h�Y��c3AO�_Y+��P��A��-B��(_G�b��d��D�&t��an���G.��P0�7�优�v���<'p�߁i��7xU����k�����kp��8ǂ�>e~��V�g��S�F��Fzc�����5J�;rϔ�[�۩�S���QY+�/κ�+�f�X���T��$V',x�{-�pP�ɣ��I���Jh#<�V���j���XBw���F��y��W8�������"q�����p\6��RH���Z��)X�}S����uo`=����m����P"�hyH�,��I)�l�HJ�XhC�"�dqD�~�����p����e���*�L���ҍ&u��!-����A[����`ДE�H�=)��͢t]ҿ(ૺ����*|��,�R�6��2�w��c����S\�G��}�Ѻ�7� �L;_$}D� ��E<'I���Zt�p�]��>h�� �7 D�"�#dA��ҿc&JlY[��F���`����2�+>� �aդ�^ZP�|�y�hmS�AdT����[?spW��i�,Aᾔ$��Y22��ާi�Ȍ����L����BN7��-�X2�^I>!�v��Z%�1��MF��N~|3�3�c��4ʼD�����O"� ����L�1!<�4?�LJ�����b��D\�_<q���ͤ�,��B3�$��Q���&�ѵ�AӘ`r5��I0��sv���p�E�}&�/��Zi��eX�����H ہepB�BӋ�t�v����bwH�6?u�a�D'D������Z���y2s���X���>D�n�ں�����f�����z��=>C<j�jENJ���EN3f�������� ������0<V���r`� )d?���.��\H H�UZ�H�}�y5BE���k��M�ԮPID���.y9���)�E��^�L�)�Y0L���V���x,?'�IZr��������+��c�櫨����U���w4�ઊ'�Yea��R;/�H�(\.t0�������7�Ko9�U�]�"`����s}�m5|���)��G��aSD�ge�����˭Y�����jd%��9����d߉���k{/�6\��K�|��61��E���FHQagʮW������r�@��SC�)l=�5�v�8x�E3�[��6[U�|�@BQ(��Q��r��������ġʏ��|�㴹f�_w����+膠���?Ai���!�ی�`��sn`�'��9�q��i��}���[��e)qtb\h�ɷ�stS맦���J��~�i��I�;U1Y�7B�Pp��� i�A��n�R���b�b��(�3/=0b� �=��"�E1ߒ����z�p���[����u��ͷXP;1��4E���Qo����!��˭��6`�N��$`�~4�D�����.�`���)q?Fi���T��UoCܜ"?'��k�L�(�z���������Eg�Uu�s٫�}���'5π5#d.V���%���qH���^�9LǪ\k�]b 1t���6���Քk:�ʆ��^z���z����{=z�'0뒯��ꁠ� ���:;`�kh�M���99�A�V{�ü���kn�ǂ�q�eL�{ܭMϣ��U��� H���$���;eT�g%*�%�,����)v"��"�,Rb2y��04�e -Y��_�S�ֵQ�������풱��4�y}�i2�=a�5��%�d�C��Ψ"�M����>�����_&��� q��4*���ww���m�%(�;��[�G�c��;�gR39Y��z�O9ïa���Ɂ�����:$aj��ْpi����6%W�V˅Be��\��� �T���qh�Y�7�-����4>�E#c���J�D�M�L;)A��h)�h����o�PS�����>�֠!���#�ưq�����(��y�`k�L���C��kNҥ!k� �(���T�V�W6������%eE|�q-,Rڭ){��� �C�h��R�>�:���$t��Ǫ��(�n�_�k`>Yުa ڣ�A"O73�d���5^�d��F>@��쐻+����y+��M�`}��e����؆�����C:t�!tz��{�\��eEF�\kNrߓ����A�fI1�x�R���?Z-rN�7����U=[P]����hOb��tE��,���7�"^+�`y0K0�a��g�V*�Aa��rӰ���������2����X���/��BW���� �-Aw�+�0�Dܥ�%���y���'�A!? 9����n� �ъG�Ha)nv��L?�;c&��n~�y-鱃�;����ތY�N3���+23��r�CK��.�[ �����0"�Q1-� w,�+W���8{��(��G���9lD�?��ݲN��<��F�l]�a��;iz�NzE��e%om,�_(|e�]ɗֵBi��-gg�H�-"�#\�a�я���\ �dW��EwsNL����$'q۩�������;�,rP����X�]����m�����U��iBq��E_Z?�S�����3,&W��%�7���8#O�<��E�Y������D����u�����}x��,^��̄Ԯ��vƹ���p�-�l+�r��?+�����2-�g�F�`e��j�Mlc�p� *���D4�U���z�v��|�F7�l�8��^G2��w2����[L�d�CL���� �w� u �9_��P�xf"��a�X�]�>�Zx1�s��. �˭��'�P����s�BBC�D�S\9s����'�ۜ��cd�a�o�3A�wc���@��8���x�������ʓa$ֽ�T ,�I��읓CL8#��]D<��8�!�*k��i�]�4���������� ����y��H.e�ٸ����U�7�YE.j�O���*�tX-�r/ygDn�65e�������[��# ���;����� �k��V�-kC0W�d��P��k =���XSX�RS��7ʽ�-o��p/�);}�v-����d (g� �V3�d��� b��6V��&B�H�j�j,��?�(e��q����\��u���L| |�s��!?�-�����hfH6�}��͈:�G���w�1 "T���G��y�
Static task
static1
Behavioral task
behavioral1
Sample
CLIPStudioPaint.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
CLIPStudioPaint.exe
Resource
win10v2004-20220901-en
General
-
Target
CLIPStudioPaint.exe
-
Size
25.9MB
-
MD5
c544ceb09b9f925bbccc8aa8672d8049
-
SHA1
384a874b2b8405b1295568b409ce45d584b2fa3e
-
SHA256
bcbc48b1985356c023a47416ea2d231c986b965a05ac55afe6e71ead0b512209
-
SHA512
562a621b3221232822c809887c62f903371588b8e86e19dc406fe6c25b2fe3cf872785de9c327828afc02fa3ea8d1e8458285730731697fce63c0abb6d3ee39f
-
SSDEEP
786432:eJdSbLJmw3gRB2rexeG3jirSOsA2Q2DOz5:e/SbLJiBaeBTC12Q2DOz5
Malware Config
Signatures
Files
-
CLIPStudioPaint.exe.exe windows x64
3631b4f1889ea77d842596101c2e5ad6
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
boost_thread
?get_current_thread_data@detail@boost@@YAPEAUthread_data_base@12@XZ
ws2_32
closesocket
qmpdkdll
QmPdkCharacterSetRotate
crypt32
CertDuplicateCertificateContext
kernel32
GetVersionExA
GetVersionExW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
GetDlgItem
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
ConvertSidToStringSidW
msvcp140
?_Ipfx@?$basic_istream@DU?$char_traits@D@std@@@std@@QEAA_N_N@Z
bcrypt
BCryptOpenAlgorithmProvider
shlwapi
PathFindFileNameW
imm32
ImmNotifyIME
msacm32
acmStreamConvert
iphlpapi
GetAdaptersInfo
concrt140
?PPLParallelForEventGuid@Concurrency@@3U_GUID@@B
vcruntime140
__std_type_info_name
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_beginthreadex
api-ms-win-crt-heap-l1-1-0
_recalloc
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
api-ms-win-crt-string-l1-1-0
_wcsupr
api-ms-win-crt-math-l1-1-0
hypot
api-ms-win-crt-utility-l1-1-0
_lrotl
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
_time64
api-ms-win-crt-convert-l1-1-0
wcstombs_s
api-ms-win-crt-filesystem-l1-1-0
_wrename
api-ms-win-crt-locale-l1-1-0
setlocale
ailia
ord210
giflib
DGifOpen
jpeg62
ord50
libpng16
png_destroy_write_struct
tiff
TIFFNumberOfStrips
comctl32
ord17
mscms
CloseColorProfile
rpcrt4
UuidFromStringW
version
VerQueryValueW
avifil32
AVIStreamGetFrame
libfbxsdk
?GetCluster@FbxSkin@fbxsdk@@QEAAPEAVFbxCluster@2@H@Z
zlib
inflate
gdiplus
GdipFillPath
wininet
InternetConnectW
boost_date_time
??0greg_month@gregorian@boost@@QEAA@G@Z
winmm
mmioCreateChunk
boost_regex
?match@?$perl_matcher@PEBDV?$allocator@U?$sub_match@PEBD@boost@@@std@@U?$regex_traits@DV?$w32_regex_traits@D@boost@@@boost@@@re_detail_107200@boost@@QEAA_NXZ
glu32
gluBuild2DMipmaps
opengl32
glVertex3fv
gdi32
GetCharABCWidthsW
comdlg32
PageSetupDlgW
shell32
DragQueryFileW
ole32
ReleaseStgMedium
oleaut32
VarUI4FromStr
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 47.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 8.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.7MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.krv0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.krv1 Size: 22.5MB - Virtual size: 22.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ