jaffacakes118_mihomo-windows-amd64-v1[.]18[.]9[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_mihomo-windows-amd64-v1.18.9.zip
Size 10.2MB
Sample260916-kwmslsxgqf
SHA256 28c3cb329dbb9ce18213368398b8fdaf097081bff79d78ce838303e193f0e9ac
MD5 354e2ca116b355fb73af77ea37470adb
SHA1 a26c5e18745a64b0c2bc7b7e1fc81a8b15ec0fa3
SHA512 85541cb9e5dfafc07fdb3534aeff0e4da02f585bf1d73227b52f3c096d7e08480cb920a191885a076ad03a89009b9b396203165bb4283ee672d421a69fbddaba
SSDEEP 196608:bIXLKvKt5Td0fBGDn/AiRguP7KMPGrDXFx6jx2nfu0EaQ6AcFTxjo88W+ub0A6ne:b+ZBKfUD/AQAnkm4dQFTpo8uuPmql99
TLSH
T17DB633524075FAB43DD9B3CB17F74CD0A9B8847A261CB043A84A4FE79C9326A5B94CF4
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/mihomo-windows-amd64.exe

File Explorer

jaffacakes118_mihomo-windows-amd64-v1.18.9.zip

.zip 10.2MB
mihomo-windows-amd64.exe

.exe 27.0MB

jaffacakes118_mihomo-windows-amd64-v1.18.9.zip

SHA256 28c3cb329dbb9ce18213368398b8fdaf097081bff79d78ce838303e193f0e9ac
MD5 354e2ca116b355fb73af77ea37470adb
SHA1 a26c5e18745a64b0c2bc7b7e1fc81a8b15ec0fa3
SHA512 85541cb9e5dfafc07fdb3534aeff0e4da02f585bf1d73227b52f3c096d7e08480cb920a191885a076ad03a89009b9b396203165bb4283ee672d421a69fbddaba
SSDEEP 196608:bIXLKvKt5Td0fBGDn/AiRguP7KMPGrDXFx6jx2nfu0EaQ6AcFTxjo88W+ub0A6ne:b+ZBKfUD/AQAnkm4dQFTpo8uuPmql99
TLSH
T17DB633524075FAB43DD9B3CB17F74CD0A9B8847A261CB043A84A4FE79C9326A5B94CF4
MD5 SHA1 SHA512 SSDEEP TLSH

mihomo-windows-amd64.exe

IMPHASH 522f45065e49cded4db0cdcb713aabee
SHA256 20f77d1d96bd7ead346ed7db3ab8d3275a5a39e04e0620c593cca6842d41dd8e
MD5 c92bfbc15975642fb6673b22c1dfbffd
SHA1 deb05b28c08f45308406b101c27bcd19dbc771f7
SHA512 ac0cbce8114b8a41e2c8437268ff0a5738dc2114bc3f9c1ecb4d5b983e061ff553233d081cd1e7ec6d37836cfa243423f0bcbabde733601604918c97bbb6707b
SSDEEP 196608:YyKGkkT6AIZK+PgLjBAWnmj5nqLjfTPBF96qZT:ykT63NgBwZqPLBOq
TLSH
T15F575A47EC6544E4C4E9C534C5A6822BBB717C498B3527D72B60F7282F72BD0AABE350
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

507648

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

12.0MB

Virtual Size

12.0MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

13.1MB

Virtual Size

13.1MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.4MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

308KB

Virtual Size

307KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

180B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

269KB

Virtual Size

269KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

jaffacakes118_mihomo-windows-amd64-v1.18.9.zip

mihomo-windows-amd64.exe

kernel32

generic