Overview
overview
7Static
static
7CoolIME.exe
windows7-x64
1CoolIME.exe
windows10-2004-x64
1Dicts/wing...in.vbs
windows7-x64
1Dicts/wing...in.vbs
windows10-2004-x64
1Dicts/wing...er.ps1
windows7-x64
1Dicts/wing...er.ps1
windows10-2004-x64
1KeyBoards/...��.url
windows7-x64
1KeyBoards/...��.url
windows10-2004-x64
1练习软�...ex.htm
windows7-x64
1练习软�...ex.htm
windows10-2004-x64
1练习软�...er.exe
windows7-x64
3练习软�...er.exe
windows10-2004-x64
3输入法教程.htm
windows7-x64
1输入法教程.htm
windows10-2004-x64
1酷极手册.chm
windows7-x64
1酷极手册.chm
windows10-2004-x64
1Behavioral task
behavioral1
Sample
CoolIME.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
CoolIME.exe
Resource
win10v2004-20231222-en
Behavioral task
behavioral3
Sample
Dicts/wingput/QuanPin.vbs
Resource
win7-20231215-en
Behavioral task
behavioral4
Sample
Dicts/wingput/QuanPin.vbs
Resource
win10v2004-20231222-en
Behavioral task
behavioral5
Sample
Dicts/wingput/User.ps1
Resource
win7-20231215-en
Behavioral task
behavioral6
Sample
Dicts/wingput/User.ps1
Resource
win10v2004-20231215-en
Behavioral task
behavioral7
Sample
KeyBoards/新云软件.url
Resource
win7-20231215-en
Behavioral task
behavioral8
Sample
KeyBoards/新云软件.url
Resource
win10v2004-20231215-en
Behavioral task
behavioral9
Sample
练习软件/help/index.htm
Resource
win7-20231215-en
Behavioral task
behavioral10
Sample
练习软件/help/index.htm
Resource
win10v2004-20231222-en
Behavioral task
behavioral11
Sample
练习软件/typingfaster.exe
Resource
win7-20231215-en
Behavioral task
behavioral12
Sample
练习软件/typingfaster.exe
Resource
win10v2004-20231215-en
Behavioral task
behavioral13
Sample
输入法教程.htm
Resource
win7-20231129-en
Behavioral task
behavioral14
Sample
输入法教程.htm
Resource
win10v2004-20231215-en
Behavioral task
behavioral15
Sample
酷极手册.chm
Resource
win7-20231129-en
Behavioral task
behavioral16
Sample
酷极手册.chm
Resource
win10v2004-20231215-en
General
-
Target
12ee8e1ad3c8b453ad28339bedf6698b
-
Size
2.9MB
-
MD5
12ee8e1ad3c8b453ad28339bedf6698b
-
SHA1
d9491eb2ef9b590ce98903929c2b0f811d113bfa
-
SHA256
a34035afcda5c0cdd12f671a174d5a7612599b820abd5a69c23c448cb53a0524
-
SHA512
66dc1971e5bd203809059e7774fb7535e35ca67037bb7e8019dae03d7386ae77c93a7d8672fbfabc4d9081f277ff6e49b91d75f09b7f1730096e9f53a9200e3a
-
SSDEEP
49152:iqRVbnGeTLyh6fovgEKCb0c9V/3xIczCQt0h2Chybmxdo+wNPS68dNsMfLrAco83:xR5nGZ/3/hIcBtHbmx2w68dFuLLi
Malware Config
Signatures
-
resource yara_rule static1/unpack001/CoolIME.exe aspack_v212_v242 static1/unpack001/练习软件/typingfaster.exe aspack_v212_v242 -
Unsigned PE 2 IoCs
Checks for missing Authenticode signature.
resource unpack001/CoolIME.exe unpack001/练习软件/typingfaster.exe
Files
-
12ee8e1ad3c8b453ad28339bedf6698b.rar
-
CoolIME.INI
-
CoolIME.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 94KB - Virtual size: 232KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 5KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 7KB - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 85KB - Virtual size: 424KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Dicts/wingput/BiaoDian.MB
-
Dicts/wingput/PinYin.MB1
-
Dicts/wingput/PinYin.MB2
-
Dicts/wingput/QuanJiao.MB
-
Dicts/wingput/QuanPin.ZI.vbs
-
Dicts/wingput/User.MB2.ps1
-
Dicts/wingput/ZNBiaoDian.MB
-
Dicts/wingput/keyboard.bmp
-
Dicts/wingput/wingput.INI
-
Dicts/wingput/wingput.MB1
-
Dicts/wingput/wingput.MB2
-
Dicts/wingput/wingput.ZI
-
KeyBoards/Default.INI
-
KeyBoards/Default.bmp
-
KeyBoards/IpaPan.TTF
-
KeyBoards/winVista.INI
-
KeyBoards/winVista.bmp
-
KeyBoards/俄文字母.KB
-
KeyBoards/偏旁部首.KB
-
KeyBoards/制表符.KB
-
KeyBoards/单位符号.KB
-
KeyBoards/希腊字母.KB
-
KeyBoards/拼音.KB
-
KeyBoards/数字序号.KB
-
KeyBoards/数学符号.KB
-
KeyBoards/新云软件.url.url
-
KeyBoards/日文平假名.KB
-
KeyBoards/日文片假名.KB
-
KeyBoards/标点符号.KB
-
KeyBoards/注音符号.KB
-
KeyBoards/特殊符号.KB
-
KeyBoards/空白键盘模板.TXT
-
KeyBoards/英文音标.INI
-
KeyBoards/英文音标.KB
-
KeyBoards/金融键盘.KB
-
Pics/image003.jpg.jpg
-
Pics/image005.jpg.jpg
-
Pics/image007.jpg.jpg
-
Pics/image009.jpg.jpg
-
Pics/image011.gif
-
Skins/Buttons.bmp
-
Skins/Buttons_单色.bmp
-
Skins/MainBar_展开.bmp
-
Skins/MainBar_折叠.bmp
-
Skins/Thumbs.db
-
Skins/back.bmp
-
Skins/back1.bmp
-
Skins/单色.INI
-
Skins/单色_展开.bmp
-
Skins/单色_折叠.bmp
-
Skins/彩色.INI
-
Skins/清爽.INI
-
Sound/ChongMa.wav
-
Sound/KongMa.wav
-
Sound/backspace.wav
-
Sound/bell.wav
-
Sound/enter.wav
-
Sound/letter.wav
-
Sound/space.wav
-
User.txt
-
对决五笔/一级简码对决.txt
-
对决五笔/三级简码对决.txt
-
对决五笔/二级简码对决.txt
-
对决五笔/单字重码对决.txt
-
对决五笔/词组重码对决_五笔篇.txt
-
对决五笔/词组重码对决_威普篇.txt
-
最先读我.txt
-
最新改进.txt
-
练习软件/background/Thumbs.db
-
练习软件/background/tw.jpg.jpg
-
练习软件/background/tw_original.jpg.jpg
-
练习软件/code/wingput.txt
-
练习软件/help/1.png.png
-
练习软件/help/2.png.png
-
练习软件/help/3.png.png
-
练习软件/help/4.png.png
-
练习软件/help/5.png.png
-
练习软件/help/6.png.png
-
练习软件/help/7.png.png
-
练习软件/help/Thumbs.db
-
练习软件/help/add.gif.gif
-
练习软件/help/bg.gif.gif
-
练习软件/help/index.files/1.png.png
-
练习软件/help/index.files/2.png.png
-
练习软件/help/index.files/3.png.png
-
练习软件/help/index.files/4.png.png
-
练习软件/help/index.files/5.png.png
-
练习软件/help/index.files/6.png.png
-
练习软件/help/index.files/7.png.png
-
练习软件/help/index.files/add.gif.gif
-
练习软件/help/index.files/interface.png.png
-
练习软件/help/index.files/menu.png.png
-
练习软件/help/index.files/show.gif.gif
-
练习软件/help/index.files/showall.gif.gif
-
练习软件/help/index.htm.html
-
练习软件/help/interface.png.png
-
练习软件/help/menu.png.png
-
练习软件/help/redball.png.png
-
练习软件/help/show.gif.gif
-
练习软件/help/showall.gif.gif
-
练习软件/history.rec
-
练习软件/record.rec
-
练习软件/skins/aluna/border.bmp
-
练习软件/skins/aluna/bottom.bmp
-
练习软件/skins/aluna/close.bmp
-
练习软件/skins/aluna/init.ini
-
练习软件/skins/aluna/maximum.bmp
-
练习软件/skins/aluna/minimum.bmp
-
练习软件/skins/aluna/numbers.bmp
-
练习软件/skins/aluna/title.bmp
-
练习软件/skins/simump/Thumbs.db
-
练习软件/skins/simump/border.bmp
-
练习软件/skins/simump/bottom.bmp
-
练习软件/skins/simump/close.bmp
-
练习软件/skins/simump/init.ini
-
练习软件/skins/simump/maximum.bmp
-
练习软件/skins/simump/minimum.bmp
-
练习软件/skins/simump/numbers.bmp
-
练习软件/skins/simump/title.bmp
-
练习软件/skins/simuos2/Thumbs.db
-
练习软件/skins/simuos2/border.bmp
-
练习软件/skins/simuos2/bottom.bmp
-
练习软件/skins/simuos2/close.bmp
-
练习软件/skins/simuos2/init.ini
-
练习软件/skins/simuos2/maximum.bmp
-
练习软件/skins/simuos2/minimum.bmp
-
练习软件/skins/simuos2/numbers.bmp
-
练习软件/skins/simuos2/title.bmp
-
练习软件/skins/simuxp/Thumbs.db
-
练习软件/skins/simuxp/border.bmp
-
练习软件/skins/simuxp/bottom.bmp
-
练习软件/skins/simuxp/close.bmp
-
练习软件/skins/simuxp/init.ini
-
练习软件/skins/simuxp/maximum.bmp
-
练习软件/skins/simuxp/minimum.bmp
-
练习软件/skins/simuxp/numbers.bmp
-
练习软件/skins/simuxp/title.bmp
-
练习软件/sound/wrong.wav
-
练习软件/text/一级简码.txt
-
练习软件/text/三级简码.txt
-
练习软件/text/为人民服务.txt
-
练习软件/text/二级简码.txt
-
练习软件/text/出师表.txt
-
练习软件/text/如何获得舒适的睡眠.txt
-
练习软件/text/岳阳楼记.txt
-
练习软件/text/常用1500字.txt
-
练习软件/text/常用1500字/1.txt
-
练习软件/text/常用1500字/2.txt
-
练习软件/text/常用1500字/3.txt
-
练习软件/text/常用1500字/4.txt
-
练习软件/text/常用1500字/5.txt
-
练习软件/text/政治经济/国务院2007工作要点.txt
-
练习软件/text/政治经济/纪念白求恩_毛泽东.txt
-
练习软件/text/散文_春_朱自清.txt
-
练习软件/text/最常用字500字.txt
-
练习软件/text/次常用1500字.txt
-
练习软件/text/次常用1500字/1.txt
-
练习软件/text/次常用1500字/2.txt
-
练习软件/text/次常用1500字/3.txt
-
练习软件/text/次常用1500字/4.txt
-
练习软件/text/次常用1500字/5.txt
-
练习软件/text/独体字.txt
-
练习软件/text/生活类文章.txt
-
练习软件/text/经典散文/从百草园到三味书屋_鲁迅.txt
-
练习软件/text/经典散文/匆匆_朱自清.txt
-
练习软件/text/经典散文/春_朱自清.txt
-
练习软件/text/经典散文/背影_朱自清.txt
-
练习软件/text/经典散文/荷塘月色_朱自清 .txt
-
练习软件/text/羊皮卷.txt
-
练习软件/text/计算机汉字输入.txt
-
练习软件/text/诗辞歌赋/再别康桥_徐志摩.txt
-
练习软件/text/诗辞歌赋/岳阳楼记_范仲淹.txt
-
练习软件/text/诗辞歌赋/致橡树_舒婷.txt
-
练习软件/text/诗辞歌赋/苏轼词三首.txt
-
练习软件/text/诗辞歌赋/面朝大海 春暖花开_海子.txt
-
练习软件/typingfaster.exe.exe windows:1 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_BYTES_REVERSED_LO
IMAGE_FILE_32BIT_MACHINE
IMAGE_FILE_BYTES_REVERSED_HI
Sections
CODE Size: 286KB - Virtual size: 744KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
DATA Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
BSS Size: - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.idata Size: 4KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.tls Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 512B - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.reloc Size: - Virtual size: 52KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 76KB - Virtual size: 156KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 8KB - Virtual size: 8KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
练习软件/user11.ini
-
练习软件/welcome.txt
-
输入法教程.htm.html
-
酷极手册.CHM.chm