C:\Source\ThoramiBot\x64\Release\ThoramiBot.pdb
Static task
static1
Behavioral task
behavioral1
Sample
ROCKET LEAGUE/SF-Community.dll
Resource
win7-20240704-en
Behavioral task
behavioral2
Sample
ROCKET LEAGUE/SF-Community.dll
Resource
win10v2004-20240704-en
General
-
Target
ROCKET_LEAGUE.rar
-
Size
2.2MB
-
MD5
8eaf91294849d89a4c16a31362baf1f7
-
SHA1
4842ee83fdd2629e0ecd83515791926fb8d8a445
-
SHA256
767c0cb0291c70aec9aac7e53c1c6df99cf23d351968f83e6132fa11a532d162
-
SHA512
f226e908ba80f4d3c82b2522590fc689c42b92e6212b028df5705117e5d9b2cb11648474969216182c8f708e526a7b514a6b3af88ee118b26de0c484bf8a1471
-
SSDEEP
49152:U3s0LJTo0l+ByIzFhnI/yAn8qSskMEvKnL9VlNfQq+r7cskfTF6airsBO:G5lYJzFu18oL9tfQDosomL
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/ROCKET LEAGUE/SF-Community.dll
Files
-
ROCKET_LEAGUE.rar.rar
-
ROCKET LEAGUE/SF-Community.dll.dll windows:6 windows x64 arch:x64
787d05b656fd44d1d06523f727973d75
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
SizeofResource
FreeResource
GetModuleHandleExW
GetCurrentProcess
GetModuleHandleW
K32GetModuleInformation
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
SleepConditionVariableSRW
FreeLibraryAndExitThread
ExitThread
CreateThread
FormatMessageA
WideCharToMultiByte
MultiByteToWideChar
QueryPerformanceCounter
QueryPerformanceFrequency
InitOnceComplete
InitOnceBeginInitialize
GetStringTypeW
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LocalFree
GetLocaleInfoEx
LCMapStringEx
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
InitializeSRWLock
TryAcquireSRWLockExclusive
WakeConditionVariable
GetSystemTimeAsFileTime
GetProcAddress
GetCPInfo
CloseHandle
InitializeCriticalSectionAndSpinCount
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
LockResource
GetStartupInfoW
GetCurrentThreadId
InitializeSListHead
RtlUnwindEx
InterlockedFlushSList
RtlPcToFileHeader
RaiseException
GetLastError
SetLastError
TlsAlloc
TlsGetValue
TlsSetValue
TlsFree
FreeLibrary
LoadLibraryExW
RtlUnwind
ExitProcess
GetModuleFileNameW
GetCurrentThread
HeapAlloc
HeapFree
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetStdHandle
GetFileType
GetFileSizeEx
SetFilePointerEx
GetTimeZoneInformation
FlushFileBuffers
WriteFile
GetConsoleOutputCP
GetConsoleMode
ReadFile
ReadConsoleW
HeapReAlloc
FindClose
FindFirstFileExW
FindNextFileW
IsValidCodePage
GetACP
GetOEMCP
GetCommandLineA
GetCommandLineW
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
CreateFileW
HeapSize
WriteConsoleW
SetEndOfFile
OutputDebugStringW
FindFirstFileW
GetCurrentDirectoryW
CreateDirectoryW
GetModuleFileNameA
RemoveDirectoryW
GetFinalPathNameByHandleW
GetEnvironmentVariableA
WaitForSingleObject
GetFileAttributesW
UnmapViewOfFile
GetModuleHandleA
Sleep
FormatMessageW
GetFileAttributesA
GetLogicalProcessorInformationEx
DeleteFileW
GetSystemInfo
SetThreadGroupAffinity
CreateDirectoryA
DebugBreak
CreateFileMappingW
MapViewOfFile
LoadResource
FindResourceW
IsDebuggerPresent
GetCurrentProcessId
GetNativeSystemInfo
GetFileInformationByHandle
PeekNamedPipe
SystemTimeToTzSpecificLocalTime
FileTimeToSystemTime
user32
CallWindowProcW
GetWindowLongPtrW
SetWindowLongPtrW
IsWindow
EnumWindows
GetWindowThreadProcessId
advapi32
EventRegister
EventUnregister
EventWriteTransfer
shlwapi
PathFindNextComponentW
PathSkipRootW
PathRemoveBackslashW
Sections
.text Size: 1.6MB - Virtual size: 1.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 272KB - Virtual size: 272KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 15KB - Virtual size: 30KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 64KB - Virtual size: 63KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: 4KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1.8MB - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 8KB - Virtual size: 7KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ