jaffacakes118_mihomo-windows-amd64-compatible-go120-v1[.]18[.]9[.]zip

General

Target
jaffacakes118_mihomo-windows-amd64-compatible-go120-v1.18.9.zip
Size 11.4MB
Sample260916-kwtk6ahm21
SHA256 5c1f2b9d7edc28f3d5889d580f061b59cf00ec90bac918e10223b1f612a105db
MD5 fba6df3773745e53083eaead1f9b9f00
SHA1 67739f5e182096791aae72fe3d567b993f0cdcf3
SHA512 b92848c72bbb8e0055e4ca5c207645606d6016008485c62ff4b9b8fa20cbb65984a846d927b3defc89df085f4352266575acd18699c5de0915ff18461a3671e0
SSDEEP 196608:IJ7oLNAptDlyW+AGCN61zpi8gwwuXR1TOHKJtOKEZTHmJKCAQg9BFtgrQmwUy:IJkhQAW+vpPeY1SHstVE1QhqB8rzc
TLSH
T15CC63391F1FE9E18E58710D90B062FE46C237832B164325C38BD26B315765FBD8DE8A6
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/mihomo-windows-amd64-compatible-go120.exe

File Explorer

jaffacakes118_mihomo-windows-amd64-compatible-go120-v1.18.9.zip

.zip 11.4MB
mihomo-windows-amd64-compatible-go120.exe

.exe 30.9MB

jaffacakes118_mihomo-windows-amd64-compatible-go120-v1.18.9.zip

SHA256 5c1f2b9d7edc28f3d5889d580f061b59cf00ec90bac918e10223b1f612a105db
MD5 fba6df3773745e53083eaead1f9b9f00
SHA1 67739f5e182096791aae72fe3d567b993f0cdcf3
SHA512 b92848c72bbb8e0055e4ca5c207645606d6016008485c62ff4b9b8fa20cbb65984a846d927b3defc89df085f4352266575acd18699c5de0915ff18461a3671e0
SSDEEP 196608:IJ7oLNAptDlyW+AGCN61zpi8gwwuXR1TOHKJtOKEZTHmJKCAQg9BFtgrQmwUy:IJkhQAW+vpPeY1SHstVE1QhqB8rzc
TLSH
T15CC63391F1FE9E18E58710D90B062FE46C237832B164325C38BD26B315765FBD8DE8A6
MD5 SHA1 SHA512 SSDEEP TLSH

mihomo-windows-amd64-compatible-go120.exe

IMPHASH 65892a964106b5e0c6c363fdf21975eb
SHA256 e2a7d91c26967ab9cfff8cf0e01986127a21e8f940315732a1ee43c83c5c4f02
MD5 c38e8cb4b425f7b8851b3317ab1ff8c1
SHA1 357665ea192c3bee0efc0c0268f8cdbaf7caed5e
SHA512 8fafb48f595334a16afbf0ba758f3cb44c18da654aea8b85421945eac816b91f234b2ba888a85326615c637f6efbbe0dea6b7c659a64d0abae66400fdb479e55
SSDEEP 196608:99y180RBkg1nNGcSgg5cewj/L8X/4+MZ:99yLBkgrGh15gj/YX/y
TLSH
T135674A47F85150E4C5AED134C6659223BBB03C894B3463E72B61FAB82E73BD45BBA350
MD5 SHA1 SHA512 SSDEEP TLSH

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

1

Major OS version

6

Entry point

458080

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE IMAGE_FILE_DEBUG_STRIPPED

PDB paths

Name

.text

Size

14.3MB

Virtual Size

14.3MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

15.0MB

Virtual Size

15.0MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

1.3MB

Virtual Size

1.8MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

290KB

Virtual Size

290KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

4B

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

jaffacakes118_mihomo-windows-amd64-compatible-go120-v1.18.9.zip

mihomo-windows-amd64-compatible-go120.exe

kernel32

generic

Sharing

General

Malware Config

Signatures

File Explorer

jaffacakes118_mihomo-windows-amd64-compatible-go120-v1.18.9.zip

mihomo-windows-amd64-compatible-go120.exe

kernel32

generic