pythonw[.]exe | Triage™

Sharing

Copy URL Twitter E-mail

General

Target
pythonw.exe
Size 102KB
Sample260928-te6c3abf69
SHA256 58b39b6d8dc9f51a94f1a3143e49b7498fb804a101f2b33baa14bd72d45298f8
MD5 ce34cda31eae4589f5b158253dd55f54
SHA1 bfc783740aa4690467bdd82b658310146c21552c
SHA512 d9d3e59a7ae363fc8fa8077bd2fecad8c3139b42442edcd92f1be0a06c565da5520e2d1b248a1e37f23ffc80e5c5534c2e85dbfac6d61baaacb84ac1008d9b80
SSDEEP 1536:dZ3n7CIxHHWMpdPa5wiE21M8kJIGFvb1CwH//4skycA89iI3fIY35:dZ37BwMpdCq/IM8uIGft//4s7Xw
TLSH
T1ABA3F741E62DBDCDE548D4314A75D4F26E24ED327680A11EB7F77F062831293FA0A93A
MD5 SHA1 SHA512 SSDEEP TLSH

Score

1^/10

Malware Config

Signatures

File Explorer

pythonw.exe

.exe 102KB

pythonw.exe

IMPHASH bf996749cfd4a521351f81fb0f1deae5
SHA256 58b39b6d8dc9f51a94f1a3143e49b7498fb804a101f2b33baa14bd72d45298f8
MD5 ce34cda31eae4589f5b158253dd55f54
SHA1 bfc783740aa4690467bdd82b658310146c21552c
SHA512 d9d3e59a7ae363fc8fa8077bd2fecad8c3139b42442edcd92f1be0a06c565da5520e2d1b248a1e37f23ffc80e5c5534c2e85dbfac6d61baaacb84ac1008d9b80
SSDEEP 1536:dZ3n7CIxHHWMpdPa5wiE21M8kJIGFvb1CwH//4skycA89iI3fIY35:dZ37BwMpdCq/IM8uIGft//4s7Xw
TLSH
T1ABA3F741E62DBDCDE548D4314A75D4F26E24ED327680A11EB7F77F062831293FA0A93A
MD5 SHA1 SHA512 SSDEEP TLSH

windows:6 windows x64 arch:x64

Digest

40:79:3c:28:56:0b:fe:ab:75:14:0b:67:a7:d1:7d:b1:d2:87:d2:23:b7:bd:31:3d:3c:1d:2a:8f:49:46:b1:b6

Digest Algorithm

sha256

PE Digests Matches

Trusted

Signing Certificate

CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US

Chains

Dec 5, 2025

CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US

CN=Microsoft ID Verified CS EOC CA 01,O=Microsoft Corporation,C=US

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Subject

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Serial Number

54:98:d2:d1:d4:5b:19:95:48:13:79:c8:11:c0:87:99

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Timespan

Apr 16, 2020 - Apr 16, 2045

Subject

CN=Python Software Foundation,O=Python Software Foundation,L=Beaverton,ST=Oregon,C=US

Serial Number

33:00:05:9f:19:e6:bc:ae:36:37:c3:49:c3:00:00:00:05:9f:19

Issuer

CN=Microsoft ID Verified CS EOC CA 01,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageCodeSigning

Revocation Status

Not revoked

Timespan

Dec 5, 2025 - Dec 8, 2025

Subject

CN=Microsoft ID Verified CS EOC CA 01,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:06:4a:1a:fa:cf:05:61:6a:74:00:00:00:00:00:06

Issuer

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 13, 2021 - Apr 13, 2026

Subject

CN=Microsoft ID Verified Code Signing PCA 2021,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:07:87:a3:34:a3:7b:a5:8e:1c:00:00:00:00:00:07

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Revocation Status

Not revoked

Timespan

Apr 1, 2021 - Apr 1, 2036

Subject

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Serial Number

33:00:00:00:05:e5:cf:0f:ff:66:2e:c9:87:00:00:00:00:00:05

Issuer

CN=Microsoft Identity Verification Root Certificate Authority 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature, KeyUsageCertSign, KeyUsageCRLSign

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Nov 19, 2020 - Nov 19, 2035

Subject

CN=Microsoft Public RSA Time Stamping Authority,OU=Microsoft America Operations+OU=nShield TSS ESN:7A00-05E0-D947,O=Microsoft Corporation,L=Redmond,ST=Washington,C=US

Serial Number

33:00:00:00:58:65:cd:eb:3f:a1:d7:fc:d2:00:00:00:00:00:58

Issuer

CN=Microsoft Public RSA Timestamping CA 2020,O=Microsoft Corporation,C=US

Key Usages

KeyUsageDigitalSignature

Ext Key Usages

ExtKeyUsageTimeStamping

Revocation Status

Not revoked

Timespan

Oct 23, 2025 - Oct 22, 2026

Minor OS version

Major OS version

Entry point

4792

Magic Number

523

Subsystem

IMAGE_SUBSYSTEM_WINDOWS_GUI

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE IMAGE_DLLCHARACTERISTICS_NX_COMPAT IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE IMAGE_FILE_LARGE_ADDRESS_AWARE

PDB paths

D:\a\1\b\bin\amd64\pythonw.pdb

pythonw.exe

python314

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

kernel32

generic