���E��K��Z�ӝ�]Mu�&�y4�_�#�T}�J2;�'���}6&��qF��o��yUU�N^H�C�G����5p���o�5#/ͪ,�N)3�63�:b��4��������F �,A��<�@�~��v�����s' �5G�i�ѱ���?T���>(��h����W=�H�<�39����L������?Y�S���2Y�xHn��A}n��S����2���n��ܲaÅ����R�v�g�2���r�h�S�F{AP&Eɔ�|��dd��(^�gJ��G� ����9KP�Me>z;��V�S�����3B��d�a7�D��St Y���o�$x���+;^Ә݊-�C\e��V-��QY}SkuP]��İYe��8�s��ܭ����ʖ�����Gp�i�d%-{�k��ǍN�G�W�@z�{c��!��f)�<hJay�}��L�T��_����a���$�� ]�V��0��#4�d��1Z�9ȅ��ǽ8�_u��; �'/a�[���Ǒ�/���d%¨�T�����!%����o��n�.��#aӣu��w�4c�k7�=-u{_Q�T,��M3.ҝfI��Xh_��V_�w-v�~��-��C�1�|�ZN�1���t �v�����.� �o�Y��p>XsT�x����J����������W����1]�� ���'�O���cd�UG�'\&Gu>��:.�ܜ9�h:�`�S��$��XW�����߸}�h���5�!�o\0��F>�`,�niժ ����I�H�]A�A3e�aR�L�,���C`#��JyUa�[�b��p�����J;�6���@\iФ��M�w|��ئ��!1@W�lʼ��|2i3�����RC��!}^�l֙���r_�˚8�{-����tl�����ڳ}���r�����'�3Jl[���%) -������BX��96��Nb��m���%f���,1���%��{j��u��,�������̱����/'w�٭.��;��70���$���mL�zR%� �r��T��#@ ��s,��B��.U57,z�}��-�EL1�����V�|Q(M!��c�s�YY��&�+Z��ZN��Q�9��[R§t�0�en�:^ޤ���*j�k�N��%"��������=>)0^���w��]��;�$e��L�݊�[�~DFg}��J��j� �/��ߥۨ�]�3��-��:IA�g�z�j'�m�mh� z�!��Ӳ@[4��,U#��緛(\K�L;��l�����tB��� )eu� `p:�j�����<J<9����|�����:*2a��z�%�9b�6�$��K5<������������@ߑ�p~2��b�_�WVͭ���9���^����s)��t������ M�X���У,�+��cH���"0��U��!����c)V�ɬ��p�Jv��C-��.�A��g�@�JDZt+v�A���1�/�4ܳ�՜G��� �Q�I�5Ėm�a�5���1��,�p#�lh�I�Hd�{�VݾǼ���Pԗ�48�d�mj��G�� G�]5���imm��"��L���a�Wl��v�c��7}��e��p#��������v rL�uЁxE��a[D�bF��9�G�j*^�a���tW��F�8�?6�eJ�t|��� F��E�$�1��Tm����-�����4��5�o�k�Ӽ���e-�^�1����Tgr���L���.��:PJGer&A(��쥃�\�?�����+�Ol_��jr�o7�9�yT��p�Y/PR�e��2%O��V}";�c�qh��YD�)t<��r�֖t��q��;Y��H_g/+�p�����V�S�1+����<U|��Q�X��*���T���)#��_�;6rJ8�{�c�{UV_�<�Vl,#���H�u���&���9Y`��R�Sl�o=4{�B�a$J�x(�4`��ǯ�yG������;���>C�Oi� �����0��6��E����9�t>���~���H1��K3� ����.��/��wY���Kr���r�XZCc�K�)$=4%P������C�N:s�O;mc�t5������-�%cU����ڶm��n��� ���Ӭly/�_D���Llv��햽�9�h�����`G�Zm����%�i�Fbfx�-l�K���B�z4�]��͓�����O@%M��ha�/xcO�S��孨�+͘! �B��O�3wOy���6X�EP,`�K߬d�������#��o��o��= ��H�&Xo�M�!�}��k��=J]�GP �b"����7��������R�-J�S-J�B��ni�"FT+�|�1S�w5�6���#�꼍&cb3π�Q��4�h~����B`�B�Tz�$�u��j����O���XH(�G {��i�ƫ�6&b����p�EM��lev��C���2�7�J�S'�<F�. A��>N�V>1w ���V�lw�BG���_mk^��XkU�t"�Z�[�a%h]��Ǡ�nÈ�*���ľ�*���[=ij��ʷ�&ac��ykb%nu=���V�g�xx���'���"�.���W8wxB#����W����n�+�]f|��>��(:j�Y�kGm�J~�F:�!�+�b�/�;��T9��@�2�)�{VD���H�N���2"�jh����TX6��I�� ێiVI�B�p�Mþ�Vy�~n�,���q�rݸ���Rmj�������Xwqh�-m�l�Y���(Q �\ #�c�b��h�̧���p��d��T�VܱZ����L�K����Bi�L������(�t����R}�y}�54u|��j�/� z$��wc��(D7�d�HZ�g1��#�u�����I�gܱM�RFu��uq�d��n`��c�Gfqi�����bb�+�`��K�Ex��K��"�� q�I=�mS�la[U����}V��N���'�2���.��T�M ���b 9䀗�<P���K2�I[��b���j��P�"e��``Z��ߨ��@�d�Ó��]G�"ޝ0l��j�!�V���~�ŊM=�>"5��V���Y!��a���
Static task
static1
General
-
Target
CLIPStudioPaint.exe
-
Size
32.3MB
-
MD5
97b3435585c25b9654c8f12f11be2fa5
-
SHA1
c55d7ce913140a0f85d144488a4d5b4606971724
-
SHA256
0dd52d93fb8a004c22745bcb421395bf85cfd51456597cbda3a7952c6adb7080
-
SHA512
a59c70e54c112d9156bd43f39056d32c95f0810ab2db065322617a81b96bb91f5797cdba1db91d218053c43e3ff49a5b0a22eafa0f75e3e1ee1636ad35a2b1af
-
SSDEEP
786432:nKAZNicQ1JUFc8mW/A+KPKcWIX4EWKMJBaQc9MQMo:PNicQ1JSmt9K5IXWla9Oo
Malware Config
Signatures
-
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource CLIPStudioPaint.exe
Files
-
CLIPStudioPaint.exe.exe windows:6 windows x64 arch:x64
38dd6d8ad3b86fefa30f904e6b20dd8f
Headers
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
Imports
boost_thread
?do_try_join_until@thread@boost@@AEAA_NAEBUmono_platform_timepoint@detail@2@@Z
ws2_32
shutdown
qmpdkdll
QmPdkSetForcedCopyPose
crypt32
CertFindCertificateInStore
kernel32
GetVersionExA
GetVersionExW
GetVersion
LocalAlloc
LocalFree
GetModuleFileNameW
ExitProcess
LoadLibraryA
GetModuleHandleA
GetProcAddress
user32
EnableWindow
CharUpperBuffW
advapi32
ConvertSidToStringSidW
msvcp140
?_Xout_of_range@std@@YAXPEBD@Z
bcrypt
BCryptOpenAlgorithmProvider
shlwapi
PathFindFileNameW
imm32
ImmGetContext
msacm32
acmStreamPrepareHeader
concrt140
?Free@Concurrency@@YAXPEAX@Z
vcruntime140
wcschr
vcruntime140_1
__CxxFrameHandler4
api-ms-win-crt-runtime-l1-1-0
_register_onexit_function
api-ms-win-crt-heap-l1-1-0
calloc
api-ms-win-crt-stdio-l1-1-0
fsetpos
api-ms-win-crt-string-l1-1-0
isalnum
api-ms-win-crt-math-l1-1-0
cos
api-ms-win-crt-utility-l1-1-0
rand
api-ms-win-crt-time-l1-1-0
_localtime64_s
api-ms-win-crt-convert-l1-1-0
strtoul
api-ms-win-crt-environment-l1-1-0
getenv
api-ms-win-crt-filesystem-l1-1-0
_stat64i32
api-ms-win-crt-locale-l1-1-0
___mb_cur_max_func
ailia
ord240
giflib
DGifOpen
jpeg62
ord50
libpng16
png_set_compression_level
tiff
TIFFNumberOfStrips
comctl32
ord17
mscms
OpenColorProfileW
rpcrt4
UuidFromStringW
avifil32
AVIFileRelease
iphlpapi
GetAdaptersAddresses
libfbxsdk
?GetCluster@FbxSkin@fbxsdk@@QEAAPEAVFbxCluster@2@H@Z
zlib
inflate
gdiplus
GdipFillPath
boost_date_time
??0greg_month@gregorian@boost@@QEAA@G@Z
winmm
timeBeginPeriod
wininet
HttpQueryInfoW
version
GetFileVersionInfoW
boost_regex
?match@?$perl_matcher@V?$_String_const_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@std@@V?$allocator@U?$sub_match@V?$_String_const_iterator@V?$_String_val@U?$_Simple_types@D@std@@@std@@@std@@@boost@@@2@U?$regex_traits@DV?$w32_regex_traits@D@boost@@@boost@@@re_detail_107200@boost@@QEAA_NXZ
glu32
gluOrtho2D
opengl32
glGetTexLevelParameteriv
gdi32
BeginPath
comdlg32
GetOpenFileNameW
shell32
ord680
ole32
OleLockRunning
oleaut32
VarUI4FromStr
Exports
Exports
Sections
.text Size: - Virtual size: 49.7MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rdata Size: - Virtual size: 10.1MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.data Size: - Virtual size: 3.9MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.pdata Size: - Virtual size: 1.6MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
_RDATA Size: - Virtual size: 9KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
.krv0 Size: - Virtual size: 9.3MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.krv1 Size: 13KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.krv2 Size: 28.8MB - Virtual size: 28.8MB
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
.rsrc Size: 3.5MB - Virtual size: 3.5MB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ