pythonw[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
pythonw.exe
Size 102KB
Sample260912-mxrt3afm2w
SHA256 e3889c5020644b9ecfd9e678f95372b1e127e29e6c02b1129ed88c38381d0972
MD5 9458f8f77580d8c949551e5fe15d2afc
SHA1 feaa4c0ab07aa007766ce11870c1edc543a1ffee
SHA512 724527f6e6a90ca801081ded224ddc2beb498c1ef774424d90f89f728547e04f2917087a2a86f748acfc80e3446987fd8dbd93b342633f7464b471311ceae59a
SSDEEP 1536:qZg7CIxHHWMpdPa5wiE21M8kJIGFvb1CwH/z4sey1Ni9GfILEqz:qZqBwMpdCq/IM8uIGft/z4siNz
TLSH
T177A3F741E63DBDCDE508D0314A75D4F26E24ED727580A51EB7F67F0628312A3FA0A936
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

pythonw.exe

.exe 102KB

pythonw.exe

IMPHASH bf996749cfd4a521351f81fb0f1deae5
SHA256 e3889c5020644b9ecfd9e678f95372b1e127e29e6c02b1129ed88c38381d0972
MD5 9458f8f77580d8c949551e5fe15d2afc
SHA1 feaa4c0ab07aa007766ce11870c1edc543a1ffee
SHA512 724527f6e6a90ca801081ded224ddc2beb498c1ef774424d90f89f728547e04f2917087a2a86f748acfc80e3446987fd8dbd93b342633f7464b471311ceae59a
SSDEEP 1536:qZg7CIxHHWMpdPa5wiE21M8kJIGFvb1CwH/z4sey1Ni9GfILEqz:qZqBwMpdCq/IM8uIGft/z4siNz
TLSH
T177A3F741E63DBDCDE508D0314A75D4F26E24ED727580A51EB7F67F0628312A3FA0A936
MD5 SHA1 SHA512 SSDEEP TLSH

Digest

96:74:68:7b:26:d6:8e:14:61:a4:12:29:fb:35:12:ff:33:9d:92:aa:d4:40:58:2a:8e:d3:c8:af:e1:b8:9f:a3

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US

Chains

Jun 10, 2026

CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US

CN=Microsoft ID Verified CS EOC CA 04,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US

Serial Number

33:00:01:c8:85:97:81:db:fe:9e:90:0f:a2:00:00:00:01:c8:85

Issuer

CN=Microsoft ID Verified CS EOC CA 04,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Jun 9, 2026 - Jun 12, 2026

Subject

CN=Microsoft ID Verified CS EOC CA 04,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:17:27:45:09:0b:8b:87:af:c6:00:00:00:00:00:17

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Mar 26, 2026 - Mar 26, 2031

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:A500-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:56:7e:8f:9d:58:08:8e:e9:60:00:00:00:00:00:56

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2025 - Oct 22, 2026

Minor OS version

Major OS version

Entry point

4792

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\1\b\bin\amd64\pythonw.pdb

pythonw.exe

python314

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

kernel32

generic