��$"�߅��@��'Sے��b�,yd��n�����5���"rv�WS��^N���e���!y�;`^9�t�"��=c?J���m��%���fȌ��0>�mB��'�d8� ��3��ڏ�V��n�K������F.�H�?�T5��5m����%�E���6��<��Oz+5� d�J)]+��T���X��>87�>�R����Dʔ e�E���6h �-d�������R��F��_�t��`Qw�8�t��L��4�p>��͇�7>A�k����MI�B��{��_�3�Mᨫ����\���_����O�VM�\l̒!5�墙~Q���]CZa]~��ۮ��|R �� ��6��:���ڄ>s_�fyS����6 Ĕ�Ad�X����&�3�S�(w�`;�����~���$�+'~�+��z�6l���� ��L+��cA<�a-'�e_���aR�~�Sc����Dĺx� ӠPm��N��> C_)��C����Ax���8�s�> �ۛX�3F�l��Q��T��^���/�D�ߞ�Z���Ao]W X��?}�;�f��4;=���N��F&��� Ll|�x�I�LP�j����{�s�����b���D�o*(�'3��u[���ԇ�{7#{�o��:�}�,C��-����(���X���x��=FJ���M�%�Yo��qz��ae�A��������J;��+�I�(��p`�q���zϧ�18<��gF>ϑ�0����� �8E�7�zk� Ү��O{�~�]�m*&Gߪ,���tt(E�~�;E;�BM�+ӎ�A�z����?JbI,�&먵:�����lJX��D15b�ҍ����cW��� _��;�F�)pPP���&+���{���:i��?^�V���B�q׀�0"IJ��/W�0n�@��$��YX[�»H��՚B�R�P����i>�I��K�C$�+-�m}Sq�XPUMo>l����Z�����Ƭ�Й���H�e�oz��n�3��[٠�ϊ��;�k����Q�6.; ������MB��R��+�T�f���ikh��"� ��������S�X���4M 璅9����+pd�3�r&՞�|�U�������d��~A�%U�=$��g��,,+ǂ7��$XeS�L�e�Fy����V˩�pkah @�$��g� � ��^yF��Nx�>^�D:�[dMW-�y&��*�NH���7���C�/�ț��&��j� ɵ.��,`(Vū�v&E���3i@����Iн���b���|��@��"�0�s������#�r�T�I�� ����$<�_&�_����9�� ��;(���@�d�X���o��e�T~e�<�T�[~Dq���OT���س6j6�v���������t���y��{�NL�2V�g�j��-�r2���Lr.�Z�8�֓q��k�VKU��8-�A�?D��+`�==��7e<��oh6�)�5$;� ^���ӂ��ټ����w2a��+̗������ϋ$��������=��3E��`�pTă-tAvLM�9SQ����������Oj�s5�;��p�&�t��[3M�����n��7«^��C=wMw��E�� 'H]¼��;8}o40T�4%����L�obυ<�����^^�L3?�V?]�D���R�%O]O��ɾ��Iύ����R ދ�:��h�� Y��v.�{�����v:�� ~-6�$�1!������L�X=�[�0x�����J��(��V-}����q��Ha���ȧP�����MX\�T�����F��6�TU �~���c]��#��#������ȴʥ��f��TXo�WKR��8x,! ���P�zn/w����4����x@U�b�F>������6��=V�]?�\�n�x�=�Ja_B�FMm#Z<�B�@�ls������n~�ɶ@�d�����`|�3�/�..qz]����]pV�j�-�.�Z�������e?��`��Ȃ���9y�͵�AC>���;x�ɿ�S�]H"�/j�6L*�|ig�MC}��j����1��2�,E q�4���}�NK$+Od��k�に��ŵR��!să ��b�~�0�W����������" ����jBTe҄��e�|8m�U�%0�V1@8�m��Hs��vm�}[�SK7S� ebO�CI��{ )e$������3*��|�Kv]Ev5��'�Fa�����_���L���αg'�\-�jcq��C�v�w�s HB@��(QaG`�ڠ�IB�F�]HԘQ���Yؾ�1jeY���j��4c��}*��1�9�7�����up������s_�v,�1�ntL� ������#)�p�}L�*���(����0��f�����W�7�rt���<�}z���리�Qa-�j�%6��[�����#2�g����8wK��k1�����uq����3�����4�Kgrn�����Xk5|�ek���sC����!,'�Wk�F��!6%ژ�"I%DcI�4<ش������/�N@>K9�x��r�&����7��":d.j�~%t���R���&m��@ml�~DN6�H�rmyg���D����B�mL� �{�72�Tz�k2����j�w%��(�x^������Y-96h��⨒`ka��8��_��S���Փ�@� ��H���ҺP�wQҽ�[�7AN���|�?�����'���,�Ӕf���<I*������ɇi�1��) A�i\� �8za��;M��OOw�ؙ�Z�Ḥ.s�H-�j;�l��zP㞮4.��z�}סX�a��]C� &dK8�ܤ�p .:{F��A�)IKJt������ǰ�������=�zY�l? ����B��\ԣf9��Q��s����.M��"p�R�\tO*��kI��3��� jۈ Ϟ m'V��g"�4x��lɇ��%j#������r�n�<WhE&�vi$��AA��sjz��q���r&q�Y���H�a?�k�E�I�Y�wSV!gE��Ov}��o����\��f�wؒ �l� ^��ӱ�w�zW����/ 3�����S���K=gZŞW^m�iCǼ
Static task
static1
Behavioral task
behavioral1
Sample
CLIPStudioPaint.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
CLIPStudioPaint.exe
Resource
win10v2004-20230220-en
General
-
Target
CLIPStudioPaint.exe
-
Size
31.9MB
-
MD5
4e182e3d54c37ef0c427146110aefa48
-
SHA1
a3c1624e1d7edbc74d19b6554d04069ae8bc8b03
-
SHA256
e0d3053748eb59d0ce45588c8527e3110feeceb676d7b39c914d69a072e8fa23
-
SHA512
0108a8115ca036f38d4b01b8d8e4a9f0258bf6085f1c5d065500c3a57d72ef254541026ae4d13437bff36fbc8782ccda5bb132e8721c4ecaa1e388360bf657bb
-
SSDEEP
786432:FcOd8fq70/OKkKAptGC4/+mLAmuVMoDvp5:FZd8C70/Ox/wLg/5
Malware Config
Signatures
Files
-
CLIPStudioPaint.exe.exe windows x64
9373df6e5b5580d005029a76ac14f845
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
boost_thread
?get_current_thread_data@detail@boost@@YAPEAUthread_data_base@12@XZ
ws2_32
shutdown
qmpdkdll
QmPdkSetForcedCopyPose
crypt32
CertOpenStore
kernel32
GetVersionExA
GetVersionExW
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EnableWindow
CharUpperBuffW
advapi32
ConvertSidToStringSidW
msvcp140
?id@?$collate@D@std@@2V0locale@2@A
bcrypt
BCryptOpenAlgorithmProvider
shlwapi
PathFindFileNameW
imm32
ImmSetCompositionWindow
msacm32
acmStreamPrepareHeader
concrt140
?_Yield@_Context@details@Concurrency@@SAXXZ
vcruntime140
wcschr
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
__p___argc
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
api-ms-win-crt-string-l1-1-0
strcspn
api-ms-win-crt-math-l1-1-0
atan2f
api-ms-win-crt-utility-l1-1-0
_lrotl
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-locale-l1-1-0
___mb_cur_max_func
ailia
ord260
giflib
EGifOpen
jpeg62
ord77
libpng16
png_set_compression_level
tiff
TIFFNumberOfStrips
comctl32
ord17
mscms
OpenColorProfileW
rpcrt4
UuidFromStringW
avifil32
AVIStreamLength
iphlpapi
GetAdaptersInfo
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
api-ms-win-core-winrt-l1-1-0
RoUninitialize
libfbxsdk
?GetCluster@FbxSkin@fbxsdk@@QEAAPEAVFbxCluster@2@H@Z
zlib
inflate
gdiplus
GdipFillPath
boost_date_time
??0greg_month@gregorian@boost@@QEAA@G@Z
winmm
timeBeginPeriod
wininet
HttpQueryInfoW
version
VerQueryValueW
boost_regex
?match@?$perl_matcher@PEBDV?$allocator@U?$sub_match@PEBD@boost@@@std@@U?$regex_traits@DV?$w32_regex_traits@D@boost@@@boost@@@re_detail_107200@boost@@QEAA_NXZ
glu32
gluBuild2DMipmaps
opengl32
glGetString
gdi32
SetTextColor
comdlg32
PageSetupDlgW
shell32
ord680
ole32
OleLockRunning
oleaut32
VarUI4FromStr
Exports
Exports
Sections
.text Size: - Virtual size: 49.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 8.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.krv0 Size: - Virtual size: 9.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.krv1 Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.krv2 Size: 28.4MB - Virtual size: 28.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ