A3DLIBS[.]dll | Triage

Sharing

Copy URL

Twitter E-mail

General

Target

A3DLIBS.dll
Size

810KB
MD5

526251d176a03d43c0e4bf4dcfe03a22
SHA1

adf5cecb7249d369b945fda197132f3e263625a6
SHA256

05b69dea3ebbbc76044aa033b6bfaeed1a55f3e3009feb6944413557745a6d2a
SHA512

bbd01aa595beb3dd71a70799654e08e8d4c8bd5feea3bfb5e470903d5349423cbab791c670cf5dac0262bf961a2c9ad2842de5368e50fb68b1063a800ebe5984
SSDEEP

12288:z36Yk79JxnnGRiyQgwYwDWAO6I49T2lylbbxysxZ72mHbU:mn9LnnGRiyQgwYwDQQTAsvEsxZ72mHbU

Score

1^/10

Malware Config

Signatures

Files

A3DLIBS.dll
.dll windows x64

fe519ead53d342ed5d12950364366f97

Code Sign

0e:8d:5b:d8:e9:b2:32:4f:bd:15:71:81:0d:19:1d:e0
Certificate

Issuer

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

31-01-2019 00:00

Not After

04-02-2021 12:00

Subject

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Photoshop\, Bridge,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

Issuer

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

18-04-2012 12:00

Not After

18-04-2027 12:00

Subject

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageCodeSigning

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

Issuer

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

01-10-2019 00:00

Not After

17-10-2030 00:00

Subject

CN=TIMESTAMP-SHA256-2019-10-15,O=DigiCert\, Inc.,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

Issuer

CN=DigiCert Assured ID Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Not Before

07-01-2016 12:00

Not After

07-01-2031 12:00

Subject

CN=DigiCert SHA2 Assured ID Timestamping CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Extended Key Usages

ExtKeyUsageTimeStamping

Key Usages

KeyUsageDigitalSignature
KeyUsageCertSign
KeyUsageCRLSign

4c:92:b0:f8:77:65:70:d5:0c:9b:cf:10:8f:5e:1c:e9:e8:55:ef:b0:02:62:76:ff:dc:ec:9f:38:90:d8:1c:a5
Signer

Actual PE Digest

4c:92:b0:f8:77:65:70:d5:0c:9b:cf:10:8f:5e:1c:e9:e8:55:ef:b0:02:62:76:ff:dc:ec:9f:38:90:d8:1c:a5

Digest Algorithm

sha256

PE Digest Matches

true

Signature Validations

Trusted

true

Verification

Signing Certificate

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Photoshop\, Bridge,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

07-10-2020 02:05
Valid: true

Chain 1

SERIALNUMBER=2748129,CN=Adobe Inc.,OU=Photoshop\, Bridge,O=Adobe Inc.,L=San Jose,ST=ca,C=US,2.5.4.15=#131450726976617465204f7267616e697a6174696f6e,1.3.6.1.4.1.311.60.2.1.2=#130844656c6177617265,1.3.6.1.4.1.311.60.2.1.3=#13025553

CN=DigiCert EV Code Signing CA (SHA2),OU=www.digicert.com,O=DigiCert Inc,C=US

CN=DigiCert High Assurance EV Root CA,OU=www.digicert.com,O=DigiCert Inc,C=US

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

kernel32

WideCharToMultiByte
SetCurrentDirectoryW
GetCurrentDirectoryW
FindClose
FindFirstFileW
FindNextFileW
GetSystemDefaultLangID
GetProcAddress
CreateFileW
DeleteFileW
GetTempFileNameW
WriteFile
GetTempPathW
DeleteCriticalSection
WaitForSingleObject
Sleep
GetExitCodeProcess
CreateProcessW
GetModuleFileNameW
GetModuleHandleW
LocalFree
FormatMessageA
FormatMessageW
MultiByteToWideChar
GetTickCount
InitializeCriticalSectionEx
OutputDebugStringW
InitializeSListHead
GetLastError
CloseHandle
DisableThreadLibraryCalls
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsDebuggerPresent
CreateEventW
WaitForSingleObjectEx
ResetEvent
SetEvent
InitializeCriticalSectionAndSpinCount
LeaveCriticalSection
EnterCriticalSection
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
LoadLibraryA
GetModuleHandleA

user32

MessageBoxW
GetFocus

advapi32

RegOpenKeyExW
RegCloseKey
IsTextUnicode
RegQueryValueExW

shell32

SHGetSpecialFolderPathW

tffontmgr

?FontLibSetDefaultFontName@@YAXAEBVTfString@@@Z
??0TfFontKey@@QEAA@XZ
?GetCharSet@TfFontKey@@QEBA?AW4EPRCCharSet@@XZ
?GetAttributes@TfFontKey@@QEBADXZ
?SetAttributes@TfFontKey@@QEAAXD@Z
?IsValid@TfFontKey@@QEBA_NXZ
?GetFontFamilyName@TfFontKey@@QEBAAEBVTfString@@XZ
?GetFontSize@TfFontKey@@QEBAGXZ
?FontLibFontMgrExist@@YA_NPEAH@Z
?FontLibFindFontKey@@YA_NAEBVTfString@@GDAEAVTfFontKey@@W4EPRCCharSet@@@Z
?FontLibRetrieveFontFamilies@@YAXHAEAV?$TfSArray@VTfString@@@@@Z
?FontLibGetDefaultFontName@@YAAEBVTfString@@XZ
?FontLibInitFctSystem@@YA_NP6A?AW4EFontStatus@@AEAV?$TfSArray@VTfString@@@@@Z@Z

tfkernel

ord129
ord4781
ord131
ord141
ord142
ord147
ord132
ord429
ord135
ord148
ord127
ord133
ord578
ord716
ord4719
ord811
ord4514
ord1396
ord4579
ord816
ord817
ord964
ord965
ord1003
ord1033
ord1035
ord1043
ord1056
ord1097
ord1115
ord1414
ord1415
ord1453
ord1455
ord1462
ord1464
ord1472
ord1492
ord1511
ord1516
ord1517
ord1584
ord1614
ord1616
ord1623
ord1626
ord1638
ord1690
ord1721
ord1735
ord1742
ord1751
ord1902
ord1903
ord1939
ord1941
ord1948
ord1950
ord1958
ord1977
ord1995
ord2000
ord2001
ord2067
ord2097
ord2099
ord2106
ord2109
ord2121
ord2170
ord2215
ord2222
ord2231
ord2537
ord2720
ord2721
ord2732
ord2733
ord2769
ord2771
ord2778
ord2780
ord2788
ord2806
ord2823
ord2969
ord2971
ord2978
ord2991
ord3067
ord3275
ord3279
ord3314
ord3408
ord3410
ord3417
ord3430
ord3506
ord3560
ord3618
ord3726
ord3727
ord3728
ord3731
ord4134
ord4135
ord4172
ord4174
ord4181
ord4183
ord4191
ord4210
ord4228
ord4233
ord4234
ord4301
ord4331
ord4333
ord4340
ord4343
ord4355
ord4406
ord4436
ord4450
ord4457
ord4466
ord4832
ord4833
ord4879
ord4881
ord4889
ord4899
ord4914
ord5025
ord5026
ord5104
ord5212
ord5227
ord158
ord18
ord826
ord5164
ord846
ord68
ord239
ord4561
ord4560
ord312
ord3242
ord185
ord30
ord4944
ord13
ord2652
ord228
ord760
ord46
ord181
ord699
ord832
ord978
ord1136
ord1139
ord1206
ord1430
ord1542
ord1853
ord1916
ord2025
ord2260
ord2667
ord2684
ord2718
ord2746
ord2849
ord2916
ord3202
ord3355
ord3882
ord4026
ord4149
ord4259
ord4533
ord4843
ord5097
ord5100
ord5194
ord718
ord3181
ord2401
ord3244
ord3245
ord4526
ord4527
ord5087
ord4498
ord4499
ord4501
ord4500
ord617
ord825
ord178
ord238
ord4745
ord2555
ord3753
ord4068
ord250
ord359
ord3978
ord4621
ord194
ord1391
ord1392
ord1395
ord1394
ord1388
ord1389
ord1390
ord480
ord4817
ord4822
ord160
ord540
ord461
ord668
ord208
ord670
ord4728
ord4729
ord4597
ord5128
ord4768
ord2318
ord758
ord1083
ord1149
ord1435
ord1443
ord1444
ord1448
ord1482
ord1503
ord1539
ord1572
ord1595
ord1596
ord1600
ord1609
ord1658
ord1668
ord1672
ord1722
ord1749
ord1851
ord1864
ord1921
ord1929
ord1930
ord1934
ord1967
ord1987
ord2022
ord2055
ord2078
ord2079
ord2083
ord2092
ord2140
ord2149
ord2153
ord2202
ord2229
ord2308
ord2309
ord2497
ord2498
ord2751
ord2759
ord2760
ord2764
ord2797
ord2815
ord3099
ord3100
ord3101
ord3142
ord409
ord3286
ord3316
ord3589
ord3594
ord3628
ord3760
ord3854
ord3869
ord3957
ord4051
ord4154
ord4162
ord4163
ord4167
ord4201
ord4220
ord4256
ord4289
ord4312
ord4313
ord4317
ord4326
ord4375
ord4385
ord4389
ord4437
ord4464
ord5095
ord5135
ord5235
ord291
ord149
ord61
ord347
ord3794
ord1180
ord2139
ord275
ord1179
ord188
ord2653
ord4688
ord190
ord907
ord1250
ord1411
ord1412
ord1899
ord1900
ord2394
ord2395
ord2465
ord2466
ord2467
ord2468
ord2609
ord2611
ord2613
ord2615
ord2621
ord2623
ord2628
ord2629
ord2634
ord2636
ord2639
ord2729
ord2730
ord2831
ord2833
ord2868
ord2870
ord2872
ord2874
ord2891
ord2893
ord2897
ord2898
ord3157
ord3159
ord3336
ord3337
ord4003
ord4004
ord4062
ord4131
ord4132
ord636
ord2888
ord2529
ord3723
ord5099
ord257
ord5045
ord5047
ord3252
ord5050
ord4574
ord1284
ord5043
ord3724
ord5048
ord5063
ord5064
ord5061
ord3180
ord5039
ord3828
ord3722
ord3720
ord3721
ord3719
ord4984
ord1280
ord5042
ord3735
ord3782
ord4675
ord5119
ord260
ord848
ord4552
ord4804
ord5088
ord1251
ord679
ord1300
ord955
ord1154
ord3213
ord4537
ord2411
ord311
ord766
ord229
ord691
ord58
ord710
ord4770
ord2885
ord4813
ord3079
ord918
ord126
ord678
ord777
ord26
ord720
ord4589
ord4693
ord4572
ord270
ord4571
ord4637
ord56
ord267
ord1277
ord4828
ord1214
ord1429
ord1477
ord1507
ord1541
ord1648
ord1744
ord1915
ord1962
ord1991
ord2024
ord2130
ord2224
ord2745
ord2792
ord2819
ord2915
ord3354
ord3693
ord3702
ord3834
ord4148
ord4196
ord4224
ord4258
ord4365
ord4459
ord4972
ord4609
ord37
ord322
ord161
ord953
ord157
ord151
ord432
ord3758
ord3526
ord841
ord743
ord1839
ord844
ord779
ord1841
ord840
ord740
ord1838
ord839
ord1837
ord4557
ord834
ord843
ord1181
ord289

tfkgeom

ord545
ord1328
ord829
ord827
ord547
ord1583
ord253
ord546
ord900
ord301
ord294
ord1555
ord1126
ord166
ord539
ord9
ord128
ord127
ord117
ord893
ord118
ord119
ord121
ord123
ord122
ord173
ord129
ord300
ord293
ord463
ord838
ord461
ord858
ord501
ord853
ord467
ord837
ord458
ord474
ord851
ord480
ord854
ord497
ord476
ord856
ord499
ord841
ord465
ord842
ord466
ord852
ord495
ord855
ord498
ord477
ord995
ord183
ord146
ord1604
ord1520
ord1605
ord1354
ord522
ord535
ord835
ord991
ord990
ord836
ord456
ord857
ord500
ord844
ord468
ord840
ord464
ord850
ord478
ord1628
ord538
ord537
ord509
ord846
ord470
ord849
ord475
ord839
ord527
ord843
ord530
ord847
ord472
ord994
ord165
ord23
ord190

msvcp140

?_XGetLastError@std@@YAXXZ
?_Execute_once@std@@YAHAEAUonce_flag@1@P6AHPEAX1PEAPEAX@Z1@Z
?__ExceptionPtrRethrow@@YAXPEBX@Z
?__ExceptionPtrCurrentException@@YAXPEAX@Z
?__ExceptionPtrToBool@@YA_NPEBX@Z
?__ExceptionPtrAssign@@YAXPEAXPEBX@Z
?__ExceptionPtrCopy@@YAXPEAXPEBX@Z
?__ExceptionPtrDestroy@@YAXPEAX@Z
?__ExceptionPtrCreate@@YAXPEAX@Z

vcruntime140

__std_terminate
__std_exception_copy
memcpy
__current_exception_context
__current_exception
_CxxThrowException
__C_specific_handler
memmove
_purecall
strchr
strrchr
wcsstr
strstr
__std_exception_destroy
__std_type_info_destroy_list
wcschr
memset

vcruntime140_1

__CxxFrameHandler4

api-ms-win-crt-stdio-l1-1-0

fclose
fflush
fgets
_close
_read
fputs
fopen
__stdio_common_vsscanf
fread
__stdio_common_vswscanf
_setmaxstdio
_wfdopen
fseek
ftell
_wsopen
fwrite
_wfopen
_wtempnam
__stdio_common_vfprintf
__acrt_iob_func
fgetws
_wopen
__stdio_common_vsprintf
rewind
fputws
__stdio_common_vfwprintf
_getmaxstdio
__stdio_common_vswprintf

api-ms-win-crt-heap-l1-1-0

malloc
realloc
calloc
free
_callnewh

api-ms-win-crt-math-l1-1-0

ceilf
sqrt
modf
floorf

api-ms-win-crt-filesystem-l1-1-0

_waccess
_wstat64i32
_wunlink
_wsplitpath

api-ms-win-crt-runtime-l1-1-0

exit
_errno
_initterm_e
_initterm
_cexit
terminate
perror
_seh_filter_dll
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_execute_onexit_table
_crt_atexit

api-ms-win-crt-environment-l1-1-0

getenv
_wgetenv

api-ms-win-crt-string-l1-1-0

wcsncmp
towlower
towupper
iswspace
iswdigit
wcstok
tolower
isalnum
islower
strcmp
isdigit
isxdigit
strncmp
_wcsdup
isspace
isalpha
strncpy
strtok

api-ms-win-crt-utility-l1-1-0

rand
srand

api-ms-win-crt-convert-l1-1-0

strtol
_wtoi

api-ms-win-crt-time-l1-1-0

_mktime64
_time64
_localtime64

Exports

Exports

A3DAdobeLibsInitialize
A3DAdobeLibsTerminate
A3DAnimAnimationLibraryAdd
A3DAnimAnimationLibraryCreate
A3DAnimAnimationLibraryGet
A3DAnimU3DAnimationModifierCreate
A3DAnimU3DAnimationModifierGet
A3DAnimU3DMotionInformationCreate
A3DAnimU3DMotionInformationGet
A3DAnimU3DMotionResourceCreate
A3DAnimU3DMotionResourceGet
A3DAsmFilterCreate
A3DAsmFilterGet
A3DAsmModelFileCollectAllParts
A3DAsmModelFileCreate
A3DAsmModelFileDelete
A3DAsmModelFileGet
A3DAsmModelFileInsertProductOccurrence
A3DAsmModelFileLoadFromCADFile2
A3DAsmModelFileLoadFromFile
A3DAsmModelFileReadHelperFree
A3DAsmModelFileWriteHelperFree
A3DAsmModelFileWriteToFile
A3DAsmPartDefinitionCreate
A3DAsmPartDefinitionGet
A3DAsmPartDefinitionInsertAnnotationEntity
A3DAsmPartDefinitionInsertRepresentationItem
A3DAsmProductOccurrenceCreate
A3DAsmProductOccurrenceGet
A3DAsmProductOccurrenceInsertDisplayFilter
A3DAsmProductOccurrenceInsertLocation
A3DAsmProductOccurrenceInsertPartDefinition
A3DAsmProductOccurrenceInsertProductOccurrence
A3DAsmProductOccurrenceInsertProductPrototype
A3DAsmProductOccurrenceInsertSceneDisplayParameters
A3DAsmProductOccurrenceInsertView
A3DAsmProductOccurrenceSetProductPrototype
A3DCrvBaseGetAsNurbs
A3DCrvBaseGetAsNurbs2
A3DCrvBlend02BoundaryCreate
A3DCrvBlend02BoundaryGet
A3DCrvCircleCreate
A3DCrvCircleGet
A3DCrvCompositeCreate
A3DCrvCompositeGet
A3DCrvEllipseCreate
A3DCrvEllipseGet
A3DCrvEquationCreate
A3DCrvEquationGet
A3DCrvHelixCreate
A3DCrvHelixGet
A3DCrvHyperbolaCreate
A3DCrvHyperbolaGet
A3DCrvIntersectionCreate
A3DCrvIntersectionGet
A3DCrvLineCreate
A3DCrvLineGet
A3DCrvNurbsCreate
A3DCrvNurbsGet
A3DCrvOffsetCreate
A3DCrvOffsetGet
A3DCrvOnSurfCreate
A3DCrvOnSurfGet
A3DCrvParabolaCreate
A3DCrvParabolaGet
A3DCrvPolyLineCreate
A3DCrvPolyLineGet
A3DCrvTransformCreate
A3DCrvTransformGet
A3DDllActivateXMLTrace
A3DDllGetVersion
A3DDllInitialize
A3DDllSetAllocationFunctions
A3DDllSetOutputFunctions
A3DDllSetProgressFunctions
A3DDllTerminate
A3DEntityDelete
A3DEntityGetPdfEntity
A3DEntityGetPdfNameFromRead
A3DEntityGetPdfNameFromWrite
A3DEntityGetType
A3DEntityIsBaseType
A3DEntityIsBaseWithGraphicsType
A3DFeatAtomDataGet
A3DFeatEntityGetType
A3DFeatEnumValuesCreate
A3DFeatEnumValuesGet
A3DFeatFeatureCreate
A3DFeatFeatureGet
A3DFeatFeatureTreeCreate
A3DFeatFeatureTreeGet
A3DFeatParameterCopyCreate
A3DFeatParameterCopyGet
A3DFeatParameterCreate
A3DFeatParameterGet
A3DFeatReferenceGeometryCreate
A3DFeatReferenceGeometryGet
A3DFeatTypeGet
A3DGlobalConvertPictureData
A3DGlobalFontKeyCreate
A3DGlobalFontKeyGet
A3DGlobalGet
A3DGlobalGetFillPatternType
A3DGlobalGetGraphDottingPatternData
A3DGlobalGetGraphHatchingPatternData
A3DGlobalGetGraphLinePatternData
A3DGlobalGetGraphMaterialData
A3DGlobalGetGraphMaterialFromIndex
A3DGlobalGetGraphPictureData
A3DGlobalGetGraphPictureFromIndex
A3DGlobalGetGraphRgbColorData
A3DGlobalGetGraphSolidPatternData
A3DGlobalGetGraphStyleData
A3DGlobalGetGraphStyleFromIndex
A3DGlobalGetGraphTextureApplicationData
A3DGlobalGetGraphTextureDefinitionData
A3DGlobalGetGraphVPicturePatternData
A3DGlobalGetPointer
A3DGlobalInsertGraphDottingPattern
A3DGlobalInsertGraphHatchingPattern
A3DGlobalInsertGraphLinePattern
A3DGlobalInsertGraphMaterial
A3DGlobalInsertGraphPicture
A3DGlobalInsertGraphRgbColor
A3DGlobalInsertGraphSolidPattern
A3DGlobalInsertGraphStyle
A3DGlobalInsertGraphTextureApplication
A3DGlobalInsertGraphTextureDefinition
A3DGlobalInsertGraphVPicturePattern
A3DGlobalIsMaterialTexture
A3DGraphAmbientLightCreate
A3DGraphAmbientLightGet
A3DGraphCameraCreate
A3DGraphCameraGet
A3DGraphDirectionalLightCreate
A3DGraphDirectionalLightGet
A3DGraphPointLightCreate
A3DGraphPointLightGet
A3DGraphSpotLightCreate
A3DGraphSpotLightGet
A3DGraphTextureTransformationCreate
A3DGraphTextureTransformationData2DCreate
A3DGraphTextureTransformationGet
A3DGraphicsCreate
A3DGraphicsGet
A3DLicPutLicenseFile
A3DMathFct1DArctanCosCreate
A3DMathFct1DArctanCosGet
A3DMathFct1DCombinationCreate
A3DMathFct1DCombinationGet
A3DMathFct1DFractionCreate
A3DMathFct1DFractionGet
A3DMathFct1DPolynomCreate
A3DMathFct1DPolynomGet
A3DMathFct1DTrigonometricCreate
A3DMathFct1DTrigonometricGet
A3DMathFct3DLinearCreate
A3DMathFct3DLinearGet
A3DMathFct3DNonLinearCreate
A3DMathFct3DNonLinearGet
A3DMiscAlloc
A3DMiscAttributeCreate
A3DMiscAttributeGet
A3DMiscCartesianTransformationCreate
A3DMiscCartesianTransformationGet
A3DMiscCartesianTransformationValidate
A3DMiscCascadedAttributesCreate
A3DMiscCascadedAttributesDelete
A3DMiscCascadedAttributesGet
A3DMiscCascadedAttributesPush
A3DMiscCascadedAttributesPushTessFace
A3DMiscEntityGetParameter
A3DMiscEntityReferenceCreate
A3DMiscEntityReferenceGet
A3DMiscEntityReferenceSet
A3DMiscFree
A3DMiscGeneralTransformationCreate
A3DMiscGeneralTransformationGet
A3DMiscGetEntityTypeMsg
A3DMiscGetErrorMsg
A3DMiscMapPtrToPtrCreate
A3DMiscMapPtrToPtrGetValueAt
A3DMiscMapPtrToPtrSetValueAt
A3DMiscMarkupLinkedItemCreate
A3DMiscMarkupLinkedItemGet
A3DMiscPointerFromIndexGet
A3DMiscReferenceOnTopologyCreate
A3DMiscReferenceOnTopologyGet
A3DMiscRootBaseInsertAttribute
A3DMiscRootBaseSetName
A3DMiscUTF8ToUnicode
A3DMiscUnicodeToUTF8
A3DMkpAnnotationItemCreate
A3DMkpAnnotationItemGet
A3DMkpAnnotationReferenceCreate
A3DMkpAnnotationReferenceGet
A3DMkpAnnotationSetCreate
A3DMkpAnnotationSetGet
A3DMkpAnnotationSetInsertAnnotationEntity
A3DMkpLeaderCreate
A3DMkpLeaderGet
A3DMkpMarkupCreate
A3DMkpMarkupGet
A3DMkpViewCreate
A3DMkpViewGet
A3DRiBrepModelCreate
A3DRiBrepModelGet
A3DRiCoordinateSystemCreate
A3DRiCoordinateSystemGet
A3DRiCurveCreate
A3DRiCurveGet
A3DRiDirectionCreate
A3DRiDirectionGet
A3DRiPlaneCreate
A3DRiPlaneGet
A3DRiPointSetCreate
A3DRiPointSetGet
A3DRiPointSetInsertPoint
A3DRiPolyBrepModelCreate
A3DRiPolyBrepModelGet
A3DRiPolyWireCreate
A3DRiPolyWireGet
A3DRiRepresentationItemGet
A3DRiRepresentationItemSet
A3DRiSetCreate
A3DRiSetGet
A3DRiSetInsertRepresentationItem
A3DRootBaseAnimationLibraryGet
A3DRootBaseAnimationLibrarySet
A3DRootBaseFeatureTreesGet
A3DRootBaseGet
A3DRootBaseSet
A3DRootBaseWithGraphicsGet
A3DRootBaseWithGraphicsSet
A3DSurfBaseGetAsNurbs
A3DSurfBlend01Create
A3DSurfBlend01Get
A3DSurfBlend02Create
A3DSurfBlend02Get
A3DSurfBlend03Create
A3DSurfBlend03Get
A3DSurfConeCreate
A3DSurfConeGet
A3DSurfCylinderCreate
A3DSurfCylinderGet
A3DSurfCylindricalCreate
A3DSurfCylindricalGet
A3DSurfExtrusionCreate
A3DSurfExtrusionGet
A3DSurfFromCurvesCreate
A3DSurfFromCurvesGet
A3DSurfNurbsCreate
A3DSurfNurbsGet
A3DSurfOffsetCreate
A3DSurfOffsetGet
A3DSurfPipeCreate
A3DSurfPipeGet
A3DSurfPlaneCreate
A3DSurfPlaneGet
A3DSurfRevolutionCreate
A3DSurfRevolutionGet
A3DSurfRuledCreate
A3DSurfRuledGet
A3DSurfSphereCreate
A3DSurfSphereGet
A3DSurfTorusCreate
A3DSurfTorusGet
A3DSurfTransformCreate
A3DSurfTransformGet
A3DTess3DCreate
A3DTess3DGet
A3DTess3DWireCreate
A3DTess3DWireGet
A3DTessAbort
A3DTessBaseGet
A3DTessBaseSet
A3DTessFaceInitialize
A3DTessFaceTerminate
A3DTessInitialize
A3DTessInsertEdge
A3DTessInsertNormal
A3DTessInsertStripe
A3DTessInsertTexture
A3DTessInsertTriangle
A3DTessInsertTriangleVertexColor
A3DTessInsertVertex
A3DTessMarkupCreate
A3DTessMarkupGet
A3DTessMkpAddPoint
A3DTessMkpAddPolyLinePoint
A3DTessMkpAddTriangle
A3DTessMkpBeginMatrixMode
A3DTessMkpBeginPoints
A3DTessMkpBeginPolyLine
A3DTessMkpBeginTriangles
A3DTessMkpEndMatrixMode
A3DTessMkpEndPoints
A3DTessMkpEndPolyLine
A3DTessMkpEndTriangles
A3DTessMkpInitialize
A3DTessMkpSetColor
A3DTessMkpSetFont
A3DTessMkpSetLabel
A3DTessMkpSetText
A3DTessMkpTerminate
A3DTessSetEdgeCount
A3DTessSetNormalCount
A3DTessSetParameters
A3DTessSetUVCount
A3DTessSetVertexCount
A3DTessTerminate
A3DTessWireAbort
A3DTessWireInitialize
A3DTessWireInsertSegment
A3DTessWireInsertVertex
A3DTessWireTerminate
A3DTopoBodyGet
A3DTopoBodySet
A3DTopoBrepDataCreate
A3DTopoBrepDataGet
A3DTopoCoEdgeCreate
A3DTopoCoEdgeGet
A3DTopoCoEdgeSetNeighbour
A3DTopoConnexCreate
A3DTopoConnexGet
A3DTopoContextCreate
A3DTopoContextGet
A3DTopoEdgeCreate
A3DTopoEdgeGet
A3DTopoFaceCreate
A3DTopoFaceGet
A3DTopoLoopCreate
A3DTopoLoopGet
A3DTopoMultipleVertexCreate
A3DTopoMultipleVertexGet
A3DTopoShellCreate
A3DTopoShellGet
A3DTopoSingleWireBodyCreate
A3DTopoSingleWireBodyGet
A3DTopoUniqueVertexCreate
A3DTopoUniqueVertexGet
A3DTopoWireEdgeCreate
A3DTopoWireEdgeGet
A3DXmlParsing

Sections

.text
Size: 362KB - Virtual size: 362KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 144KB - Virtual size: 144KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 269KB - Virtual size: 315KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 20KB - Virtual size: 19KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 1KB - Virtual size: 1KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

fe519ead53d342ed5d12950364366f97

Code Sign

0e:8d:5b:d8:e9:b2:32:4f:bd:15:71:81:0d:19:1d:e0Certificate

Extended Key Usages

Key Usages

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5cCertificate

Extended Key Usages

Key Usages

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6dCertificate

Extended Key Usages

Key Usages

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15Certificate

Extended Key Usages

Key Usages

4c:92:b0:f8:77:65:70:d5:0c:9b:cf:10:8f:5e:1c:e9:e8:55:ef:b0:02:62:76:ff:dc:ec:9f:38:90:d8:1c:a5Signer

Signature Validations

Verification

07-10-2020 02:05 Valid: true

Chain 1

Headers

DLL Characteristics

File Characteristics

Imports

kernel32

user32

advapi32

shell32

tffontmgr

tfkernel

tfkgeom

msvcp140

vcruntime140

vcruntime140_1

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-filesystem-l1-1-0

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-environment-l1-1-0

api-ms-win-crt-string-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-time-l1-1-0

Exports

Exports

Sections

.text Size: 362KB - Virtual size: 362KB

.rdata Size: 144KB - Virtual size: 144KB

.data Size: 269KB - Virtual size: 315KB

.pdata Size: 20KB - Virtual size: 19KB

.rsrc Size: 1KB - Virtual size: 1KB

.reloc Size: 4KB - Virtual size: 4KB

0e:8d:5b:d8:e9:b2:32:4f:bd:15:71:81:0d:19:1d:e0
Certificate

03:f1:b4:e1:5f:3a:82:f1:14:96:78:b3:d7:d8:47:5c
Certificate

04:cd:3f:85:68:ae:76:c6:1b:b0:fe:71:60:cc:a7:6d
Certificate

0a:a1:25:d6:d6:32:1b:7e:41:e4:05:da:36:97:c2:15
Certificate

4c:92:b0:f8:77:65:70:d5:0c:9b:cf:10:8f:5e:1c:e9:e8:55:ef:b0:02:62:76:ff:dc:ec:9f:38:90:d8:1c:a5
Signer

07-10-2020 02:05
Valid: true

.text
Size: 362KB - Virtual size: 362KB

.rdata
Size: 144KB - Virtual size: 144KB

.data
Size: 269KB - Virtual size: 315KB

.pdata
Size: 20KB - Virtual size: 19KB

.rsrc
Size: 1KB - Virtual size: 1KB

.reloc
Size: 4KB - Virtual size: 4KB