nitro free tool.zip
- SHA256 d18b9793500bc3451746e05207d63cd68e7b3329ba3c0dc907e10800119a457a
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
nitro free tool/main.py
Resource
win11-20260130-en
windows11-21h2-x64
24 signatures
600 seconds
Behavioral task
behavioral2
Sample
nitro free tool/pyarmor_runtime_000000/__init__.py
Resource
win11-20260130-en
windows11-21h2-x64
3 signatures
600 seconds
Behavioral task
behavioral3
Sample
nitro free tool/pyarmor_runtime_000000/pyarmor_runtime.dll
Resource
win11-20260130-en
windows11-21h2-x64
0 signatures
600 seconds
Behavioral task
behavioral4
Sample
nitro free tool/start.bat
Resource
win11-20260130-en
windows11-21h2-x64
1 signatures
600 seconds
General
- Target nitro free tool.zip
- Size 255KB
- Sample260426-n44ymsgz7x
- SHA256 d18b9793500bc3451746e05207d63cd68e7b3329ba3c0dc907e10800119a457a
- MD5 b68f4341c67cb23bb300564fe1767663
- SHA1 79bb1140ae7f6117705a706dc6546f49cddc5c66
- SHA512 f0b9696dc68cf7b9cae978a48312ae990fafd938b093a4ef3647c6f6480897098be565c3b9f8a4187c10bbbac88d2aa78426f9b8379b866e3e6a92c064314ee9
- SSDEEP 6144:G/BvCj5uA/YS/Y+jlUGcDH9y9LkxhfKfkknSyAsjpO:GauMwIlhQgLkxhakSSDsjpO
- TLSH T1FB4423CCCEF07846DAFC1E348A7D7BB509309BA94A0C618747395FCCAC58A56059AF87
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 1 IoCs
Checks for missing Authenticode signature.
resource unpack001/nitro free tool/pyarmor_runtime_000000/pyarmor_runtime.pyd
File Explorer
-
nitro free tool.zip.zip 255KB
-
nitro free tool/config/config.json26B
-
nitro free tool/main.py53KB
-
nitro free tool/pyarmor_runtime_000000/__init__.py103B
-
nitro free tool/pyarmor_runtime_000000/pyarmor_runtime.pyd.dll 627KB
-
nitro free tool/requirements.txt18B
-
nitro free tool/start.bat.bat 123B
nitro free tool/config/config.json
- SHA256 2e4cb786b6c2c216ad22cc6a7f485c57c4ce87182446fc9bfa9e444c06a7a805
- MD5 adce26fd641d01619d4665f917822eab
- SHA1 58f616b504a2c3f350b164f43090f1d19962d37c
- SHA512 4deaf7a9617ec605cc1e6f6d5abf57d7c7955bbb4a5290ec5cdeb003cd5ae177235c68c942059561d000f54411d2b617a633089223bb349f86823a68c2167eae
- MD5 SHA1 SHA512
nitro free tool/main.py
- SHA256 c06f7483cc8fbcd6fc402a5690f0b9f1db4eca5db1b61b66c11629da2868436f
- MD5 56a0b5243a447507ae292c7c52e5b5d2
- SHA1 7dc57361e92c7f62a7087833399b3c3582caad9a
- SHA512 5de206c239c718061b0b4566249ab7c0a338a43818891ff1800561d99d94753b962364b2f197765ffe29e6c8fd9f47f42719fb992dc2f213293024a1a9316e45
- SSDEEP 1536:wKvue5+aoiVNdUpkR0pZPQY+YliSEp8OoZnu5FvEwlsf:wHZaXwpFZlLOFXvEPf
- TLSH T1A033A9855622E17E5B96CD182F43BEDC2968D9EFC9C9E701F0C41A4FE0A873894E57C2
- MD5 SHA1 SHA512 SSDEEP TLSH
nitro free tool/pyarmor_runtime_000000/__init__.py
- SHA256 36ec246ab1810998c8e14455a9a4c4e593c4c73d368c6321c8e190518ae3b4de
- MD5 086c7d97194cdddf30b7eccaa8db6bdd
- SHA1 e0be1b02ae23ddd2127f842b6a7b2117139397c5
- SHA512 21f3cfcb78b1832127fbffcb8b96c5271668d1b918b25d89cde026dfac4b11cffee1c5b167175d2bc87cf63ca8dd4d9257e934a99c046144a527ac670ff4677c
- TLSH T13EB012C505756EC3923491C1C676113407B630D62FC008611E8862B88BC26C1CEC4301
- MD5 SHA1 SHA512 TLSH
nitro free tool/pyarmor_runtime_000000/pyarmor_runtime.pyd
- IMPHASH f6b79aad028ba161a0df24bd1a266eee
- SHA256 08e661d6b7f0aa69c36e5a62fe97d7e026841f1e64f0595d91c3cc61a5bb6cef
- MD5 9f00697744a868338efcc692c71a0c88
- SHA1 d64689ec76566be6fca899d6f318d88c8c43e1d1
- SHA512 1e2aca66d04508fbe8a9a9f7321e98e3311e9547c1bd4103329bf77a365a9fd3ae748be4d427f02659b33db35bb03356b39be584ee06f73e9a6557987ce2a67e
- SSDEEP 12288:aQdqHlnMNGrc9TdcQ7fUoP65et/nEIe2SD:aQqlc9TdcQ7fUoP65et/nZ
- TLSH T1A7D4184BE1FA15D0E6B6E17C078BF2337C3ABA588160775B355CD3A527D0A9222D1F22
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
4
Entry point
4912
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LINE_NUMS_STRIPPED
IMAGE_FILE_LOCAL_SYMS_STRIPPED
IMAGE_FILE_LARGE_ADDRESS_AWARE
IMAGE_FILE_DEBUG_STRIPPED
IMAGE_FILE_DLL
PDB paths
python314
PyArg_ParseTuple
PyBuffer_FillInfo
PyBuffer_Release
PyBytes_AsString
PyBytes_AsStringAndSize
PyBytes_FromStringAndSize
PyBytes_Type
PyCFunction_GetSelf
PyCFunction_Type
PyCMethod_New
PyCell_Get
PyCell_New
PyCell_Set
PyCode_GetCode
PyCode_Type
PyComplex_FromCComplex
PyComplex_ImagAsDouble
PyComplex_RealAsDouble
PyComplex_Type
PyDict_Copy
PyDict_DelItem
PyDict_GetItem
PyDict_GetItemString
PyDict_New
PyDict_Next
PyDict_SetItem
PyDict_SetItemString
PyDict_Size
PyDict_Type
PyDict_Update
PyErr_CheckSignals
PyErr_Clear
PyErr_ExceptionMatches
PyErr_Fetch
PyErr_Format
PyErr_GivenExceptionMatches
PyErr_NoMemory
PyErr_NormalizeException
PyErr_Occurred
PyErr_Restore
PyErr_SetFromWindowsErr
PyErr_SetObject
PyErr_SetString
PyEval_EvalCode
PyEval_GetBuiltins
PyEval_GetFrame
PyExc_AttributeError
PyExc_EOFError
PyExc_ImportError
PyExc_NotImplementedError
PyExc_OverflowError
PyExc_RuntimeError
PyExc_StopIteration
PyExc_SystemError
PyExc_SystemExit
PyExc_TypeError
PyExc_UnboundLocalError
PyExc_ValueError
PyException_SetCause
PyException_SetContext
PyException_SetTraceback
PyFloat_FromDouble
PyFloat_Pack8
PyFloat_Type
PyFloat_Unpack8
PyFrozenSet_New
PyFrozenSet_Type
PyFunction_GetCode
PyFunction_NewWithQualName
PyImport_ExecCodeModuleObject
PyImport_GetModule
PyImport_GetModuleDict
PyImport_ImportModule
PyImport_ImportModuleLevel
PyImport_ImportModuleLevelObject
PyIter_Next
PyList_Append
PyList_AsTuple
PyList_GetItem
PyList_New
PyList_Sort
PyList_Type
PyLongWriter_Create
PyLongWriter_Discard
PyLongWriter_Finish
PyLong_AsInt
PyLong_AsLong
PyLong_AsLongAndOverflow
PyLong_AsVoidPtr
PyLong_Export
PyLong_FreeExport
PyLong_FromLong
PyLong_FromVoidPtr
PyLong_GetNativeLayout
PyLong_Type
PyMapping_GetOptionalItem
PyMem_Free
PyMem_Malloc
PyMem_Realloc
PyMemoryView_FromBuffer
PyMethod_Function
PyMethod_Type
PyModule_Create2
PyModule_GetDict
PyModule_GetFilenameObject
PyModule_GetName
PyModule_Type
PyNumber_Add
PyNumber_And
PyNumber_AsSsize_t
PyNumber_FloorDivide
PyNumber_InPlaceAdd
PyNumber_InPlaceAnd
PyNumber_InPlaceFloorDivide
PyNumber_InPlaceLshift
PyNumber_InPlaceMatrixMultiply
PyNumber_InPlaceMultiply
PyNumber_InPlaceOr
PyNumber_InPlacePower
PyNumber_InPlaceRemainder
PyNumber_InPlaceRshift
PyNumber_InPlaceSubtract
PyNumber_InPlaceTrueDivide
PyNumber_InPlaceXor
PyNumber_Invert
PyNumber_Lshift
PyNumber_MatrixMultiply
PyNumber_Multiply
PyNumber_Negative
PyNumber_Or
PyNumber_Positive
PyNumber_Power
PyNumber_Remainder
PyNumber_Rshift
PyNumber_Subtract
PyNumber_TrueDivide
PyNumber_Xor
PyOS_double_to_string
PyOS_string_to_double
PyObject_ASCII
PyObject_Call
PyObject_CallFunction
PyObject_CallFunctionObjArgs
PyObject_CallMethod
PyObject_CheckBuffer
PyObject_DelItem
PyObject_Format
PyObject_GetAttr
PyObject_GetAttrString
PyObject_GetBuffer
PyObject_GetItem
PyObject_GetIter
PyObject_GetOptionalAttr
PyObject_IsSubclass
PyObject_IsTrue
PyObject_Repr
PyObject_RichCompare
PyObject_SetAttr
PyObject_SetItem
PyObject_Str
PyObject_Vectorcall
PyObject_VectorcallDict
PySequence_Check
PySequence_Contains
PySequence_List
PySequence_Tuple
PySet_Add
PySet_Contains
PySet_New
PySet_Type
PySlice_New
PySlice_Type
PySys_GetObject
PyThreadState_Get
PyTraceBack_Here
PyTuple_GetItem
PyTuple_GetSlice
PyTuple_New
PyTuple_Pack
PyTuple_SetItem
PyTuple_Size
PyTuple_Type
PyType_IsSubtype
PyUnicode_AsEncodedString
PyUnicode_AsUTF8
PyUnicode_AsUTF8AndSize
PyUnicode_AsWideChar
PyUnicode_DecodeUTF8
PyUnicode_FromFormat
PyUnicode_FromKindAndData
PyUnicode_FromString
PyUnicode_InternInPlace
PyUnicode_New
PyUnicode_Type
Py_BuildValue
Py_DecRef
Py_GetConstant
Py_IncRef
_PyBytes_Resize
_PyErr_BadInternalCall
_PyErr_Clear
_PyErr_ExceptionMatches
_PyErr_Format
_PyErr_SetString
_PyList_Extend
_PyLong_FromByteArray
_PyObject_CallMethod
_PyObject_LookupSpecial
_PyObject_MakeTpCall
_PyObject_NewVar
_PyRuntime
_PySet_NextEntryRef
_PySys_GetOptionalAttrString
_PyThreadState_GetCurrent
_PyUnicode_FromId
_PyUnicode_InternImmortal
_PyUnicode_InternMortal
_PyUnicode_JoinArray
_Py_CheckFunctionResult
_Py_Dealloc
_Py_EllipsisObject
_Py_FalseStruct
_Py_GetConfig
_Py_NoneStruct
_Py_TrueStruct
_Py_ctype_table
_Py_hashtable_compare_direct
_Py_hashtable_destroy
_Py_hashtable_hash_ptr
_Py_hashtable_new_full
_Py_hashtable_set
advapi32
CryptAcquireContextA
CryptGenRandom
CryptReleaseContext
RegCloseKey
RegEnumKeyExA
RegGetValueA
RegOpenKeyExA
iphlpapi
GetAdaptersAddresses
GetNetworkParams
kernel32
CloseHandle
CreateFileA
CreateFileMappingA
DeleteCriticalSection
DeviceIoControl
EnterCriticalSection
FlushViewOfFile
FormatMessageA
GetComputerNameA
GetCurrentProcess
GetCurrentProcessId
GetCurrentThread
GetCurrentThreadId
GetLastError
GetProcAddress
GetProcessHeap
GetSystemTimeAsFileTime
GetTickCount
GlobalAlloc
GlobalFree
HeapAlloc
HeapFree
InitializeCriticalSection
IsDebuggerPresent
LeaveCriticalSection
LoadLibraryA
LocalFree
MapViewOfFile
QueryPerformanceCounter
RtlAddFunctionTable
RtlCaptureContext
RtlLookupFunctionEntry
RtlVirtualUnwind
SetLastError
SetUnhandledExceptionFilter
Sleep
TerminateProcess
TlsGetValue
UnhandledExceptionFilter
UnmapViewOfFile
VirtualAlloc
VirtualFree
VirtualLock
VirtualProtect
VirtualQuery
VirtualUnlock
msvcrt
__iob_func
_amsg_exit
_errno
_get_osfhandle
_initterm
_lock
_mktime64
_snprintf
_stat64
_time64
_unlock
_vsnprintf
_wgetcwd
abort
calloc
clock
exit
fprintf
fputc
fread
free
fwrite
getc
getenv
isprint
isxdigit
malloc
memcmp
memcpy
memmove
memset
rand
realloc
signal
sprintf
srand
strchr
strcmp
strerror
strlen
strncmp
strncpy
strrchr
strstr
toupper
vfprintf
wcscmp
wcsrchr
user32
wsprintfA
ws2_32
WSACleanup
WSAGetLastError
WSAStartup
closesocket
connect
gethostbyname
htons
inet_ntoa
ioctlsocket
ntohl
recv
recvfrom
select
send
sendto
setsockopt
socket
PyInit_pyarmor_runtime
Name
.text
Size
522KB
Virtual Size
521KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.data
Size
18KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rdata
Size
50KB
Virtual Size
50KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.pdata
Size
9KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.xdata
Size
10KB
Virtual Size
9KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.bss
Size
Virtual Size
25KB
Characteristics
IMAGE_SCN_CNT_UNINITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.edata
Size
512B
Virtual Size
93B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.idata
Size
14KB
Virtual Size
13KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.CRT
Size
512B
Virtual Size
88B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.tls
Size
512B
Virtual Size
16B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.reloc
Size
1024B
Virtual Size
688B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
nitro free tool/requirements.txt
- SHA256 2b34709ebb78a2fc11f627914fa25fdc48f8bbf14a0f52d9924cb7d4a21978c5
- MD5 beaf4eef32cd964f7f2a06efb7f8bbce
- SHA1 bfaadd6bdbe7102a34df949c282e6ed409d44900
- SHA512 0a5153be4579674e886978c854e2650c927256443a8c6d65ea1c1b72a9c03ddc28ff2fc5af6711ae2747c4ab7272621992ef5ad7692be374a249a05f62c0b860
- MD5 SHA1 SHA512
nitro free tool/start.bat
- SHA256 49bce604beef237d620ab11acedc72fdb2c0e63a0e3b5e7d1deefa11c3420a7f
- MD5 e311560c2728e6ac20e25ba05ec87f22
- SHA1 ab1bd94a2f1fd5f7e9b250ce0cd599b76407facc
- SHA512 10090f41362dd740b88141ac860355b21746e5dd274282bc4c272a8a05af8fa41766ae71486166e68484dc875e4438905ea10b3b303a879abaae2f2f5b647baa
- TLSH T15AB02B0A24233410ECE60E991C1F2000710000C332313C013183003F4C0BBF6740AC5F
- MD5 SHA1 SHA512 TLSH