���S$���F}���2f�k9��ڳ��(�b2�-َ�� ,��*@M�GM��� �<f�҂0ea[���Ƌw����a��%�����ϣ�V�;�b2��ng ��17�H�h�q��:�d{�rs�ϤD?lQ�IU�T튅����Ϳg�1W�~BtHf�}X�(��oe�\��2BҊ���H�H����ѱ���t�V fb�h�͌i����i�R�|�9(&�@�F�v�/]~6k���ĭ} �U�l���jb�� �(=f$�5�u���U�� �d�{=�Ń9HJ>`����-kU�&JH)\̈k �;�0��^ ���(�2��klt�� 7!���WT�����j���mU��rг.7?N�ǜ�L��Z��9[I�F�e]�q`=z�$ 2ܖ�F3���I��#��v v5ˋ���(�Oa�6@��)���|�J���n�}A�9"���B�tyS`���)�w��T�}�LI�e���g���sp%���_Mt���� �j ��K�H�m�W����:�s�8^��~8֞��з/ t8�d��-��Ɛ�7&d�5R�K�Jm��5S���e��� ?��o�CN�4��C��o���{�,���u��K�:A�������Rˁr7��$�d�v'���m��(c�[��Hr��C:����k�E��S��R����g��I���������5�?ޮ����&s��~go=�e���R! ?�Kq�� �[�j��)��O�������d 竳cmC���mW�^��.�;�6�V�� ST�{�U�8ŗ$e1��P�q��/5�<��M��e{��辤�l�zN�|��W���q)��);R�a�"�im����m��|f�H����'�m��Q=ɝC�!a��jy����3���h�.\������zt�'ƈX�C0��zI��ZS��Q ֻ�2^"}�R�'�=o'!;MU2ؒzUW /%�Y���xiQ����TA-���l��`�녗���RÉ�FB�`8~ �u2ګb�3�p$������~{��!=�<VڭDt�3_����,:V��!�[mi�VAӗ,��1�Xp�9���7X��đ�u�����a{�Gܳ!��Rn�����!�N�B�z�8~�o��ۓ7��J�|{F� �����lJe�P�-�?fࡆ�o��C&���4i��q���� n���q�j��a�ߣ��&}�I� u�8�lN���D0x�3��w%N{N���YTp4�H�]���<��j�K�x�,S�'�ho���Ur�����������>��H��`,�Uf���M�2�%���x89^�װ����m�c��_2}�Կ��b��k��V� �aOFop,�8G1J�W�|Ӥ։��<d$��dU���[}Hd.q��k��SG���Ac�L���,�j4ͅX��pŖ���p����� �Օke q��9U��(�����Pm����~� B(B�����Q8$GڬN��nbW '�.c�`�;a5�L�� �t8]˝i%�P/[��kcoz|D���qR-�{Q�b�*8�xEDI��Z�w]����z299�5�p�����k�V�e����+/?�d�J����CW���� F�ӝOVa~��q��1�f���B��U���< �W�{Q��&-S�;��=�JJ�3����7d�bRX�#� �V��9�hF)���#M�v 8�Q���^���t�� � PRy�;Ms��0܀o�9�n �@���] ��GW����Q Xsχ��kx�-�B��m�w����mJ�QOI��|&��yW�|,�Ҥg�� �)��醵S �$�t�f�Ocy?nW�X�dL%��P19��閸DF�9C�W�]_}Q,,�:!>#��k�����D<�#Y����x�˗�l�3Qc�FS7�� �VV ��4�u*����IG�{��9;r�����D잉���;%ok�4���2Z�t^�p��β��]��e6N�E�R�-;�9�� �� ����e a��Df��&��=�f|�w�y�����+Q�?��nP�E$���'������U0�~��\E�#�a7�Xoe�7�ArY�;�fc8�a�P�d�J����������5h�b��W��z�¨�ꌔ����,�:~����(h'��2`�=��K��}�۩���]�"W�e<��BO�����P9"�lw\�� c�{w�>�A�J691~F��s��˰��4�ZN��x.U�V�S6ƈU�{��L�I���[7�.>��5��bU����`(:�Hr�����ȥ���(�����]'�����E&����c��+���-�R�N�z~�k8�����ƈ �*ws��r*V���J���ߝ��Q�-��t�Z W3R�� ��f2� P>���K�zn���ov�d���� (�i�_t�X���^��m���Ɨ�|�W�3C��K�6�b?����5�<��U0ePC�lu�k�F�&2vEE��v���T�=fJ�?�(���nX�]�Կ�3Ol�г�Q6D�9e&��E���ʾn����{�Y��nF�M a�c<�d��Ɇ$d >���2��\�=�OG��5iexq�D+�)��^T}4:B��֩�i��տ[�Gd �^r���]P�ˈ���:�>}���O�c��z���_4v�^h]�%�3S��9������ ���<fy��&��B� �r�1�~Y�P�x��R�@�g/H]��B_vآ��g��z[ �4�4&l!����x5&�f��/%��0��!����|Lo/ ��G��qk"������gZ,GO�EYs�kj�I�����o��b{W;���A�s�m���b�"�Ĥ��sM@�y�_����r|kfy��3���/of�������b��)D�ΰdO�"�Ku��dC!�<uڟ8)�w��o3���, u:��#_Ջm׀��w��I�k&�1��Z��@��+q��5� �~B���I���l�RȐ�L��g��3L�_�87m���z�̟Ey�ۈV�<��Z��տ$��Ճ"���� �tZ� s�c/�%r-ܠE�����n_�q
Static task
static1
General
-
Target
CLIPStudioPaint.exe
-
Size
31.8MB
-
MD5
390c1a5e843bc9eb73a20a44a37a41d1
-
SHA1
8b881361c5088632f6fb5107b05303eccb179184
-
SHA256
5c644ba9cda8726530f83d03b87c4c2d339e6172fd6bf867acc1cf7e3ef2bbb4
-
SHA512
281941bcabd1fc6edcb14aeff274cc6b35f4738f4de8ccaebede36328b7007d43093554e6ffd7639e38d698687235682514b8cca64f891089b2211feb3177496
-
SSDEEP
393216:paMcLUlvESZeMnT3ujx/MB4ZZ0/zVghTKTz7P+aBYw5A0r0GLlmCvAMPWw6Y0GJd:paMMUJvccm/TShj3mR0dh6dF7GxE4Zo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource CLIPStudioPaint.exe
Files
-
CLIPStudioPaint.exe.exe windows:6 windows x64 arch:x64
909a5211f9135f3613cc957002a1e9e4
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
boost_thread
?do_try_join_until@thread@boost@@AEAA_NAEBUmono_platform_timepoint@detail@2@@Z
ws2_32
ioctlsocket
qmpdkdll
QmPdkDisconnect
crypt32
CertCloseStore
kernel32
GetVersionExA
GetVersionExW
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EnableWindow
CharUpperBuffW
advapi32
ConvertSidToStringSidW
msvcp140
?_Xout_of_range@std@@YAXPEBD@Z
bcrypt
BCryptOpenAlgorithmProvider
shlwapi
PathFindFileNameW
imm32
ImmGetContext
msacm32
acmStreamPrepareHeader
concrt140
?Free@Concurrency@@YAXPEAX@Z
vcruntime140
wcschr
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-stdio-l1-1-0
fsetpos
api-ms-win-crt-string-l1-1-0
isalnum
api-ms-win-crt-math-l1-1-0
cos
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-filesystem-l1-1-0
_stat64i32
api-ms-win-crt-locale-l1-1-0
___mb_cur_max_func
ailia
ord240
giflib
DGifOpen
jpeg62
ord50
libpng16
png_set_compression_level
tiff
TIFFNumberOfStrips
comctl32
ord17
mscms
OpenColorProfileW
rpcrt4
UuidFromStringW
avifil32
AVIFileOpenW
iphlpapi
GetAdaptersAddresses
libfbxsdk
?GetCluster@FbxSkin@fbxsdk@@QEAAPEAVFbxCluster@2@H@Z
zlib
inflate
gdiplus
GdipFillPath
boost_date_time
??0greg_month@gregorian@boost@@QEAA@G@Z
winmm
timeGetTime
wininet
InternetCrackUrlW
version
VerQueryValueW
boost_regex
?match@?$perl_matcher@V?$_String_const_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@std@@V?$allocator@U?$sub_match@V?$_String_const_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@std@@@boost@@@2@U?$regex_traits@DV?$w32_regex_traits@D@boost@@@boost@@@re_detail_107200@boost@@QEAA_NXZ
glu32
gluOrtho2D
opengl32
glGetTexLevelParameteriv
gdi32
BeginPath
comdlg32
GetOpenFileNameW
shell32
ord680
ole32
OleLockRunning
oleaut32
VarUI4FromStr
Exports
Exports
Sections
.text Size: - Virtual size: 49.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 8.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.krv0 Size: - Virtual size: 9.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.krv1 Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.krv2 Size: 28.3MB - Virtual size: 28.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ