jaffacakes118_mihomo-windows-386-v1[.]18[.]9[.]zip

General

Target
jaffacakes118_mihomo-windows-386-v1.18.9.zip
Size 9.8MB
Sample260916-kwfpasxgpe
SHA256 e032fbf3a6f9928e5613b16f1afa5dbdb5d8969116d7f585dcc76bbb4ca8d780
MD5 0e900036c4758a6c5d2ef47d599af260
SHA1 691104feab2ac2d240673e3cccc29cec72d8cd93
SHA512 1a7a2fd6b591777c99faf36c7e6a58bad2168ab9a4479e6583e135f661d3ea77e3aefca315711d395ae92334965a84aea776e5ae1f05ee7357c9e96d58be2405
SSDEEP 196608:ZXuIt7Nha0YSaKw1SDTVUiF3vIICC4AilF4Hn8ofLWaCNTLWTHYdjF3UpVhR:ZXT7NhlraKw1S5F/CC4AiXsTQyTHYd8p
TLSH
T17EA633205B2B959BFCB813EBB20C45912360F4277D0065B7BB239E52EBCCAB7565035B
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/mihomo-windows-386.exe

File Explorer

jaffacakes118_mihomo-windows-386-v1.18.9.zip

.zip 9.8MB
mihomo-windows-386.exe

.exe 25.2MB

jaffacakes118_mihomo-windows-386-v1.18.9.zip

SHA256 e032fbf3a6f9928e5613b16f1afa5dbdb5d8969116d7f585dcc76bbb4ca8d780
MD5 0e900036c4758a6c5d2ef47d599af260
SHA1 691104feab2ac2d240673e3cccc29cec72d8cd93
SHA512 1a7a2fd6b591777c99faf36c7e6a58bad2168ab9a4479e6583e135f661d3ea77e3aefca315711d395ae92334965a84aea776e5ae1f05ee7357c9e96d58be2405
SSDEEP 196608:ZXuIt7Nha0YSaKw1SDTVUiF3vIICC4AilF4Hn8ofLWaCNTLWTHYdjF3UpVhR:ZXT7NhlraKw1S5F/CC4AiXsTQyTHYd8p
TLSH
T17EA633205B2B959BFCB813EBB20C45912360F4277D0065B7BB239E52EBCCAB7565035B
MD5 SHA1 SHA512 SSDEEP TLSH

mihomo-windows-386.exe

IMPHASH 59cf8d1b9993e0a6f0b42b8897aec358
SHA256 b82a141ecb7f507e590efa1c8d50921eccfac470b2614e533dbb130a48b021c3
MD5 4c08b0982eb4e7e8eb96f9292eefa60d
SHA1 a3c3fb95afb055e36d5f3b485e1f74b05bb1f2de
SHA512 65bf6c2eb65edf6dce34b2efeac5e921d9fbef8836ff60c4d1d74ba611bf95af00f2d3ec94f18220ab5155c978ed0b7006cef786c012e697131c2f051b0dbf9a
SSDEEP 196608:iVDQAd97cyLF7a+r4K/Sf5uFW7IqK8dj0zRkEsL2cZXM:+Da+kKqfQ5qbyLcZ
TLSH
T1C5472A44FA8B56F6E903493590AA736F23344E058B18CBDBEB057B2EF9732D21D76205
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x86 arch:x86

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

504064

Magic Number

267

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_32BIT_MACHINE

PDB paths

Name

.text

Size

11.5MB

Virtual Size

11.5MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

11.7MB

Virtual Size

11.7MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.4MB

Virtual Size

1.6MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

616KB

Virtual Size

615KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

jaffacakes118_mihomo-windows-386-v1.18.9.zip

mihomo-windows-386.exe

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_mihomo-windows-386-v1.18.9.zip

mihomo-windows-386.exe

kernel32

generic