e�5��#����z��/a-�8�}ɍ�1 e���8�����>]��#�χ��d�;gm����z"�UeuOΔo�1'�/��12ms�i�4�H��8��AŞ4����bHK�N=�CR��~���&?6�/nKB�}�s����8�]ֆH{o� ��!�i@���%y�j`��6WL��o�����Mˏ������g��C�U<wc�y%�(t����dd�m��<m�E}v� �����˗�z���;�v�NI�ns�@qR(���������c°C.��>��E\�eS�l�/%�^�`I�OB�W!�q�����Ƿ�(�պ�_�[y\�2�Ft�Q��p����6| c����L/V*�U�tPE���t��������N;���xp��t~���!aJ��r�:~�L�p�KD/����oI���`bwGL��S�ϔ?�g�@ԏ��_tg_+��� �y����c-FC<sLQ�߱�CYSh$��,����� �6Qxw?�k����i��a5{^�%��K^uӹ�dy����J�uѹ�']�qS���A�X�=����H1K�$�=�Gd���Ď�}�D�������Y����i��-��CnN�2 ���ܒF�u�w��fw�c��� �fQxj��G�u���&>��_C���@.BLzu�����~+����{���r���'u�G� ��(�i#K0!Ł`�r����i/�GmޤY���Ԭ6tC�<�t�2`���h&�J��x�Q~=�>�Y�� �tƸ�j�`���V�'S[��R�lXƝ��XE�Kl�/qP�.�����շ��nO����%b/RE<�[��� ֹtp2��m͖�0�w�,Q�CzQ����|����1��1L�A��}��C3��U����hr#���@�R=ePM!p[�罯���'9��^�x��K�z��զA�wU�@���lw�H]X���<>�;N{ wv�UҠ^��gF�������o�����0�[�O��ﰐo�� ]-͠��͟��_�MQU��:O�>��`1~<���F��o� �ףσ8�����^`"$�[��w/�bQZ�W��GXߌ,�>�Â��6����0��[�~�r���4���ڀ�����4ء1Yatu�x��8�X+V ������ �o�d��,6�Ub��ꠣ�A��K����H�+�������ﱮ��OcW���M���>;�+�gj� ���'���ϐCUh���`�C��y�����+�t�J��D`m�MM��i���}��|����gt����~��'@VB��9��i\���,B�BV�ܼY�V_�&o"Q���|p���SO'ks�+���� ]օß17{�%o���O�´T��I8%�5�J�s�j�ִ��b���Ɖ�k E��v�D%"�����̩V^���-���{-��(�PPZ�#n~6R ��8(B�Ľ�]K��d���Y�7�!J�����q/�� ���h�HF�%��S?������ʿPQ��_��}�W㽪��g��i��ЅU�)ph�Q�~R �J]5K�����]_:�4ݲ�>偫W�jX�[�f�N�[l�\��;5ն?}b�>�\�k�*�w����%�O` :� 㖦��{GL �[+g陏T��{ǼslO��L^ /�J��c�C�S�di���(�o��x֨p%f7/�X�-Uɣ�|_� ��%ݳY��l��lu5�f�� ե����eq��X��VH����$66H�� �nz�|�ı J�������R94;d���|e$6��fK��>Pq�!���|�Jf0Z)p��D5�U[���đ���cq�-����H/j3�q�Y�.��/����319���3���٫U m�~DB, � 5�ָ�����Իd�^ʭ��ߊ�q6,���C2������Ȼ����E��������E�ln�ua��|�r��������qr��ʆ�B���3ݶz�����{��*����{M��A�B����s� =k�N�a�������S����ָ'��7'�3L��+V�&�z�1D��D��!�����k�t~,]w�f.�ٮ���)�ƪL�u��U��z�<qgfv��"��.u�\���[@όxN%�yq�����o��~) �&r��|V�?P�ͳ�S��!��3ԗ�G����P�G�&���Bl��V*)��o�]{�����$|�k!�KbU.9�f���թT��L(.Q��Rs��T��p�M�,�E�A��rs�,/�m��D5�ug���~�4)] ��b��؞����J���)��Ͱ��θ(ԇ��^�yKd���)Ի�NΗ���杭c)��m�p��d������Srv�3�����Z'�ċ��� %�1G"���R:��:P��{Q��d�Cܰ��4��$u3ȧ��3�5*����\��7�3uްxq�w�^�����e�GwD;�K�hE�R�+�E���gj^J�g� Xw��}�p��� �1��cH;OP��ٍ��9�]JϹA秘��RB~�|�E��/q�{%Z�l����H:.S&pG��\��k��15���˫�6�������_FY�:�N$�V���M���E-\���DP����H�~g�~�Uc�8֊t]f|nfd�)˳-�t�s�x�'b3K �ծ�6E��~���K�舘vY��� t�ͱ��R���)��ö�� H9U��pm&&��K)�i��i�h.����*�)C���*�oӄ�Jq�9�)f��Һ�M���j Ryݥ!WŞ�y��z�dxX!��%Lmo|"���iޓ�����>�ě���y ���|�N�"�����Mj��UrH/,�bтm�����٫tӚL:TP��g'���0����:��CǸO^G�����&��+U"9��6�E��V7.����]�{�$Iq���:���t"�@qG6���(_ެ��$/�y�5�ia������^���K��cO���!�_�Ԛ xE�.NT�M�� �N����ɩ��9�@T�@qCg���@�mpU�iY�D�W����B��q���z ��0��������F���KpMY�
Static task
static1
General
-
Target
CLIPStudioPaint.exe
-
Size
35.3MB
-
MD5
53231d1f6f6ef97a2900d8b54de10e97
-
SHA1
a4f2b153d5c3787a41268e963d0705e5e7562714
-
SHA256
f718a2c7314f22029e508b072a65df3e2f86127bc1b94f66ae6b9482fc8b381d
-
SHA512
009e11e4ef6592d3a3cdf600d63eb8ee9870ba16df13ebfc15179e491ae24364584d25b1db86924cffe788e5901f5877a60339dccc60d61bfceb2d8f35486ea1
-
SSDEEP
786432:wmSJ2pMSdIFPXHe5jniRmPq9aD3nPOBXP+qGgN2hnv9EdEboN5:w1Jk7OJ3eBEEQE2BXmGawx5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource CLIPStudioPaint.exe
Files
-
CLIPStudioPaint.exe.exe windows:6 windows x64 arch:x64
9106efe9d6a50454668c0531a4885640
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
boost_date_time
??0greg_month@gregorian@boost@@QEAA@G@Z
boost_thread
?get_current_thread_data@detail@boost@@YAPEAUthread_data_base@12@XZ
ws2_32
recv
qmpdkdll
QmPdkFinal
crypt32
CertFreeCertificateContext
kernel32
GetVersionExW
GetVersionExA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
CharNextW
CharUpperBuffW
advapi32
RegDeleteKeyW
msvcp140
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
bcrypt
BCryptCloseAlgorithmProvider
shlwapi
PathAppendW
imm32
ImmGetContext
msacm32
acmStreamPrepareHeader
concrt140
?_Schedule@_StructuredTaskCollection@details@Concurrency@@QEAAXPEAV_UnrealizedChore@23@@Z
vcruntime140
__C_specific_handler
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
exit
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
api-ms-win-crt-string-l1-1-0
strcspn
api-ms-win-crt-math-l1-1-0
log10
api-ms-win-crt-utility-l1-1-0
bsearch
api-ms-win-crt-time-l1-1-0
_mktime64
api-ms-win-crt-convert-l1-1-0
strtoull
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-filesystem-l1-1-0
_wrename
api-ms-win-crt-locale-l1-1-0
setlocale
ailia
ord250
giflib
EGifCloseFile
jpeg62
ord31
libpng16
png_sig_cmp
tiff
_TIFFmalloc
comctl32
ord17
mscms
GetStandardColorSpaceProfileW
rpcrt4
UuidFromStringW
avifil32
AVIFileGetStream
iphlpapi
GetAdaptersAddresses
libfbxsdk
?ClassId@FbxSurfacePhong@fbxsdk@@2VFbxClassId@2@A
zlib
inflate
gdiplus
GdipCreateFontFromLogfontW
mf
MFEnumDeviceSources
mfplat
MFCreateMediaType
mfreadwrite
MFCreateSourceReaderFromMediaSource
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
api-ms-win-core-winrt-l1-1-0
RoInitialize
winmm
mmioStringToFOURCCW
wininet
HttpSendRequestExW
version
GetFileVersionInfoSizeW
boost_regex
?match@?$perl_matcher@V?$_String_const_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@std@@V?$allocator@U?$sub_match@V?$_String_const_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@std@@@boost@@@2@U?$regex_traits@DV?$w32_regex_traits@D@boost@@@boost@@@re_detail_107200@boost@@QEAA_NXZ
icuuc65
??1Locale@icu_65@@UEAA@XZ
skia
?setHinting@SkFont@@QEAAXW4SkFontHinting@@@Z
skshaper
?MakeBiDiRunIterator@SkShaper@@SA?AV?$unique_ptr@VBiDiRunIterator@SkShaper@@U?$default_delete@VBiDiRunIterator@SkShaper@@@std@@@std@@PEBD_KE@Z
glu32
gluOrtho2D
opengl32
glStencilOp
gdi32
SetBkColor
comdlg32
PageSetupDlgW
shell32
DragFinish
ole32
ReleaseStgMedium
oleaut32
VarUI4FromStr
Exports
Exports
Sections
.text Size: - Virtual size: 56.6MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 11.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.krv0 Size: - Virtual size: 9.9MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.krv1 Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.krv2 Size: 31.8MB - Virtual size: 31.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ