ThoramiBot_[unknowncheats[.]me]_[.]dll

Sharing

Copy URL Twitter E-mail

General

Target

ThoramiBot_[unknowncheats.me]_.dll
Size

3.7MB
MD5

950bb13840fd6d142e2ce9f5c9e10e7c
SHA1

aff4b78a1123fe9a6a5a2805354ae377dd04f359
SHA256

c67ad777dfb8bf340a63ee805927c903454a5d6e48e9324eee7c45fb37074e93
SHA512

a4b95f0a5ccb6b465a0eb9746a96a6043bc0d9ff47790950079c3b6444db73706439bae8b908928e6e53895c1ba7242df6e13bd30e5bc0d24df5bdbb466e253d
SSDEEP

98304:qRkPbVfUiLgwxN0Zq+5MIZ/gqlXwAk9C7ZYFucu3CJGKNi3VSz:qRkTV7jxs5MIhgYwAFZYFucjmA

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
ThoramiBot_[unknowncheats.me]_.dll

Files

ThoramiBot_[unknowncheats.me]_.dll
.dll windows:6 windows x64 arch:x64

787d05b656fd44d1d06523f727973d75

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL

PDB Paths

C:\Source\ThoramiBot\x64\Release\ThoramiBot.pdb

Imports

kernel32

SizeofResource
FreeResource
GetModuleHandleExW
GetCurrentProcess
GetModuleHandleW
K32GetModuleInformation
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SleepConditionVariableSRW
FreeLibraryAndExitThread
ExitThread
CreateThread
FormatMessageA
WideCharToMultiByte
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
InitOnceComplete
InitOnceBeginInitialize
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LocalFree
GetLocaleInfoEx
LCMapStringEx
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeSRWLock
TryAcquireSRWLockExclusive
WakeConditionVariable
GetSystemTimeAsFileTime
GetProcAddress
GetCPInfo
CloseHandle
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
LockResource
GetStartupInfoW
GetCurrentThreadId
InitializeSListHead
RtlUnwindEx
InterlockedFlushSList
RtlPcToFileHeader
RaiseException
GetLastError
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RtlUnwind
ExitProcess
GetModuleFileNameW
GetCurrentThread
HeapAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
GetFileSizeEx
SetFilePointerEx
GetTimeZoneInformation
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
ReadFile
ReadConsoleW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
CreateFileW
HeapSize
WriteConsoleW
SetEndOfFile
OutputDebugStringW
FindFirstFileW
GetCurrentDirectoryW
CreateDirectoryW
GetModuleFileNameA
RemoveDirectoryW
GetFinalPathNameByHandleW
GetEnvironmentVariableA
WaitForSingleObject
GetFileAttributesW
UnmapViewOfFile
GetModuleHandleA
Sleep
FormatMessageW
GetFileAttributesA
GetLogicalProcessorInformationEx
DeleteFileW
GetSystemInfo
SetThreadGroupAffinity
CreateDirectoryA
DebugBreak
CreateFileMappingW
MapViewOfFile
LoadResource
FindResourceW
IsDebuggerPresent
GetCurrentProcessId
GetNativeSystemInfo
GetFileInformationByHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime

user32

CallWindowProcW
GetWindowLongPtrW
SetWindowLongPtrW
IsWindow
EnumWindows
GetWindowThreadProcessId

advapi32

EventRegister
EventUnregister
EventWriteTransfer

shlwapi

PathFindNextComponentW
PathSkipRootW
PathRemoveBackslashW

Sections

.text
Size: 1.6MB - Virtual size: 1.6MB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 272KB - Virtual size: 272KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 15KB - Virtual size: 30KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 64KB - Virtual size: 63KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

_RDATA
Size: 4KB - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 8KB - Virtual size: 7KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

787d05b656fd44d1d06523f727973d75

Headers

DLL Characteristics

File Characteristics

PDB Paths

Imports

kernel32

user32

advapi32

shlwapi

Sections

.text Size: 1.6MB - Virtual size: 1.6MB

.rdata Size: 272KB - Virtual size: 272KB

.data Size: 15KB - Virtual size: 30KB

.pdata Size: 64KB - Virtual size: 63KB

_RDATA Size: 4KB - Virtual size: 3KB

.rsrc Size: 1.8MB - Virtual size: 1.8MB

.reloc Size: 8KB - Virtual size: 7KB

.text
Size: 1.6MB - Virtual size: 1.6MB

.rdata
Size: 272KB - Virtual size: 272KB

.data
Size: 15KB - Virtual size: 30KB

.pdata
Size: 64KB - Virtual size: 63KB

_RDATA
Size: 4KB - Virtual size: 3KB

.rsrc
Size: 1.8MB - Virtual size: 1.8MB

.reloc
Size: 8KB - Virtual size: 7KB