mihomo-windows-amd64-v1[.]19[.]33[.]1[.]zip

Sharing

Copy URL Twitter E-mail

General

Target
mihomo-windows-amd64-v1.19.33.1.zip
Size 21.6MB
Sample261107-3vf8jsgs7x
SHA256 01475d8ba44f0a1bf245dd15de0cfcff1ad913c584bff05fe4e95928ebf8309f
MD5 2932f775f5309cc6f3b66f1690a2bac0
SHA1 786fe90b982f53122440366b5f4d00f21247e2c4
SHA512 9661b90b5a508ebea2323103a4d3ad8e5817093a4562f387784a6cf0e2a057dbd0bc92f2c6a713f12844d440a0b9d47ddedbafdb811cb61c15dea73228d12ddc
SSDEEP 393216:dH0KYXbaYtPD7kGisezu67vWyZIfkhZ9TdS/RawkvJFr7SoEm3a5EFaycmLLJosK:R0NXFtUGipu67vJZIfkLI/HkRF3FfqOA
TLSH
T1BE3733059328D36204AED88B20520FDBDB63C08DAA7AFBD615D54F660FF3D55E882D36
MD5 SHA1 SHA512 SSDEEP TLSH

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
unpack001/mihomo-windows-amd64.exe

File Explorer

mihomo-windows-amd64-v1.19.33.1.zip

.zip 21.6MB
mihomo-windows-amd64.exe

.exe 58.7MB

mihomo-windows-amd64-v1.19.33.1.zip

SHA256 01475d8ba44f0a1bf245dd15de0cfcff1ad913c584bff05fe4e95928ebf8309f
MD5 2932f775f5309cc6f3b66f1690a2bac0
SHA1 786fe90b982f53122440366b5f4d00f21247e2c4
SHA512 9661b90b5a508ebea2323103a4d3ad8e5817093a4562f387784a6cf0e2a057dbd0bc92f2c6a713f12844d440a0b9d47ddedbafdb811cb61c15dea73228d12ddc
SSDEEP 393216:dH0KYXbaYtPD7kGisezu67vWyZIfkhZ9TdS/RawkvJFr7SoEm3a5EFaycmLLJosK:R0NXFtUGipu67vJZIfkLI/HkRF3FfqOA
TLSH
T1BE3733059328D36204AED88B20520FDBDB63C08DAA7AFBD615D54F660FF3D55E882D36
MD5 SHA1 SHA512 SSDEEP TLSH

mihomo-windows-amd64.exe

IMPHASH f9446c531a0baf10ff7aa8398cbc025b
SHA256 65fbc5199e92e3ff769457d9a25a5ca5985bd8227bc4754ce854cd1baa3ca390
MD5 5bbadd8c48f8bd3e7b1277f3c66909fc
SHA1 56714d9c123511599570d3fd4c3db2dfcbd6cb0f
SHA512 fb5ca488ceb6210499f5ae6e9ade814314801340df1977613f8e2683caaa3e01e21c1d0dc3d06b38595c4175e099714fb2c248512663fdae1ea5a0f122d80d03
SSDEEP 393216:9f5p/ZhxPPTiO5hfdozUrIDeP0Q3Ccii+Q/hH+K:9f5d5TiOXdoYr41g+Q/hH
TLSH
T107D75B47F82A0CE4F49DC439C66692237B713C69572523E71B10FA542F7EBD06ABA360
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Unsigned PE

Checks for missing Authenticode signature.

Minor OS version

Major OS version

Entry point

592192

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_CUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

Name

.text

Size

23.4MB

Virtual Size

23.4MB

Characteristics

IMAGE_SCN_CNT_CODE IMAGE_SCN_MEM_EXECUTE IMAGE_SCN_MEM_READ

Name

.rdata

Size

26.2MB

Virtual Size

26.2MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.data

Size

8.0MB

Virtual Size

40.5MB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.pdata

Size

563KB

Virtual Size

562KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.xdata

Size

512B

Virtual Size

192B

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ

Name

.idata

Size

1KB

Virtual Size

1KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_READ IMAGE_SCN_MEM_WRITE

Name

.reloc

Size

538KB

Virtual Size

538KB

Characteristics

IMAGE_SCN_CNT_INITIALIZED_DATA IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

Name

.symtab

Size

512B

Virtual Size

Characteristics

IMAGE_SCN_MEM_DISCARDABLE IMAGE_SCN_MEM_READ

mihomo-windows-amd64-v1.19.33.1.zip

mihomo-windows-amd64.exe

kernel32

generic