtlUnwindEx
InterlockedFlushSList
RtlPcToFileHeader
RaiseException
GetLastError
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RtlUnwind
ExitProcess
GetModuleFileNameW
GetCurrentThread
HeapAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
GetFileSizeEx
SetFilePointerEx
GetTimeZoneInformation
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
ReadFile
ReadConsoleW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
CreateFileW
HeapSize
WriteConsoleW
SetEndOfFile
OutputDebugStringW
FindFirstFileW
GetCurrentDirectoryW
CreateDirectoryW
GetModuleFileNameA
RemoveDirectoryW
GetFinalPathNameByHandleW
GetEnvironmentVariableA
WaitForSingleObject
GetFileAttributesW
UnmapViewOfFile
GetModuleHandleA
Sleep
FormatMessageW
GetFileAttributesA
GetLogicalProcessorInformationEx
DeleteFileW
GetSystemInfo
SetThreadGroupAffinity
CreateDirectoryA
DebugBreak
CreateFileMappingW
MapViewOfFile
LoadResource
FindResourceW
IsDebuggerPresent
GetCurrentProcessId
GetNativeSystemInfo
GetFileInformationByHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime

user32

CallWindowProcW
GetWindowLongPtrW
SetWindowLongPtrW
IsWindow
EnumWindows
GetWindowThreadProcessId

advapi32

EventRegister
EventUnregister
EventWriteTransfer

shlwapi

PathFindNextComponentW
PathSkipRootW
PathRemoveBackslashW

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 272KB - Virtual size: 272KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

787d05b656fd44d1d06523f727973d75

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shlwapi

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 272KB - Virtual size: 272KB

.data Size: 15KB - Virtual size: 30KB

.pdata Size: 64KB - Virtual size: 63KB

_RDATA Size: 4KB - Virtual size: 3KB

.rsrc Size: 1.8MB - Virtual size: 1.8MB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 272KB - Virtual size: 272KB

.data
Size: 15KB - Virtual size: 30KB

.pdata
Size: 64KB - Virtual size: 63KB

_RDATA
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

.reloc
Size: 8KB - Virtual size: 7KB