�IϺ)���mܞ1ǀK6[�R�L��tLq���:9F����u�WI&)���q.|'AL�Kx5c~a?�����7���yV���#rP��Ml������V�gͪ���9M̦!���@ w����r̛.��s�'l4����馎Ʋ>�UU-'N>#�V�Gh�&P�a�`sm%�.`�"�kbY�J��� ��Ljmsx �%%ή���/ >Z��H���^�"��[W_LEy��ԅX�����0�L��!�6 �D4�H�\��Y���5`Ad,t�ݚI ���A�tP�uI2~@m��_d�U��P����̲T�R��%D�@���d���A9?��f�uh����-g�5�/�e�#��|��98GZ�ޔp^�Օ@i1iO�w����i�xy��S�xYM�S�l8�D ���j=�ѵƿk-�n\=�ڞ�D�ݳ�L��(�!e��u>9]�u��Z�4�����6RP 0����|B7/�����p��7�W�UP��� Jiak��-Q!����=>k9���=r����]�pS�7d����U�J�P%����&��v�d b�h7)!���+x�6�����%V-�+��j��Gd��|��3�% *6���[x��H�o1X:m�jM���fs���M�C��LVV��X��mOt�Iˀ�d�dIG|v���.��Fg[4F}5�9���9�6��;=��̇HY�mi�<� �vR������J�fN��Û�Q0y!�{�����M�h���䌢�miu��,����s��C��1��j��٭���*�L�M�~�l�y�n=d)�Y|�U��ݣ�x�����CBn�X����];�N�1�o�H��c���U9��Dj�vg��S>���/�u�qO"�R֜/j7�*~Ty����{�&�H�n�v�@>A,�+�y+w�ף�#�'��f'��+˽ĸ0ђ]�% }E��'�-4,�[NM72�����$�;�X���ɲ�����F�l�1Χ�(�͐viVq%:n/dW�Ō3J�kO��c�lw��`d0�Dm��p}"O�<���59���X���$�����z��I��e��i��'_���&���Ʌꩺ�j]c�����b�x��hX5�njK�+5���M�%E�3����9�N@[��Õ����u������ZPkA�h�����>+*�!��a�,ώׯ���B>����Բ�� �#����9�N+rݖ�3s��p�����kŦ;�㲦�on�������q4m��E�/y�w����{�7� �EB,�8/�n7���������|�h �W��5f���f��X��K0�� �6����ZZA�r5� |M������l^Ex�˻�R{{�ߞ���W���xO� CW&iY���������36q3e)h�;a�Ci��&�~������1b\�}=�M&��^���d}W`C�%|��ֶ��� ��r?P�H�� đ�:E���t�W���al� 7+���7[�h�S��l4_�6ۤ�~��-�|�'�%gx��=�@z���Γ����v�C��/�fo;�0j��%ZI�,�U��|�uH� @v-��n>1�q��Mɉ�I�#��B�]�-Z_$}�D.Kh� 4����S�m�ި`�BWo�%��?T�+(]��L� �L����!}x����f�>5���pZՁ��* p�-�.���a��V��Ep':�v�"y��?�0��W�Ƿ���K���ݵ��;CPlb��- �DZt�w�{g����[`?�cɿJF&:�@�~tb��Z�FMo��»�^�&V�jU ���F�N�d���������Uِ�\ܿ�7P�s�`"�JyR�$F�-�$�F;+ТG���J����}M�"Ǫ����3���4�:��W*N�zSP!����ď�:���75��G�ה�6k�3<���j��i��K?nN,�,�F �/�B0��v��v�k%���'�X)f֑�o��˞)DƋB�����$�8?��-Q[��t�+� �K(����@�r�%�J u�#s����{�������, rǎ����:���搁ʪ�#I��K�>�<��4L���:���˨X�jQ�ZFC�����0?�`)�?����8���N�^,��(���P�o)�S�����67�jb���s��R���l���^Cep��^D"-Y���O{S<c���3w��ų g[�w���N���W�w�盦O/1^�:��7v�,�c�Mχ�%�Z �M���ԴH[Vk�O&7�����߇џZo�S*@�������#�Gɥ]�CG*0U��yr��|m��&���\�o����� ���?&�V�qq�.h�����<���@�Úm�O�$W��+@[E��}�$�/�$?�̠w��z��ҋX� >�V��� �@iN���gKfy&9��I�z�CI�i�)ث�ŇE�����������:MY�� �����p��SRX����~�CU#��cR#���ү+���^�e��ڲDg��c�BP;qG�����Gq��2�s�љV��n����lw��Fbs�N,��i0`l��7�����{M��i��t5a�x%Q�]���!1N�tL<55�����=�T#��c�٫W��"��S�dּ���%��@��E����o�_d����yr\.YB�sU�<�d��f�dCm��N����G��:��<DV�*����]���؏��7�w�� ֗���y��)�N��� 0J�f����҅�:��]�y��]���:���I�ߒ�o1����{��a4XL'v�18� N�XpYv��OBt:�4A��4��_T]�����V���\���S#���ڞ�h�p.<c����"|>�s���o��ܗ���Q�W:�ԍ ˮ�90/H�O|cB�6A'U���?P.�2q '}���SS�,o �� ���!�����TM�ʚ}�/�%�2~� �W��.6��G���t5��������(����]����4M�����lE���NyPա�=~[��\� ��$�^����)A�A�����'rPy旱]5��<��:��b���˯<�L�f5��Y��� %m�
Static task
static1
Behavioral task
behavioral1
Sample
CLIPStudioPaint.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
CLIPStudioPaint.exe
Resource
win10v2004-20220812-en
General
-
Target
CLIPStudioPaint.exe
-
Size
31.6MB
-
MD5
ba2dc36c630394decee1b65b6f14cb54
-
SHA1
40b22b5bf3c7c5c49f091876cdfbfc89a6bb40f6
-
SHA256
0cd489308db8b73948e2e40095e2f4a90f05a17da3f5c206b1eb2eb8a315f27f
-
SHA512
a0fde9c774bdc3dbe298802d55c8224f3b74268f9c0019a522afe6471b37a2faa4b7ef4209f0ebb4244ab5042ba9013c92ba8ba9e80df231f7324b4e63a53305
-
SSDEEP
786432:hE+O1pe0KRzZC2FEeupg7bQLetx7CJlokxio:WLeVCpqQLeyJeho
Malware Config
Signatures
Files
-
CLIPStudioPaint.exe.exe windows x64
0b9da905db426fb9a43c50940c695777
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
boost_thread
??1thread_data_base@detail@boost@@UEAA@XZ
ws2_32
send
qmpdkdll
QmPdkDisconnect
crypt32
CertFindCertificateInStore
kernel32
GetVersionExA
GetVersionExW
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
IsIconic
CharUpperBuffW
advapi32
ConvertSidToStringSidW
msvcp140
?_Xbad_function_call@std@@YAXXZ
bcrypt
BCryptOpenAlgorithmProvider
shlwapi
PathAppendW
imm32
ImmSetCandidateWindow
msacm32
acmStreamPrepareHeader
concrt140
?Free@Concurrency@@YAXPEAX@Z
vcruntime140
__RTtypeid
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-stdio-l1-1-0
ferror
api-ms-win-crt-string-l1-1-0
_wcslwr
api-ms-win-crt-math-l1-1-0
fmodf
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
_gmtime64_s
api-ms-win-crt-filesystem-l1-1-0
_wrename
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
ailia
ord200
giflib
DGifOpen
jpeg62
ord50
libpng16
png_set_compression_level
tiff
TIFFReadEncodedStrip
comctl32
ord17
mscms
CloseColorProfile
rpcrt4
UuidFromStringW
avifil32
AVIFileRelease
iphlpapi
GetAdaptersAddresses
libfbxsdk
?GetCluster@FbxSkin@fbxsdk@@QEAAPEAVFbxCluster@2@H@Z
zlib
inflate
gdiplus
GdipFillPath
boost_date_time
??0greg_month@gregorian@boost@@QEAA@G@Z
winmm
mmioWrite
wininet
InternetSetOptionW
version
VerQueryValueW
boost_regex
?construct_init@?$perl_matcher@PEBDV?$allocator@U?$sub_match@PEBD@boost@@@std@@U?$regex_traits@DV?$w32_regex_traits@D@boost@@@boost@@@re_detail_107200@boost@@AEAAXAEBV?$basic_regex@DU?$regex_traits@DV?$w32_regex_traits@D@boost@@@boost@@@3@W4_match_flags@regex_constants@3@@Z
glu32
gluOrtho2D
opengl32
glVertex3fv
gdi32
GetObjectW
comdlg32
PrintDlgW
shell32
ord680
ole32
CoTaskMemFree
oleaut32
VarUI4FromStr
Exports
Exports
Sections
.text Size: - Virtual size: 48.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 9.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.krv0 Size: - Virtual size: 8.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.krv1 Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.krv2 Size: 28.1MB - Virtual size: 28.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ