�IϺ)���mܞ1ǀK6[�R�L��tLq���:9F����u�WI&)���q.|'AL�Kx5c~a?�����7���yV���#rP��Ml������V�gͪ���9M̦!���@ w����r̛.��s�'l4����馎Ʋ>�UU-'N>#�V�Gh�&P�a�`sm%�.`�"�kbY�J��� ��Ljmsx �%%ή���/ >Z��H���^�"��[W_LEy��ԅX�����0�L��!�6 �D4�H�\��Y���5`Ad,t�ݚI ���A�tP�uI2~@m��_d�U��P����̲T�R��%D�@���d���A9?��f�uh����-g�5�/�e�#��|��98GZ�ޔp^�Օ@i1iO�w����i�xy��S�xYM�S�l8�D ���j=�ѵƿk-�n\=�ڞ�D�ݳ�L��(�!e��u>9]�u��Z�4�����6RP 0����|B7/�����p��7�W�UP��� Jiak��-Q!����=>k9���=r����]�pS�7d����U�J�P%����&��v�d b�h7)!���+x�6�����%V-�+��j��Gd��|��3�% *6���[x��H�o1X:m�jM���fs���M�C��LVV��X��mOt�Iˀ�d�dIG|v���.��Fg[4F}5�9���9�6��;=��̇HY�mi�<� �vR������J�fN��Û�Q0y!�{�����M�h���䌢�miu��,����s��C��1��j��٭���*�L�M�~�l�y�n=d)�Y|�U��ݣ�x�����CBn�X����];�N�1�o�H��c���U9��Dj�vg��S>���/�u�qO"�R֜/j7�*~Ty����{�&�H�n�v�@>A,�+�y+w�ף�#�'��f'��+˽ĸ0ђ]�% }E��'�-4,�[NM72�����$�;�X���ɲ�����F�l�1Χ�(�͐viVq%:n/dW�Ō3J�kO��c�lw��`d0�Dm��p}"O�<���59���X���$�����z��I��e��i��'_���&���Ʌꩺ�j]c�����b�x��hX5�njK�+5���M�%E�3����9�N@[��Õ����u������ZPkA�h�����>+*�!��a�,ώׯ���B>����Բ�� �#����9�N+rݖ�3s��p�����kŦ;�㲦�on�������q4m��E�/y�w����{�7� �EB,�8/�n7���������|�h �W��5f���f��X��K0�� �6����ZZA�r5� |M������l^Ex�˻�R{{�ߞ���W���xO� CW&iY���������36q3e)h�;a�Ci��&�~������1b\�}=�M&��^���d}W`C�%|��ֶ��� ��r?P�H�� đ�:E���t�W���al� 7+���7[�h�S��l4_�6ۤ�~��-�|�'�%gx��=�@z���Γ����v�C��/�fo;�0j��%ZI�,�U��|�uH� @v-��n>1�q��Mɉ�I�#��B�]�-Z_$}�D.Kh� 4����S�m�ި`�BWo�%��?T�+(]��L� �L����!}x����f�>5���pZՁ��* p�-�.���a��V��Ep':�v�"y��?�0��W�Ƿ���K���ݵ��;CPlb��- �DZt�w�{g����[`?�cɿJF&:�@�~tb��Z�FMo��»�^�&V�jU ���F�N�d���������Uِ�\ܿ�7P�s�`"�JyR�$F�-�$�F;+ТG���J����}M�"Ǫ����3���4�:��W*N�zSP!����ď�:���75��G�ה�6k�3<���j��i��K?nN,�,�F �/�B0��v��v�k%���'�X)f֑�o��˞)DƋB�����$�8?��-Q[��t�+� �K(����@�r�%�J u�#s����{�������, rǎ����:���搁ʪ�#I��K�>�<��4L���:���˨X�jQ�ZFC�����0?�`)�?����8���N�^,��(���P�o)�S�����67�jb���s��R���l���^Cep��^D"-Y���O{S<c���3w��ų g[�w���N���W�w�盦O/1^�:��7v�,�c�Mχ�%�Z �M���ԴH[Vk�O&7�����߇џZo�S*@�������#�Gɥ]�CG*0U��yr��|m��&���\�o����� ���?&�V�qq�.h�����<���@�Úm�O�$W��+@[E��}�$�/�$?�̠w��z��ҋX� >�V��� �@iN���gKfy&9��I�z�CI�i�)ث�ŇE�����������:MY�� �����p��SRX����~�CU#��cR#���ү+���^�e��ڲDg��c�BP;qG�����Gq��2�s�љV��n����lw��Fbs�N,��i0`l��7�����{M��i��t5a�x%Q�]���!1N�tL<55�����=�T#��c�٫W��"��S�dּ���%��@��E����o�_d����yr\.YB�sU�<�d��f�dCm��N����G��:��<DV�*����]���؏��7�w�� ֗���y��)�N��� 0J�f����҅�:��]�y��]���:���I�ߒ�o1����{��a4XL'v�18� N�XpYv��OBt:�4A��4��_T]�����V���\���S#���ڞ�h�p.<c����"|>�s���o��ܗ���Q�W:�ԍ ˮ�90/H�O|cB�6A'U���?P.�2q '}���SS�,o �� ���!�����TM�ʚ}�/�%�2~� �W��.6��G���t5��������(����]����4M�����lE���NyPա�=~[��\� ��$�^����)A�A�����'rPy旱]5��<��:��b���˯<�L�f5��Y��� %m�
Static task
static1
Behavioral task
behavioral1
Sample
CLIPStudioPaint.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
CLIPStudioPaint.exe
Resource
win10v2004-20220812-en
General
-
Target
CLIPStudioPaint 1.12.3.zip
-
Size
27.3MB
-
MD5
712f98552b50ca9b02f52896c12f95a3
-
SHA1
870fa21ed9bcfb5242e28642343fd1a6d66668e4
-
SHA256
2455bf9ceafc838c9b5dd07c792dcd201884878a0d66e7fb91b7da285b6fadbd
-
SHA512
51e1eb4d65ef3d0d1eb3e222dcff2bdd4aaf8c8f241af838121aeedab57092ed23bf355b783a023fe92444a74d11878392e67b70d56d0f1ad9beff07af0ae813
-
SSDEEP
786432:/mg7bGkMJ394WFQWud0/fGFIlP1MuNA5F:PfG/MdAGFIgQ6F
Malware Config
Signatures
Files
-
CLIPStudioPaint 1.12.3.zip.zip
-
CLIPStudioPaint.exe.exe windows x64
0b9da905db426fb9a43c50940c695777
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
boost_thread
??1thread_data_base@detail@boost@@UEAA@XZ
ws2_32
send
qmpdkdll
QmPdkDisconnect
crypt32
CertFindCertificateInStore
kernel32
GetVersionExA
GetVersionExW
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
IsIconic
CharUpperBuffW
advapi32
ConvertSidToStringSidW
msvcp140
?_Xbad_function_call@std@@YAXXZ
bcrypt
BCryptOpenAlgorithmProvider
shlwapi
PathAppendW
imm32
ImmSetCandidateWindow
msacm32
acmStreamPrepareHeader
concrt140
?Free@Concurrency@@YAXPEAX@Z
vcruntime140
__RTtypeid
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-stdio-l1-1-0
ferror
api-ms-win-crt-string-l1-1-0
_wcslwr
api-ms-win-crt-math-l1-1-0
fmodf
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
_gmtime64_s
api-ms-win-crt-filesystem-l1-1-0
_wrename
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
ailia
ord200
giflib
DGifOpen
jpeg62
ord50
libpng16
png_set_compression_level
tiff
TIFFReadEncodedStrip
comctl32
ord17
mscms
CloseColorProfile
rpcrt4
UuidFromStringW
avifil32
AVIFileRelease
iphlpapi
GetAdaptersAddresses
libfbxsdk
?GetCluster@FbxSkin@fbxsdk@@QEAAPEAVFbxCluster@2@H@Z
zlib
inflate
gdiplus
GdipFillPath
boost_date_time
??0greg_month@gregorian@boost@@QEAA@G@Z
winmm
mmioWrite
wininet
InternetSetOptionW
version
VerQueryValueW
boost_regex
?construct_init@?$perl_matcher@PEBDV?$allocator@U?$sub_match@PEBD@boost@@@std@@U?$regex_traits@DV?$w32_regex_traits@D@boost@@@boost@@@re_detail_107200@boost@@AEAAXAEBV?$basic_regex@DU?$regex_traits@DV?$w32_regex_traits@D@boost@@@boost@@@3@W4_match_flags@regex_constants@3@@Z
glu32
gluOrtho2D
opengl32
glVertex3fv
gdi32
GetObjectW
comdlg32
PrintDlgW
shell32
ord680
ole32
CoTaskMemFree
oleaut32
VarUI4FromStr
Exports
Exports
Sections
.text Size: - Virtual size: 48.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 9.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.krv0 Size: - Virtual size: 8.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.krv1 Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.krv2 Size: 28.1MB - Virtual size: 28.1MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ