C:\buildslave\sdk-windows-i386\build\built1.10\bin\pstats.pdb
Static task
static1
Behavioral task
behavioral1
Sample
13b9af49a68a7de9b07d6fa27431cfba06c6b9c669e9279f20a8594103186a26.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
13b9af49a68a7de9b07d6fa27431cfba06c6b9c669e9279f20a8594103186a26.exe
Resource
win10v2004-20240319-en
General
-
Target
13b9af49a68a7de9b07d6fa27431cfba06c6b9c669e9279f20a8594103186a26
-
Size
276KB
-
MD5
69924fc8b9a84725b844d862b2e31ee1
-
SHA1
800b8707755bd1a3f348ef5e2aa009a6728e855e
-
SHA256
13b9af49a68a7de9b07d6fa27431cfba06c6b9c669e9279f20a8594103186a26
-
SHA512
5395be4b6fb05aca5986e3043f44c3b873efd4afa34acdb872313fcc34ca4823893b18306e55c0ad5a96f70f35ab98dafdac4aef6caef6373bdb19275f63d014
-
SSDEEP
6144:xOtS5QnPQclLYH/3ncoyVwPAdIYt+Mk2u:xwXPQclLYH/3co9m
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource 13b9af49a68a7de9b07d6fa27431cfba06c6b9c669e9279f20a8594103186a26
Files
-
13b9af49a68a7de9b07d6fa27431cfba06c6b9c669e9279f20a8594103186a26.exe windows:5 windows x86 arch:x86
b73034f95436e309986006ca890fc51b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_32BIT_MACHINE
PDB Paths
Imports
libpanda
?get_net_time@PStatFrameData@@QBENXZ
?get_end@PStatFrameData@@QBENXZ
?get_start@PStatFrameData@@QBENXZ
?is_empty@PStatFrameData@@QBE_NXZ
?get_host_name@ConnectionManager@@SA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@XZ
?close_connection@ConnectionManager@@QAE_NABV?$PointerTo@VConnection@@@@@Z
?open_TCP_server_rendezvous@ConnectionManager@@QAE?AV?$PointerTo@VConnection@@@@GH@Z
?open_UDP_connection@ConnectionManager@@QAE?AV?$PointerTo@VConnection@@@@G@Z
??1ConnectionManager@@UAE@XZ
??0ConnectionManager@@QAE@XZ
??0ConnectionListener@@QAE@PAVConnectionManager@@HABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??1PStatCollectorDef@@QAE@XZ
??0PStatCollectorDef@@QAE@HABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?set_tcp_header_size@ConnectionWriter@@QAEXH@Z
?send@ConnectionWriter@@QAE_NABVDatagram@@ABV?$PointerTo@VConnection@@@@_N@Z
??1ConnectionWriter@@QAE@XZ
??0ConnectionWriter@@QAE@PAVConnectionManager@@HABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
?get_connection@NetDatagram@@QBE?AV?$PointerTo@VConnection@@@@XZ
?set_tcp_header_size@ConnectionReader@@QAEXH@Z
?poll@ConnectionReader@@QAEXXZ
?add_connection@ConnectionReader@@QAE_NPAVConnection@@@Z
??1ConnectionReader@@UAE@XZ
??0ConnectionReader@@QAE@PAVConnectionManager@@HABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@Z
??1PStatFrameData@@QAE@XZ
??0PStatClientControlMessage@@QAE@XZ
?decode@PStatClientControlMessage@@QAE_NABVDatagram@@PAVPStatClientVersion@@@Z
??1PStatClientControlMessage@@QAE@XZ
??0PStatServerControlMessage@@QAE@XZ
?get_num_events@PStatFrameData@@QBEIXZ
?get_current_pstat_major_version@@YAHXZ
?get_current_pstat_minor_version@@YAHXZ
?flush_read_connection@ConnectionReader@@MAEXPAVConnection@@@Z
?process_incoming_data@ConnectionListener@@MAE_NPAVSocketInfo@ConnectionReader@@@Z
?process_incoming_data@ConnectionReader@@MAE_NPAVSocketInfo@1@@Z
?process_incoming_tcp_data@ConnectionReader@@MAE_NPAVSocketInfo@1@@Z
?process_incoming_udp_data@ConnectionReader@@MAE_NPAVSocketInfo@1@@Z
?process_raw_incoming_tcp_data@ConnectionReader@@MAE_NPAVSocketInfo@1@@Z
?process_raw_incoming_udp_data@ConnectionReader@@MAE_NPAVSocketInfo@1@@Z
?receive_datagram@ConnectionListener@@MAEXABVNetDatagram@@@Z
?_zero@LVecBase3f@@0V1@B
?pstats_target_frame_rate@@3VConfigVariableDouble@@A
?pstats_scroll_mode@@3VConfigVariableBool@@A
?pstats_history@@3VConfigVariableDouble@@A
?pstats_average_time@@3VConfigVariableDouble@@A
?set_collect_tcp@Connection@@QAEX_N@Z
?output@NetAddress@@QBEXAAV?$basic_ostream@DU?$char_traits@D@std@@@std@@@Z
??0BitArray@@QAE@$$QAV0@@Z
??0BitArray@@QAE@ABV0@@Z
??1BitArray@@QAE@XZ
?set_bit_to@BitArray@@QAEXH_N@Z
?get_bit@BitArray@@QBE_NH@Z
?get_num_bits@BitArray@@QBEIXZ
??0BitArray@@QAE@XZ
??1PStatClientVersion@@UAE@XZ
??0PStatClientVersion@@QAE@XZ
?pstats_port@@3VConfigVariableInt@@A
?get_time_collector@PStatFrameData@@QBEHI@Z
?is_start@PStatFrameData@@QBE_NI@Z
?get_time@PStatFrameData@@QBENI@Z
?get_num_levels@PStatFrameData@@QBEIXZ
?get_level_collector@PStatFrameData@@QBEHI@Z
?get_level@PStatFrameData@@QBENI@Z
?read_datagram@PStatFrameData@@QAEXAAVDatagramIterator@@PAVPStatClientVersion@@@Z
?encode@PStatServerControlMessage@@QBEXAAVDatagram@@@Z
??0PStatFrameData@@QAE@XZ
??1PStatServerControlMessage@@QAE@XZ
?flush_read_connection@ConnectionManager@@MAEXPAVConnection@@@Z
libpandaexpress
?init_memory_usage@MemoryUsage@@CAXXZ
?ns_update_type@MemoryUsage@@AAEXPAXVTypeHandle@@@Z
?error@?$NotifyCategoryProxy@VNotifyCategoryGetCategory_express@@@@QAEAAV?$basic_ostream@DU?$char_traits@D@std@@@std@@_N@Z
??0ReferenceCount@@IAE@XZ
??1ReferenceCount@@UAE@XZ
?ref@ReferenceCount@@QBEXXZ
?init_type@ReferenceCount@@SAXXZ
??0Datagram@@QAE@XZ
??1Datagram@@UAE@XZ
??0DatagramIterator@@QAE@ABVDatagram@@I@Z
?get_uint8@DatagramIterator@@QAEEXZ
?get_uint16@DatagramIterator@@QAEGXZ
?get_uint32@DatagramIterator@@QAEIXZ
?_global_ptr@MemoryUsage@@0PAV1@A
?express_cat@@3V?$NotifyCategoryProxy@VNotifyCategoryGetCategory_express@@@@A
?_type_handle@ReferenceCount@@0VTypeHandle@@A
?unref@ReferenceCount@@UBE_NXZ
libp3dtool
?size@?$vector@HV?$pallocator_array@H@@@std@@QBEIXZ
??A?$vector@HV?$pallocator_array@H@@@std@@QBEABHI@Z
?deallocate@DeletedBufferChain@@QAEXPAXVTypeHandle@@@Z
?memory_hook@@3PAVMemoryHook@@A
?pvector_type_handle@@3VTypeHandle@@A
?pmap_type_handle@@3VTypeHandle@@A
?pset_type_handle@@3VTypeHandle@@A
?allocate@DeletedBufferChain@@QAEPAXIVTypeHandle@@@Z
??A?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$pallocator_array@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@@@std@@QBEABV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@1@I@Z
?push_back@?$vector@HV?$pallocator_array@H@@@std@@QAEX$$QAH@Z
?begin@?$vector@HV?$pallocator_array@H@@@std@@QAE?AV?$_Vector_iterator@V?$_Vector_val@U?$_Simple_types@H@std@@@std@@@2@XZ
?end@?$vector@HV?$pallocator_array@H@@@std@@QAE?AV?$_Vector_iterator@V?$_Vector_val@U?$_Simple_types@H@std@@@std@@@2@XZ
?init_memory_hook@@YAXXZ
?get_deleted_chain@MemoryHook@@QAEPAVDeletedBufferChain@@I@Z
?allocate_array@TypeHandle@@QAEPAXI@Z
?plist_type_handle@@3VTypeHandle@@A
?pdeque_type_handle@@3VTypeHandle@@A
??1?$pvector@M@@QAE@XZ
??0?$pvector@M@@QAE@VTypeHandle@@@Z
?erase@?$vector@MV?$pallocator_array@M@@@std@@QAE?AV?$_Vector_iterator@V?$_Vector_val@U?$_Simple_types@M@std@@@std@@@2@V?$_Vector_const_iterator@V?$_Vector_val@U?$_Simple_types@M@std@@@std@@@2@@Z
??3MemoryBase@@SAXPAX@Z
?size@?$vector@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$pallocator_array@V?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@@@@std@@QBEIXZ
??2MemoryBase@@SAPAXI@Z
?push_back@?$vector@MV?$pallocator_array@M@@@std@@QAEXABM@Z
??A?$vector@MV?$pallocator_array@M@@@std@@QAEAAMI@Z
??A?$vector@MV?$pallocator_array@M@@@std@@QBEABMI@Z
?size@?$vector@MV?$pallocator_array@M@@@std@@QBEIXZ
?end@?$vector@MV?$pallocator_array@M@@@std@@QBE?AV?$_Vector_const_iterator@V?$_Vector_val@U?$_Simple_types@M@std@@@std@@@2@XZ
?begin@?$vector@MV?$pallocator_array@M@@@std@@QBE?AV?$_Vector_const_iterator@V?$_Vector_val@U?$_Simple_types@M@std@@@std@@@2@XZ
?begin@?$vector@MV?$pallocator_array@M@@@std@@QAE?AV?$_Vector_iterator@V?$_Vector_val@U?$_Simple_types@M@std@@@std@@@2@XZ
?empty@?$vector@HV?$pallocator_array@H@@@std@@QBE_NXZ
??1?$pvector@H@@QAE@XZ
??0?$pvector@H@@QAE@VTypeHandle@@@Z
?clear@?$vector@HV?$pallocator_array@H@@@std@@QAEXXZ
?push_back@?$vector@HV?$pallocator_array@H@@@std@@QAEXABH@Z
??A?$vector@HV?$pallocator_array@H@@@std@@QAEAAHI@Z
?deallocate_array@TypeHandle@@QAEXPAX@Z
libp3dtoolconfig
?out@Notify@@SAAAV?$basic_ostream@DU?$char_traits@D@std@@@std@@XZ
?assert_failure@Notify@@QAE_NPBDH0@Z
?output@ConfigVariableBase@@QBEXAAV?$basic_ostream@DU?$char_traits@D@std@@@std@@@Z
?reload_value@ConfigVariableBool@@ABEXXZ
??BConfigVariableInt@@QBEHXZ
??BConfigVariableDouble@@QBENXZ
?_global_modified@ConfigFlags@@0HC
?ptr@Notify@@SAPAV1@XZ
user32
GetWindowInfo
LoadCursorA
SetWindowLongA
GetWindowLongA
FrameRect
FillRect
GetCursorPos
SetCursor
MessageBoxA
AdjustWindowRect
GetClientRect
SetWindowTextA
InvalidateRect
EndPaint
BeginPaint
ReleaseDC
GetDC
SetForegroundWindow
SetMenuItemInfoA
InsertMenuItemA
DeleteMenu
GetMenuItemCount
CreatePopupMenu
CreateMenu
DrawMenuBar
SetTimer
ReleaseCapture
SetCapture
SetWindowPos
ShowWindow
DestroyWindow
CreateWindowExA
RegisterClassA
PostQuitMessage
DefWindowProcA
SendMessageA
DispatchMessageA
TranslateMessage
GetMessageA
DrawEdge
TrackMouseEvent
kernel32
IsProcessorFeaturePresent
QueryPerformanceCounter
GetCurrentProcessId
GetCurrentThreadId
GetSystemTimeAsFileTime
InitializeSListHead
IsDebuggerPresent
UnhandledExceptionFilter
SetUnhandledExceptionFilter
GetStartupInfoW
GetModuleHandleW
GetModuleHandleA
GetCurrentProcess
TerminateProcess
gdi32
CreateCompatibleDC
SetBrushOrgEx
TextOutA
MoveToEx
SetTextAlign
SetTextColor
SetBkMode
SetBkColor
SelectObject
LineTo
GetTextExtentPoint32A
GetStockObject
DeleteObject
DeleteDC
CreateSolidBrush
BitBlt
CreateCompatibleBitmap
CreatePen
msvcp140
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAEHD@Z
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAE@XZ
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAE@XZ
?_Ios_base_dtor@ios_base@std@@CAXPAV12@@Z
?_Xout_of_range@std@@YAXPBD@Z
?_Xlength_error@std@@YAXPBD@Z
?_Xbad_alloc@std@@YAXXZ
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QAE_JPBD_J@Z
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IAEPADXZ
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IAE@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QAE@PAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UAE@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV01@H@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QAEAAV12@XZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UAEXXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEXABVlocale@2@@Z
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEPAV12@PAD_J@Z
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JXZ
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAEHXZ
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPAD_J@Z
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MAE_JPBD_J@Z
?_BADOFF@std@@3_JB
??_7ios_base@std@@6B@
??_7?$basic_ios@DU?$char_traits@D@std@@@std@@6B@
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QAEXH_N@Z
vcruntime140
memmove
memcpy
memset
_purecall
__std_exception_copy
__std_exception_destroy
_CxxThrowException
_except_handler4_common
api-ms-win-crt-runtime-l1-1-0
_controlfp_s
_set_app_type
_initialize_onexit_table
exit
_register_onexit_function
_invalid_parameter_noinfo_noreturn
_seh_filter_exe
_configure_narrow_argv
_initialize_narrow_environment
_get_narrow_winmain_command_line
_initterm
_initterm_e
_exit
_cexit
_c_exit
_register_thread_local_exe_atexit_callback
_crt_atexit
terminate
api-ms-win-crt-stdio-l1-1-0
_set_fmode
__p__commode
__stdio_common_vsprintf
api-ms-win-crt-utility-l1-1-0
srand
rand
api-ms-win-crt-math-l1-1-0
__setusermatherr
floor
api-ms-win-crt-heap-l1-1-0
_set_new_mode
malloc
_callnewh
free
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
Sections
.text Size: 105KB - Virtual size: 104KB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 20KB - Virtual size: 19KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 512B - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.gfids Size: 512B - Virtual size: 80B
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 144KB - Virtual size: 144KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 5KB - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ