Overview
overview
7Static
static
7CoolIME.exe
windows7-x64
1CoolIME.exe
windows10-2004-x64
1Dicts/winp...in.vbs
windows7-x64
1Dicts/winp...in.vbs
windows10-2004-x64
1Dicts/winp...in.vbs
windows7-x64
1Dicts/winp...in.vbs
windows10-2004-x64
1Dicts/winput/User.ps1
windows7-x64
1Dicts/winput/User.ps1
windows10-2004-x64
1输入法教程.doc
windows7-x64
4输入法教程.doc
windows10-2004-x64
1酷极手册.chm
windows7-x64
1酷极手册.chm
windows10-2004-x64
1Behavioral task
behavioral1
Sample
CoolIME.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
CoolIME.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
Dicts/winput/PinYin.vbs
Resource
win7-20240221-en
Behavioral task
behavioral4
Sample
Dicts/winput/PinYin.vbs
Resource
win10v2004-20231215-en
Behavioral task
behavioral5
Sample
Dicts/winput/QuanPin.vbs
Resource
win7-20240215-en
Behavioral task
behavioral6
Sample
Dicts/winput/QuanPin.vbs
Resource
win10v2004-20240226-en
Behavioral task
behavioral7
Sample
Dicts/winput/User.ps1
Resource
win7-20240221-en
Behavioral task
behavioral8
Sample
Dicts/winput/User.ps1
Resource
win10v2004-20240226-en
Behavioral task
behavioral9
Sample
输入法教程.doc
Resource
win7-20240221-en
Behavioral task
behavioral10
Sample
输入法教程.doc
Resource
win10v2004-20240226-en
Behavioral task
behavioral11
Sample
酷极手册.chm
Resource
win7-20240221-en
Behavioral task
behavioral12
Sample
酷极手册.chm
Resource
win10v2004-20240226-en
General
-
Target
cbb3309d46acd420aa7ad64ccc72ee4f
-
Size
2.4MB
-
MD5
cbb3309d46acd420aa7ad64ccc72ee4f
-
SHA1
2befec08c5a91ff496d33c8bbe11b65f3c971a53
-
SHA256
3960ea794cb0eab7871a07a880a7464d98b0d1a7f9320c566ec420584ace401e
-
SHA512
a4c97ee942e10dcfe5604b54a238fa01bb9334e5911c6589dbad267614b60af146d9808fea738cfda55277cc59299ade778d419a68ac4b6cfb2c08bec244a42b
-
SSDEEP
49152:TNVCmcbJnPq+PDNFlyPFGileTOmAZOr5WXwXBZeHj87DXOq/QMD8SALrUkMDIaxP:TNVwJPPDmzU5dPeHj87DXOZi8BLrUk+
Malware Config
Signatures
-
resource yara_rule static1/unpack001/CoolIME.exe aspack_v212_v242 -
Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/CoolIME.exe
Files
-
cbb3309d46acd420aa7ad64ccc72ee4f.rar
-
CoolIME.INI
-
CoolIME.exe.exe windows:4 windows x86 arch:x86
Headers
File Characteristics
IMAGE_FILE_RELOCS_STRIPPED
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_32BIT_MACHINE
Sections
.text Size: 94KB - Virtual size: 232KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rdata Size: 5KB - Virtual size: 16KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.data Size: 7KB - Virtual size: 200KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.rsrc Size: 85KB - Virtual size: 424KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.aspack Size: 9KB - Virtual size: 12KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
.adata Size: - Virtual size: 4KB
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
-
Dicts/winput/BiaoDian.MB
-
Dicts/winput/PinYin.MB1.vbs
-
Dicts/winput/PinYin.MB2
-
Dicts/winput/QuanJiao.MB
-
Dicts/winput/QuanPin.ZI.vbs
-
Dicts/winput/User.MB2.ps1
-
Dicts/winput/ZNBiaoDian.MB
-
Dicts/winput/winput.INI
-
Dicts/winput/winput.MB1
-
Dicts/winput/winput.MB2
-
Dicts/winput/winput.ZI
-
KeyBoards/Default.INI
-
KeyBoards/Default.bmp
-
KeyBoards/IpaPan.TTF
-
KeyBoards/winVista.INI
-
KeyBoards/winVista.bmp
-
KeyBoards/俄文字母.KB
-
KeyBoards/偏旁部首.KB
-
KeyBoards/制表符.KB
-
KeyBoards/单位符号.KB
-
KeyBoards/希腊字母.KB
-
KeyBoards/拼音.KB
-
KeyBoards/数字序号.KB
-
KeyBoards/数学符号.KB
-
KeyBoards/日文平假名.KB
-
KeyBoards/日文片假名.KB
-
KeyBoards/标点符号.KB
-
KeyBoards/注音符号.KB
-
KeyBoards/特殊符号.KB
-
KeyBoards/空白键盘模板.TXT
-
KeyBoards/英文音标.INI
-
KeyBoards/英文音标.KB
-
KeyBoards/金融键盘.KB
-
Skins/Buttons.bmp
-
Skins/Buttons_单色.bmp
-
Skins/MainBar_展开.bmp
-
Skins/MainBar_折叠.bmp
-
Skins/Thumbs.db
-
Skins/back.bmp
-
Skins/单色.INI
-
Skins/单色_展开.bmp
-
Skins/单色_折叠.bmp
-
Skins/彩色.INI
-
Sound/ChongMa.wav
-
Sound/KongMa.wav
-
Sound/backspace.wav
-
Sound/bell.wav
-
Sound/enter.wav
-
Sound/letter.wav
-
Sound/space.wav
-
User.txt
-
对决五笔/一级简码对决.txt
-
对决五笔/三级简码对决.txt
-
对决五笔/二级简码对决.txt
-
对决五笔/单字重码对决.txt
-
对决五笔/词组重码对决_五笔篇.txt
-
对决五笔/词组重码对决_威普篇.txt
-
最先读我.txt
-
输入法教程.DOC.doc windows office2003
-
酷极手册.CHM.chm