f1d8d2aa2a8ad7c74b6c6300b29cfdbcb484fc7ffad99b7fbfe1e31c048343b9

Summary

Architecture IMAGE_FILE_MACHINE_AMD64
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
Compilation Date 2026-Jul-18 17:07:02
Detected languages English - United States
Debug artifacts C:\Users\Administrator\AppData\Local\Temp\python-build-j611psu9\Python-3.11.15\PCbuild\amd64\python.pdb
CompanyName Python Software Foundation
FileDescription Python
FileVersion 3.11.15
InternalName Python Console
LegalCopyright Copyright © 2001-2023 Python Software Foundation. Copyright © 2000 BeOpen.com. Copyright © 1995-2001 CNRI. Copyright © 1991-1995 SMC.
OriginalFilename python.exe
ProductName Python
ProductVersion 3.11.15

Plugin Output

Info Matching compiler(s): MASM/TASM - sig1(h)
Info Interesting strings found in the binary: Contains domain names:
  • BeOpen.com
Suspicious The PE is possibly a dropper. Resources amount for 87.1923% of the executable.
Safe VirusTotal score: 0/70 (Scanned on 2026-09-08 09:11:41) All the AVs think this file is safe.

Hashes

MD5 ae3d36b6a887585b986a567b3f61f6e5 🔍
SHA1 ec7925f489cb493cafc018981bbbd82f976b0a13 🔍
SHA256 f1d8d2aa2a8ad7c74b6c6300b29cfdbcb484fc7ffad99b7fbfe1e31c048343b9 🔍
SHA3 5c71b2c5a1a667216d4f4412a8cad56721e2dfd1882aeafad1ce96b4e6528cd2 🔍
SSDeep 1536:9S0IzbuEYE+9z2wp+FavGmhMn+IhzZtzo/BZR:9R4buAs0FNmhMn+IhNK/BZR 🔍
Imports Hash 752594e3ad2ffffc53e7540c87d44150 🔍

DOS Header

e_magic MZ
e_cblp 0x90
e_cp 0x3
e_crlc 0
e_cparhdr 0x4
e_minalloc 0
e_maxalloc 0xffff
e_ss 0
e_sp 0xb8
e_csum 0
e_ip 0
e_cs 0
e_ovno 0
e_oemid 0
e_oeminfo 0
e_lfanew 0xf8

PE Header

Signature PE
Machine IMAGE_FILE_MACHINE_AMD64
NumberofSections 6
TimeDateStamp 2026-Jul-18 17:07:02
PointerToSymbolTable 0
NumberOfSymbols 0
SizeOfOptionalHeader 0xf0
Characteristics IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Image Optional Header

Magic PE32+
LinkerVersion 14.0
SizeOfCode 0x1000
SizeOfInitializedData 0x15200
SizeOfUninitializedData 0
AddressOfEntryPoint 0x00000000000012A0 (Section: .text)
BaseOfCode 0x1000
ImageBase 0x140000000
SectionAlignment 0x1000
FileAlignment 0x200
OperatingSystemVersion 6.0
ImageVersion 0.0
SubsystemVersion 6.0
Win32VersionValue 0
SizeOfImage 0x1a000
SizeOfHeaders 0x400
Checksum 0
Subsystem IMAGE_SUBSYSTEM_WINDOWS_CUI
DllCharacteristics IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE
SizeofStackReserve 0x1e8480
SizeofStackCommit 0x1000
SizeofHeapReserve 0x100000
SizeofHeapCommit 0x1000
LoaderFlags 0
NumberOfRvaAndSizes 16

.text

MD5 8f722ef2904577efeb6629ad26c77e0d 🔍
SHA1 ae98c3bac2af4ee2a50998ee759a5b503d4dd294 🔍
SHA256 d585761ea065fcc3e3a2bbf526aca8ffdae10f98614488fdef21871d014e50f8 🔍
SHA3 4c5d08b6b3918068e6468d4b09e47099d475e8f5add0aac9c02bed8e429f39ac 🔍
VirtualSize 0xe2c
VirtualAddress 0x1000
SizeOfRawData 0x1000
PointerToRawData 0x400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ
Entropy 5.71999

.rdata

MD5 f6a4044f9c148ea4d6b2d5b474eae1e5 🔍
SHA1 e3519a00864690f55dd02ecc302bd4fee565914e 🔍
SHA256 3deb68bb5784b325afb94dd2260ae8a738b3146c115b09bfb35bd55cef4c30a7 🔍
SHA3 21a9f0ab85bb0d49d3c5059488200c3fe47fd8eb078461cf6dba7ebe0470d507 🔍
VirtualSize 0xfae
VirtualAddress 0x2000
SizeOfRawData 0x1000
PointerToRawData 0x1400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 4.26929

.data

MD5 85c2aebd011c5c1b37c1009def59c2b6 🔍
SHA1 e6f88330c0bc7698e3f5d77202242a6e10f6e321 🔍
SHA256 ab4f194dcbbaf38d8dca700fa10eee22d80c5463d8256b36eb72ed5f7126ba69 🔍
SHA3 a5818bd143f172ebe95ef85b8e270e51e0d1ae2330fd892938463b36527155ea 🔍
VirtualSize 0x680
VirtualAddress 0x3000
SizeOfRawData 0x200
PointerToRawData 0x2400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE
Entropy 0.53249

.pdata

MD5 a618d9a3f7c04b0028b3645a6b4185d2 🔍
SHA1 4411b9b0226e4bd429a2258d855cf39a73755216 🔍
SHA256 aa1c6d9c919dbb66b02ffa72618dfbb1aa2ab778a99b8ee2d8976d23e16c567a 🔍
SHA3 57404f0feca099734a51c828aa5d0d500c61e8aaefd441adc760c3b61c81b4c1 🔍
VirtualSize 0x15c
VirtualAddress 0x4000
SizeOfRawData 0x200
PointerToRawData 0x2600
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 2.80631

.rsrc

MD5 8512a69f9992678f44971951e9465465 🔍
SHA1 46d531612786343f50e75531eab784726b3c71c7 🔍
SHA256 aa723165e47b2a9666216fcab7c1e583cfb429eb777b4b2824fe176870776596 🔍
SHA3 a2217e7151245483cadc52b67d74f21e97902a5037050552d856ab6051bbe6d8 🔍
VirtualSize 0x13b70
VirtualAddress 0x5000
SizeOfRawData 0x13c00
PointerToRawData 0x2800
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
Entropy 6.16268

.reloc

MD5 d6dca15ebdb817e5d0f6c827ff179d9c 🔍
SHA1 2cbbe7c3d04982757205551f66f1babca0054a1b 🔍
SHA256 3ffab0fa965d0070c42e0dad6cb0bee7651c0392160ba00fbb7297dab85eacc7 🔍
SHA3 eb77eea3f34b7b6a85fbf921d5983c9f3463bd69aa93b5b6b252cfa064ade1c0 🔍
VirtualSize 0x30
VirtualAddress 0x19000
SizeOfRawData 0x200
PointerToRawData 0x16400
PointerToRelocations 0
PointerToLineNumbers 0
NumberOfLineNumbers 0
NumberOfRelocations 0
Characteristics IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ
Entropy 0.712298

Imports

python311.dll Py_Main
VCRUNTIME140.dll __C_specific_handler
__current_exception
__current_exception_context
memset
memcpy
api-ms-win-crt-runtime-l1-1-0.dll _initialize_onexit_table
_register_onexit_function
_crt_atexit
terminate
_get_initial_wide_environment
_register_thread_local_exe_atexit_callback
_initialize_wide_environment
_configure_wide_argv
_initterm
_set_app_type
_seh_filter_exe
_c_exit
_cexit
__p___wargv
__p___argc
_initterm_e
_exit
exit
api-ms-win-crt-math-l1-1-0.dll __setusermatherr
api-ms-win-crt-stdio-l1-1-0.dll __p__commode
_set_fmode
api-ms-win-crt-locale-l1-1-0.dll _configthreadlocale
api-ms-win-crt-heap-l1-1-0.dll _set_new_mode
KERNEL32.dll GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter
RtlVirtualUnwind
RtlLookupFunctionEntry
RtlCaptureContext
InitializeSListHead
IsDebuggerPresent
GetSystemTimeAsFileTime
GetModuleHandleW

Delayed Imports

1

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x3d97
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.92312
Detected Filetype PNG graphic file
MD5 d84083d023ab6bb01cc96281cfb3e626 🔍
SHA1 8370c259d6de6b37d085b6ad619b700b021b8082 🔍
SHA256 340f2558a86deacf822e4fc71aa76b57eced007eafa8fc0f5f4c36db0fee036b 🔍
SHA3 a900e884fbed02bcba86678651f582be635d2359db70a7ec69edce03dcd41122 🔍

2

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x1628
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.41689
MD5 dde62d95fb87110950e35f5cee25e1fd 🔍
SHA1 47bbdd56fad02e02bf5c1b17f306ceafc6d56a85 🔍
SHA256 05321b56810c7a9f2512e16d5c643677c43a99f9b30f1c7ce48cc6306cd2eebd 🔍
SHA3 52136ae691c4afb053c7e96af67c0d6766a270d89a7771afa4c9564dd1a6cd14 🔍

3

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0xea8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.79946
MD5 ed103ab242f20dea088dce386834cb8f 🔍
SHA1 f42f092d074570ec52d76be85a532a406b0f19bc 🔍
SHA256 4923eeebe7b9cf9ca305d3186bc352757b3004313697ee4b6f8fe82a2b177a10 🔍
SHA3 f0f4f63f9e1a0db5f53e93ac977ab670671a1f9aca4a46c0f523b0eb9210cd4c 🔍

4

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x8a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.46048
MD5 76625981516eaa8e7c76387398de1af7 🔍
SHA1 052509f83f8dc727f4b303f5fe40ffbf47db2ca5 🔍
SHA256 ccfe3199e1582613d64adc318bb337fd5f5c6628548188bfadf8f1c20580eeba 🔍
SHA3 fd503cf0748b1a89409e61a00c19f7997a7ec9c42dd9a2d603149f37db2afc00 🔍

5

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x6c8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.19604
MD5 700e0b990563d9ab9546cf3cd75d3980 🔍
SHA1 7dd2e290a294d0b02fe2acade1a30e543a98c238 🔍
SHA256 a779a6adb616fe70692d7ca9e60ed4e464e912877a9afce52ce2c0a7de8fd7c1 🔍
SHA3 8bec8f54bcb05505c780b7d11d1be08bcaa34cd9fcc3d787eb5b12c84cdbca80 🔍

6

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x568
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.22279
MD5 9f1e1348de3da00f9548ba9aa951523c 🔍
SHA1 dcf9ab58ce285445cf7e43ad40d77d5c552542e4 🔍
SHA256 72138c1f894dc2e2198ec2b25c1edae7fd2c27501e0da92475c3a83c31740921 🔍
SHA3 724dffb1bc5dee2805799a7b955e54bebee13cce99c53a7c2e3c0ded609dc287 🔍

7

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x30fa
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 7.93695
Detected Filetype PNG graphic file
MD5 0db28d2e17bf94752eaee9078e8cf3c4 🔍
SHA1 f68fa54699a9ddf89987a4533c057209ff44ebd0 🔍
SHA256 ca773d78ea0b81263cba18acf2845fdc4b53a689bcf5b78e1eb06942f13220df 🔍
SHA3 e7341548fed5212a386dba6ea6a9bddeec310569d714f712ad6a8034d19776bd 🔍

8

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x4228
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.75838
MD5 55fbb9e8fc0a5ca1082147b72ec9a8ee 🔍
SHA1 c1e5c4c0e06510313a2794f1a1f447d77abb73a6 🔍
SHA256 eecf352bb39aba19adf2110a53cc5a5d440c04aa99ed32cc3cd19a8bbf012eb3 🔍
SHA3 7a78b172ad44dfc99dbb19f031af8c802d4fe537489daa0bcc3808a0ea9394a7 🔍

9

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x25a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.05077
MD5 0e77ae575bb14cda2d4632f8de90cac3 🔍
SHA1 a36266b5aa140e34cdd858693b66baaa416fb29a 🔍
SHA256 2035c31dd483556102cd4877aecdc1634c3eef8fecd394b5ffa873745e1eb710 🔍
SHA3 2f91d2a4d72a840e05dd2d6ce0affaecd706ff852fff97c6d383dc8d90fd36df 🔍

10

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x10a8
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.00445
MD5 8753647d8d4fc2e4df04cdf4f522d015 🔍
SHA1 d4f9322de3ec8d48a789c30f51dac1dd869b04d2 🔍
SHA256 83fbae1dab956aa0b6f46047287bf550800519e44a5f2581627283d1a01fb800 🔍
SHA3 4685066823ddbb2f04f7a699ba30a0eed81b6231d16a3ed3dd29cdf86a509a82 🔍

11

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x988
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.40353
MD5 e2dc532e0f88b9e775b40d06a45d9757 🔍
SHA1 6625d375ed2fd36091c6959163ca10b45c68ad62 🔍
SHA256 46af9a2c04627346f31662b09ae8a859b399db09c5da0055fb29c58587598dae 🔍
SHA3 e9f94a069dd51f7146b36cecd1d74d5b13c7a9086603763f3cb6a13e64e419f3 🔍

12

Type RT_ICON
Language English - United States
Codepage UNKNOWN
Size 0x468
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 4.12758
MD5 470b0a6086c6ec068a38f1629e93e169 🔍
SHA1 be4b68f8504d02e681d467f9bb585cb3f6de31b6 🔍
SHA256 db28967f8609ec90b509881d4d1d29278ba6f02d03e7e949e411298e3d7f2284 🔍
SHA3 0dddacd9b6f1c90f126138286e46e99d7bb127f7c7f25cb2bcea9f48952b05f0 🔍

1 (#2)

Type RT_GROUP_ICON
Language English - United States
Codepage UNKNOWN
Size 0xae
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.00668
Detected Filetype Icon file
MD5 95a824ff8067919e99897f959b3ac0d4 🔍
SHA1 e09cc39164ba426634d9c9148156ba13e09e1a90 🔍
SHA256 ebe3b5f6f527967d80bfea4860213781120fcb46fd9d709f73a1ef15688f1a06 🔍
SHA3 09b405ea060666deee850834ebcc88fbc3b377f7d252015bd278c396d7a657a5 🔍

1 (#3)

Type RT_VERSION
Language English - United States
Codepage UNKNOWN
Size 0x3b0
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 3.49211
MD5 72fcd23a201e42002cc110510506ab7a 🔍
SHA1 ac6d3fadc6bbe70592808b58e1fdf35305e1a79c 🔍
SHA256 d05b6f5b36cc4949a882fd2625f67df743704c3d5f80831070505a05622782b4 🔍
SHA3 2e55577037cbd4a0c368e4d00303058c04f9c51eca7132e8bd8afcc46147f988 🔍

1 (#4)

Type RT_MANIFEST
Language English - United States
Codepage UNKNOWN
Size 0x527
TimeDateStamp 1980-Jan-01 00:00:00
Entropy 5.22051
MD5 92a74cc750bf43e1a133ee0400910658 🔍
SHA1 6cd7052b40e72f90f70e393d2a9c77de69e2cbf1 🔍
SHA256 bd76c737191489222cc219b605648fee50ae2721a7d1af7ebd756b429dee7ec2 🔍
SHA3 418985f8de769564d9052ad4c06a8dc153838b94014ddeb2fffb9ca944233309 🔍

Version Info

Signature 0xfeef04bd
StructVersion 0x10000
FileVersion 3.11.15150.1013
ProductVersion 3.11.15150.1013
FileFlags (EMPTY)
FileOs VOS_DOS_WINDOWS32
VOS_NT_WINDOWS32
VOS__WINDOWS32
FileType VFT_APP
Language UNKNOWN
CompanyName Python Software Foundation
FileDescription Python
FileVersion (#2) 3.11.15
InternalName Python Console
LegalCopyright Copyright © 2001-2023 Python Software Foundation. Copyright © 2000 BeOpen.com. Copyright © 1995-2001 CNRI. Copyright © 1991-1995 SMC.
OriginalFilename python.exe
ProductName Python
ProductVersion (#2) 3.11.15
Resource LangID English - United States

IMAGE_DEBUG_TYPE_CODEVIEW

Characteristics 0
TimeDateStamp 2026-Jul-18 17:07:02
Version 0.0
SizeofData 128
AddressOfRawData 0x246c
PointerToRawData 0x186c
Referenced File C:\Users\Administrator\AppData\Local\Temp\python-build-j611psu9\Python-3.11.15\PCbuild\amd64\python.pdb

IMAGE_DEBUG_TYPE_VC_FEATURE

Characteristics 0
TimeDateStamp 2026-Jul-18 17:07:02
Version 0.0
SizeofData 20
AddressOfRawData 0x24ec
PointerToRawData 0x18ec

IMAGE_DEBUG_TYPE_POGO

Characteristics 0
TimeDateStamp 2026-Jul-18 17:07:02
Version 0.0
SizeofData 672
AddressOfRawData 0x2500
PointerToRawData 0x1900

TLS Callbacks

Load Configuration

Size 0x140
TimeDateStamp 1970-Jan-01 00:00:00
Version 0.0
GlobalFlagsClear (EMPTY)
GlobalFlagsSet (EMPTY)
CriticalSectionDefaultTimeout 0
DeCommitFreeBlockThreshold 0
DeCommitTotalFreeThreshold 0
LockPrefixTable 0
MaximumAllocationSize 0
VirtualMemoryThreshold 0
ProcessAffinityMask 0
ProcessHeapFlags (EMPTY)
CSDVersion 0
Reserved1 0
EditList 0
SecurityCookie 0x140003000

RICH Header

XOR Key 0x2cc57705
Unmarked objects 0
Imports (VS2008 SP1 build 30729) 10
Imports (35207) 2
ASM objects (35207) 3
C objects (35207) 10
C++ objects (35207) 18
Imports (35228) 3
Imports (33145) 2
Total imports 51
C objects (POGO O) (35228) 1
Resource objects (35228) 1
Linker (35228) 1

Errors

Leave a comment

No comments yet.