Gridinsoft Logo

Cool Client.exe Ransomware Occamy Analysis

Updated 1 month ago
Checked by Malware Check
Cool Client.exe

Technical Analysis

File Name Cool Client.exe
File Type
PE32+ executable (GUI) x86-64, for MS Windows
Scanner Version 1.0.229.174
Database Version 2025-11-15 06:00:16 UTC
⚠

Ransom.Win64.Occamy.oa!s1

Malware family: Occamy

N/A
Detection Rate
131,584
File Size (bytes)
2025-11-15
Analysis Date

Scan Another File

File Identification

Hash Type Value Action
MD5
ef82c959439e29600ff36476140597d9
SHA1
7b49c55de7300e68003398813385b5fcbbc0d171
SHA256
034fc3933c40ba25a5cf18a61c1b1931827850681c44a9ac2aae88d7ee0a7ac5
SHA512
df2d7fa9b0148f00da3aa087fc2a75f131d6066c85601e3a7da73a7b5d6e712aa81837b1f6c519f86aadaa242dff5a1191fba15d6362e9bf859130980562fe1a
ImpHash
7182b1ea6f92adbf459a2c65d8d4dd9e

PE Analysis

Basic Information

▼
Image Base 0x140000000
Entry Point 0x140001000
Compilation Time 2018-01-19 11:28:23
Checksum 0x00000000 (Actual: 0x0002ad76)
OS Version 4.0
PEiD Signatures PE32+ executable (GUI) x86-64, for MS Windows
Digital Signature No valid SignedData structure was found.
Imports 9 libraries
msvcrt, KERNEL32, SHELL32, WINMM, OLE32, SHLWAPI, USER32, GDI32, COMCTL32
Exports 0 functions
Resources 6 Resources
Sections 6 Sections

Version Information

▼
FileVersion 1.0
ProductVersion 1.0
ProductName Cool Cilent
InternalName Cool Cilent
FileDescription Cool Cilent
CompanyName Cool Cilent
LegalTrademarks Cool Cilent
LegalCopyright Cool Cilent
PrivateBuild Cool Cilent
SpecialBuild Cool Cilent
Comments Cool Cilent
Translation 0x0000 0x04e4

PE Sections

▼
Name Virtual Address Virtual Size Raw Size Entropy Characteristics MD5
.code 0x00001000 22,853 bytes 23,040 bytes 5.48 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ EE5C5AD38B8F832BACAAA63A4DBA7B45
.text 0x00007000 66,245 bytes 66,560 bytes 6.33 (Normal) IMAGE_SCN_CNT_CODE|IMAGE_SCN_MEM_EXECUTE|IMAGE_SCN_MEM_READ 44BAFA3018F9EB36DF47401A57F0C303
.rdata 0x00018000 19,245 bytes 19,456 bytes 6.66 (Compressed) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 941E1BDFA1A2B59593DF46DB561A76F8
.pdata 0x0001d000 4,296 bytes 4,608 bytes 4.88 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 9C802CF9AB10BC93A185F9699AC76726
.data 0x0001f000 8,984 bytes 5,632 bytes 4.30 (Normal) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ|IMAGE_SCN_MEM_WRITE C7E18F049BB6DB320E9ADC872ABEB25E
.rsrc 0x00022000 10,856 bytes 11,264 bytes 7.66 (Packed/Encrypted) IMAGE_SCN_CNT_INITIALIZED_DATA|IMAGE_SCN_MEM_READ 3628AE6D3776F00578C3BFC5B37BCC5F
Entropy Analysis Alert

1 section(s) with high entropy (≥7.5) detected - possible packing/encryption

1 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼
Total Resources: 6 (10,238 bytes)
Resource Type Count Total Size Percentage
RT_RCDATA 4 8,746 bytes
85.4%
RT_VERSION 1 820 bytes
8%
RT_MANIFEST 1 672 bytes
6.6%

Certificate Chain Analysis

▼
No Digital Signatures

This file is not digitally signed.

Security Implications:
  • Cannot verify the publisher's identity
  • Increased security risk when running this file
  • May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

Ransom.Win64.Occamy.oa!s1 Removal

Gridinsoft has the capability to identify and eliminate Ransom.Win64.Occamy.oa!s1 without requiring further user intervention.

Download Anti-Malware

Removal Instructions

Follow these steps to completely remove the threat from your system

  1. Start by downloading Gridinsoft Anti-Malware to your computer.
  2. Double-click on the gsam-en-install.exe file and follow the on-screen instructions to install the program.
  3. Once the installation of Gridinsoft Anti-Malware is complete, the program will open on the Scan screen.
  4. Click on the "Standard Scan" button to begin scanning your computer for threats.
  5. After the scanning process is finished, click on "Clean Now" to remove any detected threats.
  6. If prompted, restart your system to complete the removal process and ensure all threats are eliminated.
Important: Before You Start
Disconnect from the internet to prevent the malware from spreading or downloading additional threats. Run the scan in Safe Mode for better detection and removal of persistent threats.

Leave a Comment

Share your thoughts or insights about this file. Do you align with our conclusion?

Your feedback could influence our rating, and rest assured, your email will remain confidential and will only be used to communicate with you if necessary.

Your Score for
/

Gridinsoft Anti-Malware

Stay Malware-Free: Keep Your PC Protected with Gridinsoft Anti-Malware

Gridinsoft Anti-Malware offers just that—peace of mind with a robust, user-friendly solution that’s constantly updated to combat the latest threats. Designed by cybersecurity experts, it provides real-time protection and effortless malware removal. It’s not just about detecting threats; it's about enhancing your digital life with uninterrupted security. Give it a try and experience what it feels like to browse worry-free!

Gridinsoft Anti-Malware Download Now
Gridinsoft Anti-Malware