J[ �98舭�d�Z��X�hR��BV�/>E6��~,��2�Y��}�=E �_�[�⼄���V�;��>�A�?Wv�-U�2�pU6�� ���C������ML�����ϱCsY^BuxРI�����2�1UB΄ $Ӓ�+�Y�y��1���e<2:����M�� mM�57�@�g;��+,o.��8(1��y�t�B��d�*����oE$u���xF���wr��I'h�e$�',ů��%��fS�D���[Շ��#I7^� ?���ﴻ�G������ ��V�����@4 �:�1�/O����ކ"P����Ṟx�q2�$N�*p�����?4J�Qk���b��^q����TBv�L�:��������鮺mQmR��ߡ�Ӛ�;ͣuzQ�aV�;���9�l~ �MQ�Ì�$�4�W�vF]���X�ႨI�V{�ދ�¥zT�r���!�X�I���`�d��o �Sܪ2o�3l�YȮ�,����h�U�}��H������"۵�;S4_Of��%^���_���>�QgӘ� 3���$�ϙ~<h��L@<�� �}��m��9��t�ǕG(D�B��T��2�u����L}��G_ 6�2@����)��K�љ)����n�d�.w�����ٱ�/�ņ�����{h����U��O�2�a���6=ë�����a1=Ĝ;L�~�'lj ��6��O�L6���ƭ��Ugw7k��9z&��Z��� in���R1���8L z�ߚk1�H�Y:������B�7����F�T���D,S��(� J��ڔ� rpT��L�m�1���\�"vX]/D���겻��ĵ�ݡ�*��ﳭ�.�aC/�qilT-�GeXx��H�NQ����qn�!o�F���g�y�3���ԥͤ�.o��'SӇM�7�B��z|N|����k�Bj:Ŀ\��uv�>d��rs5'�o�,ջy]d۟"X�\Ϙ0m�����R�]K ��0�w]G�['���*���^����ad9\&���0���o�}[;�F�Z�=l���sT �������C�fxoX�*x�ќ���y�5tMEy���:���6��B�v��������=� ���HZ<ά�UrN+��Z���� %�Ѣ����삇yW�0���ٖ���7ME$�L��x�87��>��x���\�?���I~��F��j�'�>0�a��$_���s��~"y��y�s�������=J�9`;�ֳAI B>K��Ew��[i��FC��|�]I ]���Q=혶��T{���'����^��7 #����`�d�!����G:>6 �@��o٦�5�U]���R9���v�lm;���%eC@t��2���Y��נ�Lx�d�O_��(8&�Z�����3������58_ϴ������q��!8����ǣ�8����03��K-���������4�hI%8tX<J!iVdw���iج��%�H` ��W�����Ɠ��As��}2x��ؗ>�4��#\� ��K<Gl��K5l`�r�:�N�:J�[��+2'�N��~���hW� uc?00�'&֒�&�CO��\u}��l��T��p� �y� qV���]��dp�w~�=���k��A䗩��{n0lzt���g8Wp��h���\B:�QL�z��=����AP�e��r����B��������f��u�����������F�����l���(n��� K����q��Ai֡���{T���+�j��ۃH'��X.:tJ(}���l�I�$�l�z�Ϳ/s|���ʍP�({��%Z�B�!��V���&��";2� n ]�D���Q��cԧ�q%"?>��c��;U�/�brD�8 ���Z�)ڑs� �v����G'�J&j�����/�dWz(n��_���I3mӥ�5�;�N �s�O������\D�U�* ���#�'�p��ʗX��q�w �pA9���~*䫎��bDP�)6���c2�P`ٵD{�mz�����:�xO��T��1��˼A��{���E_Վ�?x�._����p��.0Z�?`W���I,���y���}�S��B;�I��L���J��S*�F�Z0�ש�9�8�`�}l����+F]��p��g��zU����Z{�����Π�fj�!]�֭9�/:�f�=5 !ַI�%v����}_FiG��oK��٭�7��c��wa���g�!wF�q��6�L��R����]7D'�o�NBt��p�w�/P��_�(F���m�-��|�"�������!� qt�2����ٮ,ͯ+/��E^��3"����?�1�c %s~E�Z��4&5��=a �(+ bc�5�����~���nU1c�����!��I� �X�_�9��¹&��g��l�mشIO�O����K�2�t V�Da�����}b���o��=si���ͨ̔�q���7�Vfhb��:${t0�7��w�����ؽ��Y�����L�m��%��/ff�,�q%:�h�ѝ��x��IT���2;M��Ę��B��<�Eҥ�H">�JM69�@oK�KOհy�À>T\v�(~y1l��r�����0�� �"��ܧ����P�{��|dMg���$K�2�\3]��wS�©�Y���T䫨���gߔX���� �B913�0�D�b�z�xpCj�ʾE��QM�6�0�B3�;&O6��Kl�1O¿�[#��+(�We�]�϶H6ma��k����ΞUF鶖��.PH�7�� �Q J�����H��z�vΤ�H�A6C;"�x���h��@yF�6��j+I�����R�N���_6<7�ӏ�pOy��[�-�j�z�r�M�������G�@�}�`iZ�D��F.�ך��4�Z&Ü�r�s���F��`�ܺF��� ���W.��ӷ��������e�k�!ȼ:���B`݄y�{�$;��+@z����ur��<Y��-�K���h��@>1fi� 1騽8�b��jz��jK7�����t[�f��8m�'T���m���9:ʃ�O�;�� �n���K�kX_�O96Iq 4�
Static task
static1
Behavioral task
behavioral1
Sample
CLIPStudioPaint.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
CLIPStudioPaint.exe
Resource
win10v2004-20230915-en
General
-
Target
CLIPStudioPaint.exe
-
Size
31.9MB
-
MD5
ca3bbafed2d19edda70f016a4841c34c
-
SHA1
053742d8a1baac033af716a22d625922f600b51d
-
SHA256
029c4910f01d96f04c5f0c4e6248fab98e1495f4650c921f81d347cc0bf2b335
-
SHA512
1ea92f67d41670846a2e268fccf9fce673ad73d3112a111e90ae28492f28253d29ab170d160a6aedf5f8f9783289e444c0e09e7e5a5bce9e30fb598d0435830a
-
SSDEEP
786432:oQsGWlROcYPyFO8gNsp89TzOFOm+NsINbOY7dOPy05:oC7D6FiNsp893O0mkZ7dOF5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource CLIPStudioPaint.exe
Files
-
CLIPStudioPaint.exe.exe windows x64
9373df6e5b5580d005029a76ac14f845
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
boost_thread
?get_current_thread_data@detail@boost@@YAPEAUthread_data_base@12@XZ
ws2_32
shutdown
qmpdkdll
QmPdkSetForcedCopyPose
crypt32
CertOpenStore
kernel32
GetVersionExA
GetVersionExW
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EnableWindow
CharUpperBuffW
advapi32
ConvertSidToStringSidW
msvcp140
?id@?$collate@D@std@@2V0locale@2@A
bcrypt
BCryptOpenAlgorithmProvider
shlwapi
PathFindFileNameW
imm32
ImmSetCompositionWindow
msacm32
acmStreamPrepareHeader
concrt140
?_Yield@_Context@details@Concurrency@@SAXXZ
vcruntime140
wcschr
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
__p___argc
api-ms-win-crt-heap-l1-1-0
_set_new_mode
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vsprintf
api-ms-win-crt-string-l1-1-0
strcspn
api-ms-win-crt-math-l1-1-0
atan2f
api-ms-win-crt-utility-l1-1-0
_lrotl
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-convert-l1-1-0
strtod
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-filesystem-l1-1-0
_unlock_file
api-ms-win-crt-locale-l1-1-0
___mb_cur_max_func
ailia
ord260
giflib
EGifOpen
jpeg62
ord77
libpng16
png_set_compression_level
tiff
TIFFNumberOfStrips
comctl32
ord17
mscms
OpenColorProfileW
rpcrt4
UuidFromStringW
avifil32
AVIStreamLength
iphlpapi
GetAdaptersInfo
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
api-ms-win-core-winrt-l1-1-0
RoUninitialize
libfbxsdk
?GetCluster@FbxSkin@fbxsdk@@QEAAPEAVFbxCluster@2@H@Z
zlib
inflate
gdiplus
GdipFillPath
boost_date_time
??0greg_month@gregorian@boost@@QEAA@G@Z
winmm
timeBeginPeriod
wininet
HttpQueryInfoW
version
VerQueryValueW
boost_regex
?match@?$perl_matcher@PEBDV?$allocator@U?$sub_match@PEBD@boost@@@std@@U?$regex_traits@DV?$w32_regex_traits@D@boost@@@boost@@@re_detail_107200@boost@@QEAA_NXZ
glu32
gluBuild2DMipmaps
opengl32
glGetString
gdi32
SetTextColor
comdlg32
PageSetupDlgW
shell32
ord680
ole32
OleLockRunning
oleaut32
VarUI4FromStr
Exports
Exports
Sections
.text Size: - Virtual size: 49.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 8.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.krv0 Size: - Virtual size: 9.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.krv1 Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.krv2 Size: 28.4MB - Virtual size: 28.4MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ