�p@k#��������L+�t]�ԅiyuf��t�"��Fb���{x]=Ͱ�"?��������2�������h�u ��'�Y�j��;b������i��;������0*f�Ik�ij�7( n� �F�AK�ti8�� �e���Ao�xsy�"�\���������<���"Y0C��F��w�*8�(�t�?��o���U��� �A~�����V3�LV�-�D�`�7��M��.�8D���g�v";�u/��N��0�u���eiNm��|jف��^0̇�� ��W�uB�}lⵀ����!�����V6���B�g�d�r˅Y�"j���`@��`yRgj�������T�X�&Z3�� �E]%��mb��& c�/�I>A���.)�_�����v�l->�z�(*�����z��I�L`�o$��� TXj�i�,e�H�8��F�Ts��)�Ĭ���>��Zp�?|�,��������v���� � �)ӡ�/g�4X��o~xZŃuni���P���}��+�j&�kp([�`p�!�A��2� �e��=�����."�����&K^�Э⪟*#����9->����~�6�����n��B>XV���I�\�`yߟ0�^N��e�K^��:ѳq+���W�i���U���X�yb���{��t��]8�#����x�:p�<c��Ѝ2{r�e����IJ�84�d��*�]�N�3O��=�@�SZٻ�(���Y�w�Rl��9�gQ�"Ŀ��l�N*��ޤ�F�;N�ηF�M���[w��H�:��6��h�&v�Ba�y�*[�ބ����v�����6��¤P[MQ>��f�h�����:���-�wްzc�*�9�a�KqD�g���i��A��`��ˡy��ՙ챘�/� �O�{�� .� I�O���>N�tؙ>Jx�Bq�i�a;��MK�ml��д��ju��]�||�Alh�x7<&@a�O��Yj��To&��Cl���l[E��?�F6Fg{R�I���Q���@i9d�1Hd�7���=���T��~��c�G@����^�/���I� �?�a^��ɾ0�@����Ʉ`���$2Q����s��ɒ�o(4�4��cw�착23�� DnjV�~h*ޡ��(R�ŶP#Z�%���mI��TS�3��|j�^�����?�\\z�Nm�M3D�m3����IE#�h]��5*R�Ί� ᴮ��;�ƶ��*�CLy5|�ԭ�GO ��80g�T(��������ih�5�����c�0��_��/�Xm�_��]dS����� �c�e���FO�$����i��D9�=�P�n2//H��+>Vk�E��M#fR�+��vD������4S�O�K:��I�Ń^�U}]ҙT(��V���L_ы�JqB-\ک%�ߏl*�)mR��T�UL�0sJK��n��ܪ�i� ��o���)z��>��2�ay�p�6� !@1�ʄ����B��u�{�4��#��djf��R�:'͵a�f� ��nf�?D�<d�sx��DH%_S�0��+L�̰�L&��o�C��`iqz��bG��aAO�.O`]�Q���e�:�Չ ��7�b�%���$/���������QK���T�k7��<&�i �:A���� ��.�Dh�d�[�ӡ���������|��yC��}I`�n�����DTg5���x��U�� �Y�E��(��ZD�����>�o����%}�J�1J��=��P��+��ɜ��i����5��˷۬T˦��ɁP6���[��)ouX8�U����[��V6��������� �e|��ܶ9W?���q;��e��6x^�����Vx]�a�p�ې1M���W���IЅ�@h j����U����Ȕql}�������=���qU�JB纂 �MV"!�5�Ы����h��ř�3�,�l1h=^+�Bm*�<�Ȇ��5=,K���Nv�}��h�%W�U.�[~Α��t^�6���I��:��ƻ�(V� �E��*D��O ����KoX���D@JM'}��9�T�O+1ʀ$��We�3�9��Ԙ���hRƁF#*���-f��v�Ҡ <G5�}a{ls�nRf)뚦�t�^�ַ>�32�B����m�z�S��\m�ϟ�Ň�P�ti/�,���J9��0�ܿF�7�#��Nbe�QS!�v�Z�So���ć�6���ɚ����X�:,A41�8��������xn�Վht�Sf�]��D����e�X�t�C��Q ��e�L�(����=�ZU/Ί[�v�yЭ��1.��<���X|&��lI��� �!�!����g\��Ј?��i9��Dޠ�r�9�7B҇�v�&���:�1�4�{���D%\��j��n�zí�#�7@��*d��x�����TMq�>�=ǻ"��[k2�4�M���'����#��2}4��ZWFI������˯��f�p�`�H�; �f��O�2��K7��n�b�X���cG�M�: �q}�@a�W�p'@�u�� �C���IDN�ri����z�Q��Lf$({i�h��ڄvϓ�_8M�W@B*z?���Q��t%�i��ͰR����ak�β�Up�Ӭ���'��/�9�sәXL��l,f��?^�-�����'�y�j̴��]�u`U�����}"�v��8ތ�"V|m��q�߱m�.cmr�C='� ��/m,���Rê��Ҟ�H�Mf����9�'7�.wKZ��P����_��\.�2���Z��DN�4�[���D��1!��ɧzA���M�ƛ[�/��Χ�Q�5�geY���J}�fa6�O�N,�iEN"]5��C�'���b zߟ�G��X��X�UM� " sr%��q���,���G Li�D~��z�bՌ�Z��%�ޥ�pv��9k������`\���)7pϻ!�Ng)�v�ޅl%f���'�@�(�<�X�U��$��+R��0F�"��"My*�p凗�=�q({�e���~?Ή:�O��`f�v�6�j?��H�:�ɏ���3^8�Z9ҕѮ�!�D�f>��F@��4�����bS�*��Wh�8���b�`��
Static task
static1
Behavioral task
behavioral1
Sample
CLIPStudioPaint.exe
Resource
win7-20230831-en
Behavioral task
behavioral2
Sample
CLIPStudioPaint.exe
Resource
win10v2004-20230915-en
General
-
Target
CLIPStudioPaint.exe
-
Size
34.7MB
-
MD5
be34e95f0263a783567b4b40a0e68cbe
-
SHA1
e4703b2af5dafca11b8871e1792c5aaddbbe25e6
-
SHA256
12e79c8d521f0ea0ba4a6c8fcbb8295e15f2e89969651fb7ed83256bf3923140
-
SHA512
e900a262134a83f5d5a0421468f3f2e9ca84c369e327369686e69c6d0ff93849eb547212b96e853da2e80404e56e90a417d460ace69a60c9e0b5175c6c17ea98
-
SSDEEP
786432:3tR9pCWiEGX3/5LzWgtGjq9Qb+7MCYbPbjIn55fD5:dRuWiEGhLzRtN9W4MBPb0n55fD5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource CLIPStudioPaint.exe
Files
-
CLIPStudioPaint.exe.exe windows:6 windows x64
8a142fd1d331be0d09c52f2337245c57
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
boost_date_time
??0greg_month@gregorian@boost@@QEAA@G@Z
boost_thread
?get_current_thread_data@detail@boost@@YAPEAUthread_data_base@12@XZ
ws2_32
recv
qmpdkdll
QmPdkFinal
crypt32
CertFreeCertificateContext
kernel32
GetVersionExW
GetVersionExA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CharNextW
CharUpperBuffW
advapi32
RegDeleteKeyW
msvcp140
_Thrd_id
bcrypt
BCryptCloseAlgorithmProvider
shlwapi
PathAppendW
imm32
ImmGetContext
msacm32
acmStreamPrepareHeader
concrt140
?_Schedule@_StructuredTaskCollection@details@Concurrency@@QEAAXPEAV_UnrealizedChore@23@@Z
vcruntime140
__C_specific_handler
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
api-ms-win-crt-string-l1-1-0
strcspn
api-ms-win-crt-math-l1-1-0
log10
api-ms-win-crt-utility-l1-1-0
bsearch
api-ms-win-crt-time-l1-1-0
_mktime64
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-filesystem-l1-1-0
_wrename
api-ms-win-crt-locale-l1-1-0
setlocale
ailia
ord250
giflib
DGifCloseFile
jpeg62
ord31
libpng16
png_read_end
tiff
TIFFNumberOfStrips
comctl32
ord17
mscms
GetColorDirectoryW
rpcrt4
UuidFromStringW
avifil32
AVIFileGetStream
iphlpapi
GetAdaptersAddresses
libfbxsdk
?ClassId@FbxSurfacePhong@fbxsdk@@2VFbxClassId@2@A
zlib
inflate
gdiplus
GdipCreateFontFromLogfontW
mf
MFEnumDeviceSources
mfplat
MFCreateMediaType
mfreadwrite
MFCreateSourceReaderFromMediaSource
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
api-ms-win-core-winrt-l1-1-0
RoInitialize
winmm
mmioStringToFOURCCW
wininet
HttpSendRequestExW
version
GetFileVersionInfoSizeW
boost_regex
?match@?$perl_matcher@V?$_String_const_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@std@@V?$allocator@U?$sub_match@V?$_String_const_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@std@@@boost@@@2@U?$regex_traits@DV?$w32_regex_traits@D@boost@@@boost@@@re_detail_107200@boost@@QEAA_NXZ
icuuc65
??1Locale@icu_65@@UEAA@XZ
skia
??0SkTextBlobBuilder@@QEAA@XZ
skshaper
?MakeFontMgrRunIterator@SkShaper@@SA?AV?$unique_ptr@VFontRunIterator@SkShaper@@U?$default_delete@VFontRunIterator@SkShaper@@@std@@@std@@PEBD_KAEBVSkFont@@V?$sk_sp@VSkFontMgr@@@@0VSkFontStyle@@PEBVLanguageRunIterator@1@@Z
glu32
gluOrtho2D
opengl32
glStencilOp
gdi32
SetBkColor
comdlg32
PageSetupDlgW
shell32
DragFinish
ole32
RevokeDragDrop
oleaut32
VarUI4FromStr
Exports
Exports
Sections
.text Size: - Virtual size: 55.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 11.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4.2MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.krv0 Size: - Virtual size: 9.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.krv1 Size: 14KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.krv2 Size: 31.2MB - Virtual size: 31.2MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ