p��A����.������b�nQ�V ������;�&4:�-��i��l�cn��Nc�0�Q�Q��� pR��{��X�)ex�u�%�w�iJ�ix��Un(�L��p V|��)��R]AgY_W����2�o+��T�����ffuLk_��|B�K^����9�y�̄�b�]��r<~���˲Nkˉ�xS�y�ZqRAYR���r-h��ù����L4���PS��;��nE���Qhys��*��`ٗ��pQ�B�VM7$��/��Z}}�c�n7��K�)�L��:=�.k��lp�oa� �O9�.�Y���jαw����<�?��G�X�������H�0�C��Ζ�=T+��hW��bn�j9!�����$,/7���;��"���tG�g��M��/����3��1�T��4%��Gb�1��;����z������I�����6L3�n����#a�*C��efªc����;HD�XF ����\n_� ^tIm�K��X�q#GXGQ{��r��j���GU�I���cw�K'�bh7Zpg��g7�|$)�c�V��x����0�>@��O�>�� ;q[�aEo�fX�ݩ����Ұ����OǶ�x����'�wEJ��U-4َ���r�t��$WZ PAn����֤��`T~H˫���@9���r9���R�U:���VC��}�Ś��C�D�t���g%\r��a�ׯ! P���, @���d z�vh�d��k�a���!���E�Ax(�q�8˖)0�܈���E��|�`0pK�b=7ԍL?L�EG��^V��oD�{�X�ƍ�аiP��:8"�쇀)�f;.���NqHÀt�k�t��DeF�jy��,�%r;i��ߩ��f�X"7c��27Ʊ{��W�)�a,[�>B�K�94��.7�"��,�B�a8���k!��x��w���^��|�>�^(c�)�e�Xy�_��H @�8T���������.�m���w:��6! �uz~k'������M0�����CK�JB�}RM <=�L��#>�L:�e�X�+���lc�^�O���lY��7uۅ��)��,�$Z��O�z ��]�S�Ƞ�f�pv4f��S�L��!�5��Pׅ�� ��\�y�E�����oG�ƌ�bWز�}��M�w�&.�2�T/��ߠ�����eQX�rBj@Q&|�����UK�e#'�* ��X5�|)E�xr��&Z�������5���/l��X[�o�\%p2�jp�g?W�1�c<��^&�O�`)�*���)p�k��+3(�-��V�S#]����չ���2��v��������������G�M�JքY� ��l,��8F�ڏ��J�/"��u�]���o H��Q �b�H�mp&o�bEڣ�������������"�>�K�B�X��T��#`��m�l7��B�(����x�IqW�?k���!V^�V0*����D�o��B_���^It�F��y�F���[�N���R_I�Y�v����V�$����,�O�K�Ҫ���t͖�����������DL8�2sG�d���5� m�`c�!�_7R�5 V�lZ��oJ��m�ǡ5L<����)^e(��K�G�@nՒ�p�ڽ�� ;�O�hn(�j�X�"C���Ez41Q2�lZ���������6Au�b'm\�3@ot��@V��*�W/�;q���*��,f�Co�wϔK��w���������������]P(Iv�m����}F�,9��R"�9��w����ig��p���i�ZSc7��ׇ\��F�/7#=ӟ�=�*/��)��>8_��zV�/������������I{)ۤ-o��S�=2�d9'������vj9�@���+�����J.����ܣ�Y�M��3P�H�#F��k��]�%�4ɿ�g���Y�J�X��[�� �>�ŲԀ�Y>���W���غ(|�d��7vKz�u�(maYB�Nf�+,%�?.D�'�ɴ��N)w^5�{�?c���}\�ej�A�G��K��oҔ����l�Wn�%s��� a/QF�q��ЖT�$H�V�$[k�_�, Ǧ6I2�'����u�I��PGӖ��e��80�"CH��(���]-I�Q:}/f�&'�E�H��0}y����2a}/.☌�(�{F�X�6kt�3a�g��_��jK�/�[�z]۾����m��pۭ4\ǐx��'�K��5+��T������R�?�R!�G%�CB�[RB�h-��w�}f`��-T��/�����A� �c]�La,k�����K��ʸ�fT���G���_��m�K�JL�>l��7�u@S,b_������-���"e�uk`�fE��&s�]u7#�?w�,��C �I�O�#��� :$�e��m�����T�mV���:��|;i��!O��%�]�QY����1A%�?� �v�ŷ�e����ₗ�Q���U���z!�:$Q)�7Q����1?����(/��y��B�~q��� e�v����(@Ydp��4s� �m}�!���>��%.Ƥ��;3�q�����F��q�9�z�rY�;� O�����U/8�B��mh$Ōi��#�5�f L~@iw�//�*</�R�Ϲ���$B�-L�4�a�GB�wv�o/�m��x��K�Mgr� ��7��q��h[�F�rlb&�x�Rd�Ü��R����S)94܊eL�eɼ9*ۍ����;�U �-74�1�0��\&I�/�E�UfCCr��<�����i���[$T�u* �2'��kj}�0Y�A��m�-�F\:�9��MY ���k\*6�[= �QZ�q��<,K ^��,�뇡�k��rԏm^6�"��G��3�z��4E����#�Ej���-7��\�wc��!Y��;]+�Q�/7��O�8�H�0�Ұz!��AA� �z�����m,?ؐ��!��b�TU{�N�������H*�I�A�θ>����Ɛ����6uQVX����г���9�5�ۜ?��0�%�E �ʭ���6�)O�'�r��L�i{�],a�o�v��坌8�x����Ou�0��z��N,QA�[����z�"Td)�3
Static task
static1
Behavioral task
behavioral1
Sample
CLIPStudioPaint.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
CLIPStudioPaint.exe
Resource
win10v2004-20230220-en
General
-
Target
CLIPStudioPaint.exe
-
Size
26.3MB
-
MD5
e85e330b8aaf0e52cce1e553d4d04485
-
SHA1
1f4cab0066b2fc73a8b9cb84e0bb1256f878969f
-
SHA256
a0fb20633a60136efb6689b985c483f65de345ba182c30afdc1e3a6f4b6dc690
-
SHA512
f0bc5d8bbeb5fc21e7a2b8c3f41e4da467595cc550a0d121dfc012fc8fc6d43790cdc4724061c7b9d548f8d02beee69ecee95cd4c2605fee7b9762fdbb0a0df3
-
SSDEEP
786432:ZO2q8Lfn0ZKoNCz8N6KQLAlRIku2i1To:Zbq8LVx8N6KqAlGho
Malware Config
Signatures
Files
-
CLIPStudioPaint.exe.exe windows x64
867806cca77b37011b64371186c5be5b
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
boost_thread
??1thread_data_base@detail@boost@@UEAA@XZ
ws2_32
send
qmpdkdll
QmPdkDisconnect
crypt32
CertFindCertificateInStore
kernel32
GetVersionExA
GetVersionExW
GetSystemTimeAsFileTime
LocalAlloc
LocalFree
GetModuleFileNameW
GetProcessAffinityMask
SetProcessAffinityMask
SetThreadAffinityMask
Sleep
ExitProcess
FreeLibrary
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
IsIconic
GetUserObjectInformationW
GetProcessWindowStation
GetUserObjectInformationW
advapi32
ConvertSidToStringSidW
msvcp140
?_Xbad_function_call@std@@YAXXZ
bcrypt
BCryptOpenAlgorithmProvider
shlwapi
PathAppendW
imm32
ImmSetCandidateWindow
msacm32
acmStreamPrepareHeader
concrt140
?Free@Concurrency@@YAXPEAX@Z
vcruntime140
__RTtypeid
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_c_exit
api-ms-win-crt-heap-l1-1-0
realloc
api-ms-win-crt-stdio-l1-1-0
ferror
api-ms-win-crt-string-l1-1-0
_wcslwr
api-ms-win-crt-math-l1-1-0
fmodf
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-convert-l1-1-0
strtoll
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-time-l1-1-0
_gmtime64_s
api-ms-win-crt-filesystem-l1-1-0
_wrename
api-ms-win-crt-locale-l1-1-0
_configthreadlocale
ailia
ord200
giflib
DGifOpen
jpeg62
ord50
libpng16
png_set_compression_level
tiff
TIFFReadEncodedStrip
comctl32
ord17
mscms
CloseColorProfile
rpcrt4
UuidFromStringW
avifil32
AVIFileRelease
iphlpapi
GetAdaptersAddresses
libfbxsdk
?GetCluster@FbxSkin@fbxsdk@@QEAAPEAVFbxCluster@2@H@Z
zlib
inflate
gdiplus
GdipFillPath
boost_date_time
??0greg_month@gregorian@boost@@QEAA@G@Z
winmm
mmioWrite
wininet
InternetSetOptionW
version
VerQueryValueW
boost_regex
?construct_init@?$perl_matcher@PEBDV?$allocator@U?$sub_match@PEBD@boost@@@std@@U?$regex_traits@DV?$w32_regex_traits@D@boost@@@boost@@@re_detail_107200@boost@@AEAAXAEBV?$basic_regex@DU?$regex_traits@DV?$w32_regex_traits@D@boost@@@boost@@@3@W4_match_flags@regex_constants@3@@Z
glu32
gluOrtho2D
opengl32
glVertex3fv
gdi32
GetObjectW
comdlg32
PrintDlgW
shell32
ord680
ole32
CoTaskMemFree
oleaut32
VarUI4FromStr
wtsapi32
WTSSendMessageW
Exports
Exports
Sections
.text Size: - Virtual size: 48.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 8.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.krv0 Size: - Virtual size: 3.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.krv1 Size: 22.8MB - Virtual size: 22.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ