CLIPStudioPaint exe Trojan Wacatac File Malware Analysis: 9e42355e0edc39c156d844f5821f6446

CLIPStudioPaint.exe Trojan Wacatac Analysis

Updated 9 minutes ago

Checked by Malware Check

CLIPStudioPaint.exe

Hash Type	Value	Action
MD5	9e42355e0edc39c156d844f5821f6446
SHA1	45f674bd08040a0c5846ee1abce84fea1d666e13
SHA256	4e2b07ffe4f65b2c73ff47cf28a2f184ed0a7475325ad4282059b122162af673
SHA512	40846346fd653330b7cf63f8225ef8f6deaf53df3b4bd38b532ff1b139fdb582ff3f516b2dae3b96f5974221e4d24230646e8ecfd6ac1fb4df04ae113c93e0fa
ImpHash	20d4b8595402f754caa3db686a566504

Hash Type

Value

Action

MD5

9e42355e0edc39c156d844f5821f6446

SHA1

45f674bd08040a0c5846ee1abce84fea1d666e13

SHA256

4e2b07ffe4f65b2c73ff47cf28a2f184ed0a7475325ad4282059b122162af673

SHA512

40846346fd653330b7cf63f8225ef8f6deaf53df3b4bd38b532ff1b139fdb582ff3f516b2dae3b96f5974221e4d24230646e8ecfd6ac1fb4df04ae113c93e0fa

ImpHash

20d4b8595402f754caa3db686a566504

PE Analysis

Basic Information

▼

Icon	Hash: 863f61d6f2716c147763aa8c36936bf8 Fuzzy: c023a2e141a89059191f38edc486950d dHash: c88e236d330ccec8
Image Base	`0x140000000`
Entry Point	`0x147208758`
Compilation Time	2023-03-09 18:45:50
Checksum	0x043aacc4 (Actual: 0x027672cd)
OS Version	6.0
PEiD Signatures	`PE32+ executable (GUI) x86-64, for MS Windows`
Digital Signature	No valid SignedData structure was found.
Imports	57 libraries
Exports	0 functions
Resources	86 Resources
Sections	10 Sections

Version Information

▼

CompanyName	CELSYS,Inc.
FileDescription	CLIP STUDIO PAINT
FileVersion	2.0.0.0
InternalName	CLIP STUDIO PAINT
LegalCopyright	(C) CELSYS,Inc. All Rights Reserved.
OriginalFilename	CLIPStudioPaint.exe
ProductName	CLIP STUDIO PAINT
ProductVersion	2.0.0
Translation	0x0409 0x04b0

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
	`0x00001000`	54,267,904 bytes	17,568,256 bytes	8.00 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`F0EE32631868A43AD61D8919AEB4FD02`
	`0x033c2000`	9,310,208 bytes	3,302,912 bytes	8.00 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`A4CEAF22587266636168034CB074100B`
	`0x03ca3000`	4,116,480 bytes	158,208 bytes	8.00 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`918A906885601336332661CF441A0609`
	`0x04090000`	1,712,128 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
	`0x04232000`	12,288 bytes	3,072 bytes	7.80 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`73533E36EC486B9622563FBFE3BA537A`
	`0x04235000`	3,633,152 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
	`0x045ac000`	372,736 bytes	37,376 bytes	7.98 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`7B135A7CE84EC3B36B1B56150B010CCA`
`.rsrc`	`0x04607000`	3,633,152 bytes	3,632,640 bytes	4.87 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`96C73F7739EE0A31F380E6429C3D5400`
	`0x0497e000`	33,460,224 bytes	7,512,064 bytes	8.00 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`6F6E81DBAB41912F3E796BD088A136A8`
	`0x06967000`	9,064,448 bytes	9,062,400 bytes	7.92 (Packed/Encrypted)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`85377AD348DBA699BAD2B3E625FD268F`

Entropy Analysis Alert

7 section(s) with high entropy (≥7.5) detected - possible packing/encryption

Resource Analysis

▼

Total Resources: 86 (3,627,999 bytes)

Resource Type	Count	Total Size	Percentage
RT_ICON	72	3,625,122 bytes	99.9%
RT_GROUP_ICON	12	1,080 bytes	0%
RT_VERSION	1	776 bytes	0%
RT_MANIFEST	1	1,021 bytes	0%

Certificate Chain Analysis

▼

No Digital Signatures

This file is not digitally signed.

Security Implications:

Cannot verify the publisher's identity
Increased security risk when running this file
May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

File Name	CLIPStudioPaint.exe
File Type	PE32+ executable (GUI) x86-64, for MS Windows
Scanner Version	1.0.219.174
Database Version	2025-06-30 05:00:21 UTC

CLIPStudioPaint.exe Trojan Wacatac Analysis

Technical Analysis

Ransom.Win64.Wacatac.cld

Scan Another File

File Identification