4edd32cdcc8ea03e06bdf851e84ce8e41a32e7b439eefecddd41164300ffdbb7

General

Target
Clip Studio Paint EX 4.0.3 (x64) Multilingual.zip
Size 472.5MB
Sample260913-vgfqvsap8s
SHA256 4edd32cdcc8ea03e06bdf851e84ce8e41a32e7b439eefecddd41164300ffdbb7
MD5 c98980ead5119e1e4d401c2cb253ca0c
SHA1 2af6c5a435611a38010108911efc8ece208a98f8
SHA512 d00b2125c0f191062affeeb992a1f5e8b622b669ac24c8e1a4b9ffc7bfca2b95c669985f61da7abe8da757acd10d1eb24a553d0647a0b5b2ae7f2bfbc5e057b2
SSDEEP 12582912:DiL2lwCiUjWpMhB7TEnzU2rzqzPy9Io0JD:DjJqpaqz/APcCD
TLSH
T1DA3933FA4C45C25EC1A93509DF69C0C8B21718AF64EC93683C7A88E91E837673B5DCE5
MD5 SHA1 SHA512 SSDEEP TLSH

Score

6^/10

Malware Config

Targets

- Target
  Clip Studio Paint EX 4.0.3 (x64) Multilingual.zip
- Size 472.5MB
- SHA256 4edd32cdcc8ea03e06bdf851e84ce8e41a32e7b439eefecddd41164300ffdbb7
- MD5 c98980ead5119e1e4d401c2cb253ca0c
- SHA1 2af6c5a435611a38010108911efc8ece208a98f8
- SHA512 d00b2125c0f191062affeeb992a1f5e8b622b669ac24c8e1a4b9ffc7bfca2b95c669985f61da7abe8da757acd10d1eb24a553d0647a0b5b2ae7f2bfbc5e057b2
- SSDEEP 12582912:DiL2lwCiUjWpMhB7TEnzU2rzqzPy9Io0JD:DjJqpaqz/APcCD
- TLSH
  T1DA3933FA4C45C25EC1A93509DF69C0C8B21718AF64EC93683C7A88E91E837673B5DCE5
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

1^/10
behavioral1
- Target
  CSP_403w_setup.exe
- Size 442.4MB
- SHA256 b304a3de3eb13b9e8b40f866e50a8e34c6798b79b8e4c70fc7bc9e0c2665e8d0
- MD5 db50c5fac8d51edb44e91f9a4835fa8f
- SHA1 5f065c2a5231862badea072af3d35b3a7ecfc294
- SHA512 e3fc40c9da9438153501a2ec09fcf6aaa5ca1d01e1cb72b72664b4146c8e3456482a8a9c379347c6281ebd252c661aebd26bd38860ea0b068d59a9c907405b4e
- SSDEEP 12582912:7TVqAZMfrLqKvhUQ4fA4Ouo91dioaF/tkP2K3h2Uc8xK:7TV/ZQ/SQ7huO0pF/qPpcJ
- TLSH
  T16629331BA584892EE5BF0631ACAF0D51B6647D336B31849B72D0FB285CF17C1BA63607
- MD5 SHA1 SHA512 SSDEEP TLSH
Score

6^/10

adware defense_evasion discovery persistence privilege_escalation ransomware spyware trojan
- Network Share Discovery
  Attempt to gather information on host network.
  discovery
- Checks computer location settings
  Looks up country code configured in the registry, likely geofence.
- Event Triggered Execution: Component Object Model Hijacking
  Adversaries may establish persistence by executing malicious content triggered by hijacked references to Component Object Model (COM) objects.
  persistence privilege_escalation
behavioral2