python-manager.zip
- SHA256 00394412fe88ff281df5791bcb8a477b7c3cb363a5815d25e18981474e16eb60
Overview
overview
3Static
static
3pip.exe
windows10-2004-x64
1pip.exe
windows11-ltsc_2024-x64
1pym-gui.exe
windows10-2004-x64
1pym-gui.exe
windows11-ltsc_2024-x64
1pym.exe
windows10-2004-x64
1pym.exe
windows11-ltsc_2024-x64
1python.exe
windows10-2004-x64
1python.exe
windows11-ltsc_2024-x64
1pythonw.exe
windows10-2004-x64
1pythonw.exe
windows11-ltsc_2024-x64
1Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
pip.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
pip.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral3
Sample
pym-gui.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
1 signatures
150 seconds
Behavioral task
behavioral4
Sample
pym-gui.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
1 signatures
150 seconds
Behavioral task
behavioral5
Sample
pym.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral6
Sample
pym.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral7
Sample
python.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral8
Sample
python.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
Behavioral task
behavioral9
Sample
pythonw.exe
Resource
win10v2004-20260911-en
windows10-2004-x64
0 signatures
150 seconds
Behavioral task
behavioral10
Sample
pythonw.exe
Resource
win11ltsc2024-20260911-en
windows11-ltsc_2024-x64
0 signatures
150 seconds
General
- Target python-manager.zip
- Size 1.4MB
- Sample261030-caynzsgw21
- SHA256 00394412fe88ff281df5791bcb8a477b7c3cb363a5815d25e18981474e16eb60
- MD5 3b5a4a5244a1f18582a24e2b78c8ba7f
- SHA1 578082ad516adc21dcb2da854cec50cba6ab1b14
- SHA512 e517078ed670f06ed67cfe9282cfdd0167e0f13aeda8571af5c7de95d4ff16cf499f7d1c42a62f862160b49fc52d977103896f4d1d9e2b7460653a5065bb6e91
- SSDEEP 24576:iDTQvuCAXjMp8WROQBMEBMM9uhFOlKVItQ233+9fc+ATqsL21o6+4wRLqiqtAX6p:eFXjMTO219uhFuKVIr3I0H2qCvFd
- TLSH T18465335C4E4BB4D0A44BE0B925A72C63DF0D7CE3C388B5633F54B9589F99B4E824EA11
- MD5 SHA1 SHA512 SSDEEP TLSH
Score
3/10
Malware Config
Signatures
- Unsigned PE 5 IoCs
Checks for missing Authenticode signature.
resource unpack001/pip.exe unpack001/pym-gui.exe unpack001/pym.exe unpack001/python.exe unpack001/pythonw.exe
File Explorer
-
python-manager.zip.zip 1.4MB
-
pip.exe.exe 463KB
-
pym-gui.exe.exe 1010KB
-
pym.exe.exe 597KB
-
python.exe.exe 480KB
-
pythonw.exe.exe 478KB
pip.exe
- IMPHASH 0079d5213d6e7c345e58f55a3bdffbd0
- SHA256 6d02f8793c99a450119f34fa538b62b85f6c5a9b9e2ad97cdc07a2db8d255d87
- MD5 2d9425605ed2e0d31911616b58996f44
- SHA1 0c6c9d248f9c512f5f067302577a8b510fa4a46c
- SHA512 264341f6cae502b369afafe16b0003c2c82236f40d2a551ccd69eceb5a1b070836c3368f26ddc80e8b1cc20648fe6d323b395c82fd00fe66202ae6b9186ad2d0
- SSDEEP 6144:eKHg62wzToQUAmY1Gdk19FYvuLItesl1UsnpJW3VjA3dJ9jZzeGhWdPXZjYel:eivRUAmYN7Atea1UANdzeGh
- TLSH T1B3A48D65F6A800F9E0B7D17CCA534902EB727856437196CF0394E9762F276E18E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
161520
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetConsoleCP
GetConsoleOutputCP
SetConsoleCP
SetConsoleOutputCP
GetStdHandle
ReadFile
WriteFile
CloseHandle
SetHandleInformation
GetLastError
CreatePipe
WaitForSingleObject
GetExitCodeProcess
CreateThread
CreateProcessA
GetModuleFileNameA
MultiByteToWideChar
GetConsoleMode
WriteConsoleW
SetEndOfFile
LocalFree
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
CreateFile2
AreFileApisANSI
GetModuleHandleW
GetProcAddress
GetFileInformationByHandleEx
WideCharToMultiByte
QueryPerformanceCounter
GetSystemTimePreciseAsFileTime
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
WakeAllConditionVariable
SleepConditionVariableSRW
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentProcess
ExitProcess
TerminateProcess
FreeLibrary
GetModuleHandleExW
IsProcessorFeaturePresent
GetModuleFileNameW
GetCommandLineA
GetCommandLineW
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapAlloc
HeapFree
VirtualProtect
LoadLibraryExW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
FlushFileBuffers
ReadConsoleW
GetFileSizeEx
SetFilePointerEx
GetTimeZoneInformation
IsValidCodePage
GetACP
GetOEMCP
HeapReAlloc
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetProcessHeap
CreateFileW
HeapSize
RtlUnwind
Name
.text
Size
332KB
Virtual Size
331KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
104KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
15KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
512B
Virtual Size
480B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=175, id=261, version=33145,
count=17, id=260, version=33145,
count=7, id=259, version=33145,
count=10, id=259, version=35721,
count=16, id=260, version=35721,
count=89, id=261, version=35721,
count=3, id=257, version=33145,
count=134, id=1, productName=Unmarked objects,
count=4, id=261, version=36244,
count=1, id=255, version=36244,
count=1, id=258, version=36244,
pym-gui.exe
- IMPHASH 8140b7b06ae746743c357496862b9e8d
- SHA256 7348604fc7373468888dcd25ea11216ec5684737b5490a0d2c72a1e61a4b1ec0
- MD5 f15aa2547002f1dda909d82b4dbab43d
- SHA1 ba5eddba28f9a54bc5073f5dbb4594ee0cef9429
- SHA512 94f9a6f65b2af5c7ddd8162db99e7961b3e416ed9ad15ebcb16a7700d9c12755d1951c55a4726ac096fece58a4eed89fd1045623792289ae00ff33e069e0c97d
- SSDEEP 24576:yjSr1RYMqD9l4UGNbgPzcuEiXnR+Tg1R:QSJmD9l4UGZi1XnRj
- TLSH T1AC25BE05F2B501F8D676F578DAA3B607EA72385903205ADF13E25A492FA36E05F7B310
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
567200
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
d3d11
D3D11CreateDeviceAndSwapChain
shell32
SHBrowseForFolderA
ShellExecuteW
SHGetPathFromIDListA
ole32
CoTaskMemFree
kernel32
CreatePipe
PeekNamedPipe
WaitForSingleObject
Sleep
CreateProcessA
GetModuleFileNameA
GetModuleHandleW
MultiByteToWideChar
OutputDebugStringA
GlobalAlloc
GlobalUnlock
GlobalLock
GlobalFree
WideCharToMultiByte
VerSetConditionMask
QueryPerformanceCounter
QueryPerformanceFrequency
FreeLibrary
GetModuleHandleA
GetProcAddress
LoadLibraryA
GetLocaleInfoA
IsDBCSLeadByte
GetStdHandle
GetConsoleMode
WriteConsoleW
FreeEnvironmentStringsW
GetEnvironmentStringsW
GetCommandLineW
GetCommandLineA
HeapReAlloc
GetOEMCP
GetACP
IsValidCodePage
GetTimeZoneInformation
ReadConsoleW
SetFilePointerEx
GetFileSizeEx
GetConsoleOutputCP
SetHandleInformation
SetEndOfFile
EnumSystemLocalesW
GetUserDefaultLCID
IsValidLocale
GetLocaleInfoW
LCMapStringW
CompareStringW
GetTimeFormatW
GetDateFormatW
LoadLibraryExW
VirtualProtect
HeapFree
HeapAlloc
UnhandledExceptionFilter
IsDebuggerPresent
RtlVirtualUnwind
RtlCaptureContext
WriteFile
GetModuleFileNameW
GetModuleHandleExW
TerminateProcess
ExitProcess
GetCurrentProcess
IsProcessorFeaturePresent
FlsFree
FlsSetValue
FlsGetValue
FlsAlloc
SetLastError
RtlUnwindEx
RtlLookupFunctionEntry
RaiseException
RtlPcToFileHeader
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentProcessId
CloseHandle
ReadFile
SetEnvironmentVariableW
GetProcessHeap
SetStdHandle
CreateFileW
FlushFileBuffers
HeapSize
GetStartupInfoW
SetUnhandledExceptionFilter
SleepConditionVariableSRW
WakeAllConditionVariable
GetFileType
GetLocaleInfoEx
LocalFree
FormatMessageA
RtlUnwind
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
CreateFile2
AreFileApisANSI
GetLastError
GetFileInformationByHandleEx
GetSystemTimePreciseAsFileTime
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
user32
SetProcessDPIAware
EnumDisplayMonitors
GetMonitorInfoW
MonitorFromWindow
LoadCursorW
SetWindowLongPtrW
SetWindowLongW
GetWindowLongW
WindowFromPoint
ScreenToClient
ClientToScreen
GetCursorPos
SetCursor
SetCursorPos
AdjustWindowRectEx
GetClientRect
GetPropA
SetPropA
ReleaseDC
GetDC
SetForegroundWindow
GetForegroundWindow
IsWindowUnicode
ReleaseCapture
SetCapture
GetCapture
GetKeyState
SetFocus
TranslateMessage
IsIconic
SetWindowPos
SetLayeredWindowAttributes
IsChild
GetMessageExtraInfo
TrackMouseEvent
GetKeyboardLayout
EmptyClipboard
GetClipboardData
SetClipboardData
CloseClipboard
OpenClipboard
MessageBoxW
UpdateWindow
ShowWindow
DestroyWindow
CreateWindowExW
RegisterClassExW
UnregisterClassW
PostQuitMessage
DefWindowProcW
PeekMessageW
DispatchMessageW
BringWindowToTop
gdi32
GetDeviceCaps
imm32
ImmGetContext
ImmReleaseContext
ImmSetCompositionWindow
ImmSetCandidateWindow
d3dcompiler_47
D3DCompile
Name
.text
Size
748KB
Virtual Size
748KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
197KB
Virtual Size
197KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
23KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
35KB
Virtual Size
34KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
3KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=180, id=261, version=33145,
count=32, id=260, version=33145,
count=23, id=259, version=33145,
count=10, id=259, version=35721,
count=16, id=260, version=35721,
count=89, id=261, version=35721,
count=19, id=257, version=33145,
count=210, id=1, productName=Unmarked objects,
count=9, id=261, version=36244,
count=1, id=255, version=36244,
count=1, id=151,
count=1, id=258, version=36244,
pym.exe
- IMPHASH 7d01637d28804890e51a911f06da2102
- SHA256 e47727d8beaf98aa24ac2f0f00f42cc42c0757783782d477245214a159a11c72
- MD5 02cbc7807a47163e3314ef6b913af84b
- SHA1 237b0db64d0afcdf3fecf2c4e63d2db5d313f410
- SHA512 603c05aeeccc67346b5658ca137f90c878a3f2575b31d85a6f69e9826ac77e1ea4790901851cbfbaa28956ef370091ce214a8d4ab11a0a293430868648623602
- SSDEEP 6144:K0m4KKdwxzgVD4jvqwyTlGOikT7qo1FANurqDicFG7fGdeMwhaRGu6MJnPejYH9B:lGEVDWvyAO3XFBwzHRGBM9WRA7
- TLSH T19DD45C26D6A411FCE1A3D2B8CE574913FA7278464331AACF03D05A571F276E49F3AB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
252448
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetStdHandle
GetEnvironmentStringsW
FreeEnvironmentStringsW
CloseHandle
GetLastError
WaitForSingleObject
GetExitCodeProcess
CreateProcessA
GetModuleFileNameA
MultiByteToWideChar
WideCharToMultiByte
GetConsoleMode
WriteConsoleW
GetConsoleCP
GetConsoleOutputCP
SetConsoleCP
SetConsoleOutputCP
SetEndOfFile
CreateFileW
HeapSize
GetProcessHeap
SetStdHandle
SetEnvironmentVariableW
HeapReAlloc
LocalFree
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
CreateFile2
AreFileApisANSI
GetModuleHandleW
GetProcAddress
GetFileInformationByHandleEx
QueryPerformanceCounter
GetSystemTimePreciseAsFileTime
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
WakeAllConditionVariable
SleepConditionVariableSRW
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
DuplicateHandle
GetCurrentProcess
CreateProcessW
IsProcessorFeaturePresent
WriteFile
GetModuleFileNameW
ExitProcess
TerminateProcess
FreeLibrary
GetModuleHandleExW
GetCommandLineA
GetCommandLineW
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
GetFileType
HeapAlloc
HeapFree
CreatePipe
VirtualProtect
LoadLibraryExW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
FlushFileBuffers
ReadFile
GetFileSizeEx
SetFilePointerEx
ReadConsoleW
GetTimeZoneInformation
IsValidCodePage
GetACP
GetOEMCP
RtlUnwind
shell32
ShellExecuteExA
ole32
CoUninitialize
CoInitializeEx
CoCreateInstance
CoTaskMemFree
Name
.text
Size
432KB
Virtual Size
431KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
118KB
Virtual Size
117KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
12KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=187, id=261, version=33145,
count=7, id=259, version=33145,
count=10, id=259, version=35721,
count=16, id=260, version=35721,
count=91, id=261, version=35721,
count=18, id=260, version=33145,
count=7, id=257, version=33145,
count=139, id=1, productName=Unmarked objects,
count=4, id=261, version=36244,
count=1, id=255, version=36244,
count=1, id=151,
count=1, id=258, version=36244,
python.exe
- IMPHASH 0079d5213d6e7c345e58f55a3bdffbd0
- SHA256 121a8d701afe295cc5131d7fc31d0863a4ab62bf3f8afd8f92b3ce3a08f1ec0a
- MD5 b2176d790710c3dd2b176c3e4ccdb052
- SHA1 e983c1960d6fd4877bfef422ce33e64abf5f6cf1
- SHA512 e67669e226fb2b5bcfce8791f845d080880d6ffef5066d29712fee030a424c6589776153342017b912955a617e11be1755baa5dff24d6565feb378da06cdeb80
- SSDEEP 6144:qWtMwXzhtbWqHt5nQqODeZPLhM8/9Wfv2C4fs1j8mwFX7T1OCdjipH+N:DTlWqHH8Dewk988mUxOC
- TLSH T1D6A47C66A2A401F9F167D17CC9534913EA72F8564331E6CF0390AA772F276E14E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
160464
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_CUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetConsoleCP
GetConsoleOutputCP
SetConsoleCP
SetConsoleOutputCP
GetStdHandle
ReadFile
WriteFile
CloseHandle
SetHandleInformation
GetLastError
CreatePipe
WaitForSingleObject
GetExitCodeProcess
CreateThread
CreateProcessA
GetModuleFileNameA
MultiByteToWideChar
GetConsoleMode
WriteConsoleW
SetEndOfFile
LocalFree
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
CreateFile2
AreFileApisANSI
GetModuleHandleW
GetProcAddress
GetFileInformationByHandleEx
WideCharToMultiByte
QueryPerformanceCounter
GetSystemTimePreciseAsFileTime
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
WakeAllConditionVariable
SleepConditionVariableSRW
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentProcess
ExitProcess
TerminateProcess
FreeLibrary
GetModuleHandleExW
IsProcessorFeaturePresent
GetModuleFileNameW
GetCommandLineA
GetCommandLineW
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapAlloc
HeapFree
VirtualProtect
LoadLibraryExW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
FlushFileBuffers
ReadConsoleW
GetFileSizeEx
SetFilePointerEx
GetTimeZoneInformation
IsValidCodePage
GetACP
GetOEMCP
HeapReAlloc
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
SetStdHandle
GetProcessHeap
CreateFileW
HeapSize
RtlUnwind
Name
.text
Size
331KB
Virtual Size
330KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
104KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=175, id=261, version=33145,
count=17, id=260, version=33145,
count=7, id=259, version=33145,
count=10, id=259, version=35721,
count=16, id=260, version=35721,
count=89, id=261, version=35721,
count=3, id=257, version=33145,
count=134, id=1, productName=Unmarked objects,
count=4, id=261, version=36244,
count=1, id=255, version=36244,
count=1, id=151,
count=1, id=258, version=36244,
pythonw.exe
- IMPHASH 97ef37ee950b31511a4b3417e7efb7db
- SHA256 22a4fcc301e9ab8741f4630c9b8bb5d5cc05bb3499a60f40b5d42be987a71a4c
- MD5 837f978eb33ac44349ca1145a7aa49aa
- SHA1 f05474fd430fefb6958cdd19faa5612abfb99e94
- SHA512 d59becc2eac361ed5e11145fcab3a50d4b9dbee061dce8bb9676acc5448c96e58c10f0269cd97ada7dad22688a886dde61f51feebcbb84f095db7afc6fc8a997
- SSDEEP 6144:Rhw+A77Yz8ApcLgY9dc9VVGJTNYvVI5y6qm/CSXUcCDxrEIp3je6D:Hm4cLgSdcjYXYdGXURpEIZ/
- TLSH T1A2A46C66A6A401F9F067D17CC9534913EA72F8564331E6CF0390AA772F276E14E3EB21
- MD5 SHA1 SHA512 SSDEEP TLSH
-
Unsigned PE
Checks for missing Authenticode signature.
Minor OS version
0
Major OS version
6
Entry point
159296
Magic Number
523
Subsystem
IMAGE_SUBSYSTEM_WINDOWS_GUI
DLL Characteristics
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
File Characteristics
IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE
PDB paths
kernel32
GetCommandLineW
GetLastError
WaitForSingleObject
GetExitCodeProcess
CreateProcessA
LocalFree
MultiByteToWideChar
WideCharToMultiByte
GetStdHandle
ReadFile
WriteFile
CloseHandle
GetModuleFileNameA
GetConsoleMode
WriteConsoleW
SetEndOfFile
HeapSize
CreateFileW
GetProcessHeap
SetStdHandle
FormatMessageA
GetLocaleInfoEx
CreateDirectoryW
FindClose
FindFirstFileW
FindFirstFileExW
FindNextFileW
GetFileAttributesExW
CreateFile2
AreFileApisANSI
GetModuleHandleW
GetProcAddress
GetFileInformationByHandleEx
QueryPerformanceCounter
GetSystemTimePreciseAsFileTime
ReleaseSRWLockExclusive
AcquireSRWLockExclusive
GetCurrentThreadId
EnterCriticalSection
LeaveCriticalSection
InitializeCriticalSectionEx
DeleteCriticalSection
EncodePointer
DecodePointer
LCMapStringEx
GetStringTypeW
GetCPInfo
WakeAllConditionVariable
SleepConditionVariableSRW
GetCurrentProcessId
GetSystemTimeAsFileTime
InitializeSListHead
SetUnhandledExceptionFilter
GetStartupInfoW
RtlPcToFileHeader
RaiseException
RtlLookupFunctionEntry
RtlUnwindEx
SetLastError
FlsAlloc
FlsGetValue
FlsSetValue
FlsFree
GetCurrentProcess
ExitProcess
TerminateProcess
FreeLibrary
GetModuleHandleExW
IsProcessorFeaturePresent
GetModuleFileNameW
RtlCaptureContext
RtlVirtualUnwind
IsDebuggerPresent
UnhandledExceptionFilter
HeapAlloc
HeapFree
VirtualProtect
LoadLibraryExW
GetDateFormatW
GetTimeFormatW
CompareStringW
LCMapStringW
GetLocaleInfoW
IsValidLocale
GetUserDefaultLCID
EnumSystemLocalesW
GetFileType
FlushFileBuffers
GetConsoleOutputCP
ReadConsoleW
GetFileSizeEx
SetFilePointerEx
GetTimeZoneInformation
IsValidCodePage
GetACP
GetOEMCP
HeapReAlloc
GetCommandLineA
GetEnvironmentStringsW
FreeEnvironmentStringsW
SetEnvironmentVariableW
RtlUnwind
user32
MessageBoxW
shell32
CommandLineToArgvW
Name
.text
Size
329KB
Virtual Size
329KB
Characteristics
IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Name
.rdata
Size
104KB
Virtual Size
103KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.data
Size
7KB
Virtual Size
11KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.pdata
Size
16KB
Virtual Size
15KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.fptable
Size
512B
Virtual Size
256B
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Name
.rsrc
Size
17KB
Virtual Size
17KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Name
.reloc
Size
3KB
Virtual Size
2KB
Characteristics
IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
generic
count=176, id=261, version=33145,
count=17, id=260, version=33145,
count=7, id=259, version=33145,
count=10, id=259, version=35721,
count=16, id=260, version=35721,
count=89, id=261, version=35721,
count=7, id=257, version=33145,
count=133, id=1, productName=Unmarked objects,
count=4, id=261, version=36244,
count=1, id=255, version=36244,
count=1, id=151,
count=1, id=258, version=36244,