C:\Users\rayma\OneDrive\Документи\Visual Studios\Crab Game\1hAck Mod Menu\x64\Release\Crab Game Mod Menu - 1hAck v3.0.pdb
Static task
static1
Behavioral task
behavioral1
Sample
crab.dll
Resource
win7-20240215-en
Behavioral task
behavioral2
Sample
crab.dll
Resource
win10v2004-20240226-en
General
-
Target
crab.dll
-
Size
1.6MB
-
MD5
d1ef439db527bd5e26667227a8fc4fac
-
SHA1
6b64931ecf011524a10685f5753523935c4b7a46
-
SHA256
d57211abf3fd955ea6edfd068f00d20eac3779cebae6d040a89722625512917c
-
SHA512
e58077dad253acb64c0dfd9d6b3dc6a05aa8ac6eb555bc492b1908868a20c6b0f146e1323d1ef46a04c4d341a4b88db277763f1d2685112fe029a2659bfb0f22
-
SSDEEP
49152:Rald+79dBIlwM/8LdJME5LvhRIFfEr1Uam7DdCqn:L9dBIlwM/8LTvLs46am7
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource crab.dll
Files
-
crab.dll.dll windows:6 windows x64 arch:x64
ef36360e1f78db234f782f6628efba60
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DLL
PDB Paths
Imports
kernel32
GlobalUnlock
QueryPerformanceFrequency
QueryPerformanceCounter
VirtualFree
VirtualAlloc
GetSystemInfo
VirtualQuery
HeapCreate
HeapFree
Thread32Next
Thread32First
GetCurrentThreadId
SuspendThread
ResumeThread
CreateToolhelp32Snapshot
Sleep
HeapReAlloc
CloseHandle
HeapAlloc
HeapDestroy
GetThreadContext
GetCurrentProcessId
GetModuleHandleW
FlushInstructionCache
SetThreadContext
OpenThread
FindFirstFileW
DisableThreadLibraryCalls
CreateFileW
FindClose
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
GlobalFree
SetFileInformationByHandle
AreFileApisANSI
GetLastError
GetFileInformationByHandleEx
WideCharToMultiByte
LocalFree
FormatMessageA
FreeLibrary
GetModuleFileNameA
LoadLibraryExA
EnterCriticalSection
GlobalAlloc
GetCurrentProcess
ReadProcessMemory
LeaveCriticalSection
InitializeCriticalSectionAndSpinCount
DeleteCriticalSection
SetEvent
ResetEvent
WaitForSingleObjectEx
CreateEventW
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
UnhandledExceptionFilter
SetUnhandledExceptionFilter
TerminateProcess
IsProcessorFeaturePresent
IsDebuggerPresent
GetSystemTimeAsFileTime
VirtualProtect
CreateThread
GlobalLock
GetProcAddress
GetModuleHandleA
InitializeSListHead
user32
MessageBoxW
SetCursorPos
GetForegroundWindow
SetClipboardData
GetClipboardData
GetCursorPos
CloseClipboard
OpenClipboard
ReleaseCapture
GetClientRect
SetCursor
SetCapture
MessageBoxA
SendInput
mouse_event
GetAsyncKeyState
EmptyClipboard
IsChild
GetSystemMetrics
GetWindowRect
FindWindowA
SetWindowLongPtrA
CallWindowProcA
DestroyWindow
DefWindowProcA
CreateWindowExA
UnregisterClassA
RegisterClassExA
GetKeyState
LoadCursorA
ScreenToClient
GetCapture
ClientToScreen
comdlg32
GetOpenFileNameW
GetSaveFileNameW
shell32
SHGetPathFromIDListW
ShellExecuteW
ShellExecuteA
SHBrowseForFolderW
msvcp140
?_Xout_of_range@std@@YAXPEBD@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEBDHH@Z
??1_Lockit@std@@QEAA@XZ
??0_Lockit@std@@QEAA@H@Z
?_Getgloballocale@locale@std@@CAPEAV_Locimp@12@XZ
??Bid@locale@std@@QEAA_KXZ
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z
?id@?$codecvt@DDU_Mbstatet@@@std@@2V0locale@2@A
?uncaught_exception@std@@YA_NXZ
?showmanyc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JXZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
?_Getcat@?$codecvt@DDU_Mbstatet@@@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?getloc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEBA?AVlocale@2@XZ
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?unshift@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEAD1AEAPEAD@Z
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
?_Init@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAXXZ
?in@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?out@?$codecvt@DDU_Mbstatet@@@std@@QEBAHAEAU_Mbstatet@@PEBD1AEAPEBDPEAD3AEAPEAD@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
??0?$basic_ios@DU?$char_traits@D@std@@@std@@IEAA@XZ
??0?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?clear@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?_Fiopen@std@@YAPEAU_iobuf@@PEB_WHH@Z
??0?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@_N@Z
?read@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEAD_J@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@V?$fpos@U_Mbstatet@@@2@@Z
?seekg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@_JH@Z
?tellg@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA?AV?$fpos@U_Mbstatet@@@2@XZ
?_Syserror_map@std@@YAPEBDH@Z
?_Winerror_map@std@@YAHH@Z
?sbumpc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHXZ
?_Xbad_function_call@std@@YAXXZ
?_Xbad_alloc@std@@YAXXZ
_Xtime_get_ticks
?_Decref@facet@locale@std@@UEAAPEAV_Facet_base@3@XZ
?_Init@locale@std@@CAPEAV_Locimp@12@_N@Z
?_Incref@facet@locale@std@@UEAAXXZ
?_Getcat@?$ctype@D@std@@SA_KPEAPEBVfacet@locale@2@PEBV42@@Z
??1_Locinfo@std@@QEAA@XZ
??0_Locinfo@std@@QEAA@PEBD@Z
??1facet@locale@std@@MEAA@XZ
??0facet@locale@std@@IEAA@_K@Z
?id@?$ctype@D@std@@2V0locale@2@A
?id@?$collate@D@std@@2V0locale@2@A
_Strxfrm
_Strcoll
?_Getcoll@_Locinfo@std@@QEBA?AU_Collvec@@XZ
?tolower@?$ctype@D@std@@QEBADD@Z
?_Xregex_error@std@@YAXW4error_type@regex_constants@1@@Z
?tolower@?$ctype@D@std@@QEBAPEBDPEADPEBD@Z
_Thrd_sleep
_Query_perf_counter
_Query_perf_frequency
?setw@std@@YA?AU?$_Smanip@_J@1@_J@Z
?uflow@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?imbue@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAXAEBVlocale@2@@Z
?sync@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAHXZ
?setbuf@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAAPEAV12@PEAD_J@Z
?_Unlock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
?_Lock@?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAAXXZ
??1?$basic_iostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??0?$basic_iostream@DU?$char_traits@D@std@@@std@@QEAA@PEAV?$basic_streambuf@DU?$char_traits@D@std@@@1@@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAVios_base@1@AEAV21@@Z@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
?write@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@PEBD_J@Z
?_Xlength_error@std@@YAXPEBD@Z
?always_noconv@codecvt_base@std@@QEBA_NXZ
??1?$basic_ostream@DU?$char_traits@D@std@@@std@@UEAA@XZ
??1?$basic_streambuf@DU?$char_traits@D@std@@@std@@UEAA@XZ
?_Pninc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAAPEADXZ
??1?$basic_ios@DU?$char_traits@D@std@@@std@@UEAA@XZ
?xsputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEBD_J@Z
?xsgetn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@MEAA_JPEAD_J@Z
??1?$basic_istream@DU?$char_traits@D@std@@@std@@UEAA@XZ
urlmon
URLDownloadToFileA
imm32
ImmGetContext
ImmSetCompositionWindow
ImmReleaseContext
d3dcompiler_43
D3DCompile
xinput1_3
ord4
ord2
vcruntime140_1
__CxxFrameHandler4
vcruntime140
memmove
__std_terminate
__std_exception_destroy
__std_exception_copy
strchr
strstr
memcpy
__std_type_info_destroy_list
_CxxThrowException
__intrinsic_setjmp
__current_exception_context
__current_exception
__C_specific_handler
strrchr
memchr
memset
memcmp
longjmp
api-ms-win-crt-runtime-l1-1-0
system
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit
_cexit
exit
_initterm
_initterm_e
terminate
_invalid_parameter_noinfo_noreturn
_wassert
_errno
_invalid_parameter_noinfo
abort
strerror
api-ms-win-crt-stdio-l1-1-0
ferror
clearerr
fgets
fopen
_wfopen
freopen
fgetc
fseek
__acrt_iob_func
ftell
fputc
ungetc
getc
__stdio_common_vfprintf
__stdio_common_vsscanf
fflush
setvbuf
fsetpos
_fseeki64
tmpnam
tmpfile
__stdio_common_vsprintf
fgetpos
_popen
_pclose
_ftelli64
feof
fwrite
__stdio_common_vsprintf_s
fclose
_get_stream_buffer_pointers
fread
api-ms-win-crt-time-l1-1-0
_localtime64
clock
_difftime64
strftime
_gmtime64
_mktime64
_time64
api-ms-win-crt-utility-l1-1-0
rand
srand
qsort
api-ms-win-crt-filesystem-l1-1-0
_lock_file
rename
remove
_unlock_file
api-ms-win-crt-string-l1-1-0
isxdigit
strcpy_s
wcscpy_s
isalpha
isupper
islower
isspace
isalnum
strcoll
strspn
strpbrk
isblank
toupper
ispunct
isgraph
iscntrl
strncpy
tolower
isdigit
strcmp
strncmp
api-ms-win-crt-convert-l1-1-0
strtod
strtoull
atof
strtoll
api-ms-win-crt-locale-l1-1-0
localeconv
___lc_codepage_func
setlocale
api-ms-win-crt-heap-l1-1-0
malloc
free
realloc
_callnewh
calloc
api-ms-win-crt-math-l1-1-0
atan2f
fmod
frexp
floorf
pow
sinf
powf
fmodf
floor
tanh
cosf
_dsign
asinf
_dclass
ldexp
ceilf
sqrtf
acos
asin
atan2
ceil
cos
cosh
exp
log
log10
sin
sinh
sqrt
tan
api-ms-win-crt-environment-l1-1-0
getenv
Sections
.text Size: 1.0MB - Virtual size: 1.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: 497KB - Virtual size: 496KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: 4KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: 41KB - Virtual size: 41KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.rsrc Size: 1KB - Virtual size: 1KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.reloc Size: 3KB - Virtual size: 3KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ