Benign Download

check_vm.py

check_output invoked with shell=Truesubprocess.check_output call

SHA-256253beee4b9149c90e742aab3974748295af24588e18e49b78a5744309a7b3e43

Evidence

English function-word token "for" lines 3–11

11… VM():
  if os_type == "windows":
      try:
          import wmi
          objWMI = wmi.WMI()
          for objDiskDrive in objWMI.query("Select * from Win32_DiskDrive"):
              if "vbox" in objDiskDrive.Caption.lower() or "virtual" in objDiskDrive.Caption.lower():
                  return "\n\033[1;32;31m[!]\x1b[0m Virtual Machine detected \033[1;32;31m[!]\n\x1b[0m"
              retu …

References /proc/cpuinfo system information path lines 13–19

99… 2;31m[-]\n\x1b[0m"
  else:
      try:
          checkVM = subprocess.check_output(
              'grep -q ^flags.*\ hypervisor /proc/cpuinfo && echo "This machine is a VM"', shell=True)
          if checkVM == "This machine is a VM":
              return "\n\033[1;32;31m[!]\x1b[0m Virtual Machine detected 0 …