jaffacakes118_mihomo-windows-amd64-go121-v1[.]18[.]9[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
jaffacakes118_mihomo-windows-amd64-go121-v1.18.9.zip
Size 11.3MB
Sample260916-kwpbfaxgrd
SHA256 9a9fff7243fa9fd0870e22137500094e429887aa2b96a149c030021ebb07819a
MD5 78d7ddced15aad2e71bfa877307c0091
SHA1 12ef898b9a38df2cd6eec8c1a1f89b3ceee659c8
SHA512 5c3adc2807c937e3d300d6add7edd9f77427978d4cfbfe05b1a52e214fe2a1efe68b4148f0b7e068d55fa2f50503a3d054b4d7cb3730b751ce35d58a22638f42
SSDEEP 196608:p29aUcdY1vPusohoKhoMTDBTnAsIX5b95WqGzIyiBFQ3LCePbp0h1DsPBN1WfLJj:49tvPusAmMT1TAj7JGDijYT1WjJxx
TLSH
T1E6C63356C8B0B538313CDBEFE89914A8EB21338C14556E6C0E6E86F5B1E5C2597331EE
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/mihomo-windows-amd64-go121.exe

File Explorer

jaffacakes118_mihomo-windows-amd64-go121-v1.18.9.zip

.zip 11.3MB
mihomo-windows-amd64-go121.exe

.exe 30.8MB

jaffacakes118_mihomo-windows-amd64-go121-v1.18.9.zip

SHA256 9a9fff7243fa9fd0870e22137500094e429887aa2b96a149c030021ebb07819a
MD5 78d7ddced15aad2e71bfa877307c0091
SHA1 12ef898b9a38df2cd6eec8c1a1f89b3ceee659c8
SHA512 5c3adc2807c937e3d300d6add7edd9f77427978d4cfbfe05b1a52e214fe2a1efe68b4148f0b7e068d55fa2f50503a3d054b4d7cb3730b751ce35d58a22638f42
SSDEEP 196608:p29aUcdY1vPusohoKhoMTDBTnAsIX5b95WqGzIyiBFQ3LCePbp0h1DsPBN1WfLJj:49tvPusAmMT1TAj7JGDijYT1WjJxx
TLSH
T1E6C63356C8B0B538313CDBEFE89914A8EB21338C14556E6C0E6E86F5B1E5C2597331EE
MD5 SHA1 SHA512 SSDEEP TLSH

mihomo-windows-amd64-go121.exe

IMPHASH ea509d361799935a94335b88f534a970
SHA256 bbe24e759e1403baf5ac6ba02145bc20edd5ddc7c313e4da8fbbab8031567870
MD5 5b2121951c33a5aadff91506e07a7c8e
SHA1 e42d2282fa826975d3ffaa7385f2ae65c20a77b1
SHA512 589206470852772066ed353406874b785422b199c36768f7a99ac796e18a771c2b3eb3c5a8c6809e0cd74eb7b82d7a8317b3bcaa8e32986e10feddf4e8589e26
SSDEEP 196608:htrpEiAYAbXBPy8cw+AO/G4GOB5beBvdmZzMmOiGeqNAOZ:hAVYAbXA8cw+Am5Um1oiGl
TLSH
T1EF674947E86540E4C9EDD538C9A69223BF717C458B3523DB2B60F7282F72BD06AB9350
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

473152

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

13.6MB

Virtual Size

13.6MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

15.2MB

Virtual Size

15.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.3MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

383KB

Virtual Size

383KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

168B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

280KB

Virtual Size

279KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

jaffacakes118_mihomo-windows-amd64-go121-v1.18.9.zip

mihomo-windows-amd64-go121.exe

kernel32

generic