�����:���f�š���q#S-p�����2N]��0�KBr���NЛ@��I�O���) �TsS{Q���u�x��AX�.w���Ē�@��8�z��y�H��N��b��|�~��\�#����멄�fȺ��,��A�����o&2 )V��ļQQ����P�2��H�R8�`���G���p����/! gWTt m�mj�v� Z(�euw��GG���7��B��c�6�e֔o������?�o�+£�[4�.`���T>R �r���Y8 ��8kg���%*��3���Tw���fl!bГ�o�A�3�`��j"���Ya.�xxPq �/�w���u��W ��_�Ow����4�@K�V`�RAn��=�?�нɩ��SS+B��H�����?��/�����n/1a�w�@=�{�m�h2X˾�#G+�d W7u���G�?����h`c�\.YI��ϾH����-���%���ʶ�+ �١?�0x?)�#��%�!��<��A�����V /l�f%��u�,ZD6e�lJ������!�R"f���.��u��5����{��b��<]G�����`/)q89n�Z�̑���Ax��J��X|M��]R[l�Ϥ@���OgUVj���6r�s������0�?Ĵ��H{e��䘼M��$�ҿ�Z��o�G\�a�)�u��ˇ/�q�K�̡�EJßؠ������_`/�ec��|j,�����RG����+���j��1g�pp��J�S������%�R�&O�'e=L���Z��'�������x$ua����[����wp����Qy��9�R�צ����P�{�B�5h��j�m�+�JV_��A�U�ų�����T���'�� F!+��l�%���~7�1��a�q�v�{T�i'�^�-��!5�l�NӠ�'~���|�]2��500��P�[�����ŭt����4�G��"�y琿��������NZHr��&�)�N1�rM�� �e���5AX���;��q�� �u�sY=~��ڰ�s>-a,(���=�#$��)C���˒]F����4c����&��)�!?� o�n�(���2wJ9[���5�� ӝ0�58�Q�Xx�D0WYϊy�����(�����Bnj���D���(���e��Y:�Ś%UTW}�Ӌ=�t/�S��?#mO�"�!&c�ːBk����c�c����"^�}moV X�;��pu�Gέߒ��w�~@��%ȼD�˧\N�%�>QJ��y��98?U�s`'�vʩ� W��a����{� �O�`��Y����v��l���h�����8���]�I�����#�j��rݲ�=�`cEd�1����:�7��e���t��?���L���;�.����d.���ڲH¬���=A��W4�J��I�W[3#��F�QI3�R����.�9����Dz�C.r7 ���T��&r����Q= �"���t�n I�:��-gsBu|PDZ�$���<�2�ȵ@`kRS k��+�B�� �Aw�*�[&���}����o�7m#b���\�\����� ��Ƚ���O�����$���/�� ^�O��G �0�b�QSime�'�X1���A�� �o����� �{�L_�]�]����k�����+�y3��[�wB�.�W�ΐ�]��P �J����K44N�^�����F{�K ���E&�%��gGЉ��'�i���N��طګQ��JN<�q"Z��q��5�j&#A�Ӊy\2�Z'~��wq�1���+��G�(�����_�j��fӐ�7�؝{�B!�{f3��(:2�[#@�km�YDn��+$Tc��( r,�U�,�a�P����6��b��c=|�Y�\In�<v Y�<d�jZ�So��Ǣ{�f ��1����@�r��h���#�Z!\�v��3�S#�m��i8�3A}��Gy�q#�Ro%8�l��2��F?|���[��Nl���"�����7H�lS�8P�nK����Ү�-2k�w+)��������og�A(Q���ʐ�!,XA�UZ�bF�Ogi\�ow�S�+��C���w<S�:v��1Z!cw�z��}�8W5���4~�o�L��Q��y3��1L� f��`�Ŵ啻��Y��MW:������=����V�~%�Y���g��'���S�U�VB�c��@G��c�L�er�v]�"��3�5�넚�MN����| �J�Fp������sO�A����������n�cR��tp�7}��]8����l���U��A=B�$W2�X�F����P�J� ���" ]^G��g$�:���]��q�ĐM �ۓ7Ā��Q� �b�:����B&a��ƌ�]���Gsoɇ{|_G�M��D1͒s� X}�'{ I�j58�W� �Q\U��'�� �bBmhGK��V�\5ɝQ6/��EA�kI��`g��,`���42e����r<��dW���G����Od��. �)��������J��p@�ˬS���"�����L��m�y[Kjl�h�����u�1�*K�������v�@�xq��z����2���|j���� �Ԃ��P�W����ɚ@&O�����C�Y�jDɧ�L7��e��kf�P�"��QK��N�,�v�u��.�M_�������t㬟n��u����Jm.īH��l��������Q�Q1n^�����V��l�m�.��O�Eq<�ΦV��I�w�,���f)a<Oh&Q}�N�O91_�A����+K���Yմ��u��O���QLMcM�*�+!#*l�\N<��* �9;���0��n����S�9�W#!GRL�i-�=���!��"�����V�A&%�$�P��[F��s�IôJs�S��Yp��!���f}�}�k"e�ڊD�� V��Fx��k3n�ŭ]j/O{�g�D�T�h���z��=Et�����I�E�K˱ʤ\�Ow�\R�LxT�m��t�C���̧k�n�X#K�e%�m��TN$deK���n#�yrW��x��ʹ��t�z����INF F���-tO� �Oח�Ё��}���}z����X�$wP�O� `S`xVVyק���Μ
Static task
static1
Behavioral task
behavioral1
Sample
CLIPStudioPaint.exe
Resource
win11-20240508-en
General
-
Target
CLIPStudioPaint.exe
-
Size
33.2MB
-
MD5
83e09964ed9fe345fc9248a356e22aa1
-
SHA1
282d6988bfec0c0a28f1d37d79036da2c86a08e6
-
SHA256
ef48b9119bf1345e747b5a051ed0e436a2078962901c1f800952e44f768eaa52
-
SHA512
c3e6984d670a841f409d65c3bc401ea3d484e97ead8297b0d3e03e76fc9a4091039d3316bcfa5501804d41da18ca171234051b59fd3e1ab9958d061d3b307e64
-
SSDEEP
786432:RwFCxTYlohf9os2yv0bydW/oXGHuUkwAuGRsUuqPyth5:RwFC1YlohGs90bdo2H8w3GqsPm5
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource CLIPStudioPaint.exe
Files
-
CLIPStudioPaint.exe.exe windows:6 windows x64 arch:x64
e72886a72694e987533c00ddc48292df
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
boost_thread
?get_id@thread@boost@@QEBA?AVid@12@XZ
ws2_32
recv
qmpdkdll
QmPdkQumaGetDeviceState
crypt32
CertGetCertificateContextProperty
kernel32
GetVersionExA
GetVersionExW
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
RegisterClassW
CharUpperBuffW
advapi32
ConvertSidToStringSidW
msvcp140
?_Xout_of_range@std@@YAXPEBD@Z
bcrypt
BCryptGenRandom
shlwapi
PathFindFileNameW
imm32
ImmGetVirtualKey
msacm32
acmStreamPrepareHeader
concrt140
?PPLParallelForEventGuid@Concurrency@@3U_GUID@@B
vcruntime140
__std_exception_destroy
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_initialize_wide_environment
api-ms-win-crt-heap-l1-1-0
_recalloc
api-ms-win-crt-stdio-l1-1-0
__p__commode
api-ms-win-crt-string-l1-1-0
strcat
api-ms-win-crt-math-l1-1-0
atanf
api-ms-win-crt-utility-l1-1-0
qsort
api-ms-win-crt-time-l1-1-0
_gmtime64
api-ms-win-crt-convert-l1-1-0
atoi
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-filesystem-l1-1-0
_lock_file
api-ms-win-crt-locale-l1-1-0
localeconv
ailia
ord101
giflib
GifMakeMapObject
jpeg62
ord83
libpng16
png_set_filter
tiff
TIFFWriteEncodedStrip
comctl32
ord17
mscms
GetColorProfileHeader
rpcrt4
UuidFromStringW
avifil32
AVIMakeCompressedStream
iphlpapi
GetAdaptersAddresses
libfbxsdk
?GetCluster@FbxSkin@fbxsdk@@QEAAPEAVFbxCluster@2@H@Z
zlib
crc32
icuuc65
??4UnicodeString@icu_65@@QEAAAEAV01@$$QEAV01@@Z
gdiplus
GdipFillPath
mf
MFEnumDeviceSources
mfplat
MFShutdown
mfreadwrite
MFCreateSourceReaderFromMediaSource
api-ms-win-core-winrt-string-l1-1-0
WindowsCreateStringReference
api-ms-win-core-winrt-l1-1-0
RoUninitialize
boost_date_time
??0greg_month@gregorian@boost@@QEAA@G@Z
winmm
timeBeginPeriod
wininet
HttpOpenRequestW
version
GetFileVersionInfoSizeW
boost_regex
?construct_init@?$perl_matcher@PEBDV?$allocator@U?$sub_match@PEBD@boost@@@std@@U?$regex_traits@DV?$w32_regex_traits@D@boost@@@boost@@@re_detail_107200@boost@@AEAAXAEBV?$basic_regex@DU?$regex_traits@DV?$w32_regex_traits@D@boost@@@boost@@@3@W4_match_flags@regex_constants@3@@Z
glu32
gluScaleImage
opengl32
glPushMatrix
gdi32
BitBlt
comdlg32
PageSetupDlgW
shell32
SHCreateItemInKnownFolder
ole32
StringFromGUID2
oleaut32
VarUI4FromStr
Exports
Exports
Sections
.text Size: - Virtual size: 51.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10.4MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.krv0 Size: - Virtual size: 9.5MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.krv1 Size: 13KB - Virtual size: 13KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.krv2 Size: 29.7MB - Virtual size: 29.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ