��ĊZ��Q���$y/�����-کvi2ָ����I����M_��+),����Y��uNf�i�sZ^��.>�/�y �I�Hl��+����Ms����nN�rmw�e�# *t�xcyH'��_\g*���3yD�4�)��q�m�63pHODD�0��N:���mz�XO���U8��K�!9�!�e]��A��7 ��ӑ��Ee~]J��~��{B\Xv]�h|�/���Ԗ�Z �nL������:/��"j�5�����R��h�d�a��v@��pPq��Ѫ;R�2����\V���#�Oָ���9��F|V��0m��w"��J�2(F5�i�c��TN��t�zȥ��f��e������/1>'�D�'Q�"\jeֿpx����&f�����"�b|��^E�'#��B�^�_�m����,�G���?��_������������@z����4�]1%�p���{�Ȑ�+i��{de�W��+qG: ЌR;,|��Ν �N$�c��2�+ۖ�y�S�K�^#xr�HQ*�m#���t�#W̡��ÖE�(���$�����~Q�M�Mj���X���zz&$T��{L[��Yn+կ���� -���7t��4�)�Q�g�A,g��=k�_1��T �{�j�I��]:�Ęʓ*:]>piվ�웿�]�1#����W4��?���}�P�x� B�S8��G�������H�#f���aK�9Il��(P�q����ߪ8<�����w��qX�J�G�S���U�9�@���kË�����`l��7;U���D}D��ݒ�__�Hg�g_W�7���NBS�V���d�&G_nݗ,��t\d?��ꢎ����g��j�'8�e�s�2J����d~�K��� ˯R�Rr �Sj��H=�OC��`�G�M�&���m��*���k﮵*�����.���;�`ւW���������hK�.t�!%�RCA� /|�l����nv���P[��j�HpY+;������r� �y��]��8�s]ι� ���_T"�(.�W!o\E�\:�`�#�g����N�l�M:�9��j�e�W�tG,�N������BP�q�E��*E���� ��$?͈*�'�b��.W���<Q��4���\M�1J_+�^� ]��S�L~��)!�*�h�%�A2�ڄ� � �gRs�La}�=R��g0{m =�� ss�8�� �[���d�y4��������CQ/D۩y,�]n1�df9��˸��gb�t�"�R1}�nu�{��jI�U�V�<��PKy �b;s 𩍻͈Zjq�×7�/���NC|���G�8`4�UG��d�̎x���l�X�����:T��ttg~Յ{�1P��#�&K��;ā3L�e��e�l���~J��#�A'�L�� �L��$���X��¡���d�]�3�I|.�JL�ի_~�c-7�<��)�6q����/�w��7�Evϛ����U�""��d/Op7L�^+./�WD�tf �M�������-�=�@��)��4����0r.���WZM����V����������v��[ޏ&�V<A�#�d��;0�w���\��Y�A�T�������,�m�FL�{��Ehߜgc7f˹� ��"M�����QoK͒�Y��L�=#����֏� �c32v�<C�hRf7��d�<6݉���-����+῟W١����~ߩ��fWu������J���4;��M�N��_k�9���%��3��R6�r��J�n[��;ц�Q;u �P�?�)�3���Q��8����O�YnԦ�U�����b�t(�d�O� R�H� �5�0e\��Pu3��R8[-���M5Ā���,�O��a�������7N=�=��$��D��O4�"����g�J���v�4�ک���^��>�NJM�{.S��+M�4=�n+d;���dz���*D�hu��ug�G�,�>���8ϟ?�$1��H�nm�xG4�p�k��媴��c��9�Y���J���#�����`�8��P4Q%[�.�=�?�̂���ij���-o�g}�G2��s�Գ�&m3���촔2ANX��%?E��>��{4'#��x���W��vpM;}�f�n�����%�{��+i~_q���W�D�&�!"���9'������U�?Ҋ���j�l�?�� |W��a�&Ī|`J���҅�n`v�z��C�0���r�r������Z �NJ��(�Ү���'#.Rr$H�b����)��0;ޜN^v��Q )�7NC����$Ɍz]v��l�-��P9j��Z�4����| � n�YE�c+1�+�Z�8����LZɉ�4�=H7�#�ZG�W9ǻmy�b�Y4ŵ�����������5�VSAlL�K��E�6/��KDDЎ��5"J'fg&��;����ʴ���"��Q�~SN�W,���&�p�?;aB��N��̗��)*�IC뙝��Ǟv�\6�����w��d�J����R���x5�+Iw���W�1��w����|����W0b�5�=,�/r�t���r �=��_��-�UR�4�M��!C�+z�� ':�?-��OiaBG2��Cr�%`���U(T;8�z�}��w%Ph�~7��pR]�v����"��� $Qk�j���0F�B�8j���]�#�y%[X�ģ�+cY����S����V��N�a��� �# |���h�����{Q5��� �R��~���F�N4(�"j?��� X�B`�r?��Tž#�)䉴��=���ȵ�)��ڑ� ~�]���Ocϐ{4�k;�i��Ұ���$IT���%�B/�;u�^����Z��������N8��������Y:�4�ѫ�6�a\2H5��NkaI�)�C���ϡOG_�ˆ�h�:꣑RØ�"�(�$���B��J��Y����|ىNQ?:�h(8A˄���m��->�n���D��%�1f+�4Ԯ���Ed܅�(�����2��������9��H'��e$d?�z�_�ky�X��ދ9����������4� �:���T��3t//d��t���
Static task
static1
Behavioral task
behavioral1
Sample
CLIPStudioPaint.exe
Resource
win11-20231215-en
General
-
Target
CLIPStudioPaint.exe
-
Size
35.5MB
-
MD5
dc29ddaa82b29ca9e433938072adf19c
-
SHA1
f8acc984c931e0ccdf3160900e1e6bb0d2b6b105
-
SHA256
28b431c1c8ebc715806b466b14398a4528c5d35e9d486f9004700626ed5960d4
-
SHA512
de04d5ada42b6f8814601d2421ab6f0cecad2a057cd271bf716804beecb762ced1b85de478bf84614fcf2e66a811b8194148b632fa5aae0c8cc409432bce525a
-
SSDEEP
786432:D9mXDp8KhF3fW6Gu4HlE6L3xh/8o5PQp9T5USrl/EvwI5:UDp8KhFUdhh/8o5opt5USrlcv/5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource CLIPStudioPaint.exe
Files
-
CLIPStudioPaint.exe.exe windows:6 windows x64 arch:x64
5d804dc2e1536771208eb7ad2f12f8e2
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
boost_date_time
??0greg_month@gregorian@boost@@QEAA@G@Z
boost_thread
?get_current_thread_data@detail@boost@@YAPEAUthread_data_base@12@XZ
ws2_32
recv
qmpdkdll
QmPdkFinal
crypt32
CertFreeCertificateContext
kernel32
GetVersionExW
GetVersionExA
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
IsWindowVisible
CharUpperBuffW
advapi32
RegDeleteKeyW
msvcp140
??0?$basic_streambuf@DU?$char_traits@D@std@@@std@@IEAA@XZ
bcrypt
BCryptCloseAlgorithmProvider
shlwapi
PathAppendW
imm32
ImmGetContext
msacm32
acmStreamPrepareHeader
concrt140
?_Schedule@_StructuredTaskCollection@details@Concurrency@@QEAAXPEAV_UnrealizedChore@23@@Z
vcruntime140
__C_specific_handler
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-stdio-l1-1-0
__stdio_common_vswprintf_s
api-ms-win-crt-string-l1-1-0
wcscpy
api-ms-win-crt-math-l1-1-0
floor
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-time-l1-1-0
_localtime64
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-filesystem-l1-1-0
_stat64i32
api-ms-win-crt-locale-l1-1-0
localeconv
ailia
ord20
giflib
EGifCloseFile
jpeg62
ord31
libpng16
png_sig_cmp
tiff
_TIFFmalloc
comctl32
ord17
mscms
GetStandardColorSpaceProfileW
rpcrt4
UuidFromStringW
avifil32
AVIFileGetStream
iphlpapi
GetAdaptersAddresses
libfbxsdk
?sNormalMap@FbxSurfaceMaterial@fbxsdk@@2PEBDEB
zlib
inflate
gdiplus
GdipCreateFontFromLogfontW
mf
MFEnumDeviceSources
mfplat
MFCreateMediaType
mfreadwrite
MFCreateSourceReaderFromMediaSource
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
api-ms-win-core-winrt-l1-1-0
RoGetActivationFactory
winmm
mmioStringToFOURCCW
wininet
HttpSendRequestExW
version
GetFileVersionInfoSizeW
boost_regex
?match@?$perl_matcher@V?$_String_const_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@std@@V?$allocator@U?$sub_match@V?$_String_const_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@std@@@boost@@@2@U?$regex_traits@DV?$w32_regex_traits@D@boost@@@boost@@@re_detail_107200@boost@@QEAA_NXZ
icuuc65
??1Locale@icu_65@@UEAA@XZ
skia
?setHinting@SkFont@@QEAAXW4SkFontHinting@@@Z
skshaper
?MakeBiDiRunIterator@SkShaper@@SA?AV?$unique_ptr@VBiDiRunIterator@SkShaper@@U?$default_delete@VBiDiRunIterator@SkShaper@@@std@@@std@@PEBD_KE@Z
glu32
gluOrtho2D
opengl32
glStencilOp
gdi32
SetBkColor
comdlg32
PageSetupDlgW
shell32
DragFinish
ole32
ReleaseStgMedium
oleaut32
VarUI4FromStr
Exports
Exports
Sections
.text Size: - Virtual size: 57.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 11.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 4.3MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1.8MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.krv0 Size: - Virtual size: 10.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.krv1 Size: 14KB - Virtual size: 14KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.krv2 Size: 32.0MB - Virtual size: 32.0MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ