Spectra Assure

failIncident: Malware

Scanned:

1Q847

Artifact:

latest

removed

malicious

Research

模拟操作

License: Permissive (MIT)

Published:

Visit GitHub

See on PyPI

SAFE Assessment

Compliance

Licenses

No license compliance issues

Secrets

No sensitive information found

Security

Vulnerabilities

6 severe vulnerabilities exploited

Hardening

2 unsafe code linking practices

Threats

Tampering

1 malware-like behaviors found

Malware

5 supply chain attack artifacts

INCIDENTS FOR THIS VERSION:

malware

Reported By: ReversingLabs (Automated)

Learn more about malware detection

malware

Reported By: Community (OpenSSF)

More info

removal

Reported By: Community

malware

Reported By: ReversingLabs (Researcher)

Learn more about malware detection

malware

N/AReported By: Community (kam193)

More info

Overview issues24 vulnerabilities6 malware5 behaviors116 dependencies0 contributors1 versions25

Popularity

343.2k

Total Downloads

Contributor

Declared Dependencies

Dependents

Top issues

See all issues

Problem

Windows executable files can be converted to self-extracting applications that rebuild their own code during execution. Algorithms that process the executable format, and act as the operating system loader, are typically written in the low-level assembly code. As re-implementations of core system functionalities, they are often an imperfect simulation of complex application loading procedures. Most runtime packers are incompatible with the baseline vulnerability mitigation options that operating systems provide. Therefore, it's a common practice that various security features get silently disabled during this type of software packing. Packed applications typically continue to run without visible software defects, and they can even pass rigorous quality assurance testing. However, such tests rarely evaluate vulnerability mitigation effectiveness.

Prevalence in PyPI community

2 packages

found in

Top 100

1 packages

found in

Top 1k

3 packages

found in

Top 10k

160 packages

in community

Next steps

When this issue is reported, it is common to find additional compatibility issues that the runtime packing has introduced. You should deprecate the use of runtime packers or enforce digital rights management via less intrusive ways that still preserve compatibility with vulnerability mitigation options.

Problem

Windows executable files are mapped in memory as a sequence of allocated pages. The pages are grouped into sections with defined access rights. Main executable code section is referenced by the entry point address. When the entry point section requests a combination of write and execute access rights attributes, it gets allowed to self-modify its code during runtime. Vulnerability mitigations are implemented with the assumption that the executable code sections are read-only, or immutable. Using unsafe executable section access rights may lead to exposing critical security data to overwrites, tampering, and complete bypasses of vulnerability mitigations. This issue is typically reported when a software publisher uses a low quality executable packing solution.

Prevalence in PyPI community

2 packages

found in

Top 100

2 packages

found in

Top 1k

7 packages

found in

Top 10k

173 packages

in community

Next steps

You should deprecate the use of runtime packers, or enforce digital rights management via less intrusive ways that preserve compatibility with vulnerability mitigation options.

Problem

Proprietary ReversingLabs malware detection algorithms have determined that the software package contains one or more malicious components. The detection was made by either a static byte signature, software component identity, or a complete file hash. This malware detection method is considered highly accurate, and can typically attribute malware to previously discovered software supply chain attacks. It is common to have multiple supply chain attack artifacts that relate to a single malware incident.

Prevalence in PyPI community

0 packages

found in

Top 100

0 packages

found in

Top 1k

11 packages

found in

Top 10k

14.01k packages

in community

Next steps

If the software intent does not relate to malicious behavior, investigate the build and release environment for software supply chain compromise.

Avoid using this software package.

Problem

Threat researchers have manually inspected the software package and determined that it contains one or more malicious files. The detection was made by a hash-based file reputation lookup. This malware detection method is considered highly accurate, and can typically identify the malware family by name.

Prevalence in PyPI community

0 packages

found in

Top 100

0 packages

found in

Top 1k

10 packages

found in

Top 10k

14.02k packages

in community

Next steps

Investigate the build and release environment for software supply chain compromise.

Avoid using this software package.

Problem

Third-party malware detection algorithms have determined that the software package contains one or more malicious files. The detection was made by a hash-based file reputation lookup. This malware detection method is considered accurate, and can typically identify the malware family by name.

Prevalence in PyPI community

1 packages

found in

Top 100

0 packages

found in

Top 1k

19 packages

found in

Top 10k

772 packages

in community

Next steps

None

Exploits Unknown

Exploits Exist

Exploited by Malware

Patching Mandated

FAQ for 1Q847

What is 1Q847?

模拟操作. For more information about this package, visit its homepage.

Is 1Q847 malicious or is it safe to use?

The Python package 1Q847 has been removed from registry. It was scanned for malware, software tampering, risky behaviors, exposed secrets and known vulnerabilities. Malware or tampering has been detected, making it unsafe to use. 9 other issues and risky behaviors were found. The package contains risks, and the analysis results should be reviewed before it is used. Visit the Issues and Behaviors sections of the analysis for more details. All versions of the 1Q847 package were malicious.

Is 1Q847 popular?

The Python package 1Q847 is not widely used. It has 343K recorded downloads. A package's popularity is not a good indicator of its safety, visit the SAFE Assessment section to see the full analysis of package deployment risk categories.

How do I secure 1Q847 once it is in my app?

Since we can't know when or where malicious attacks will happen, we recommend tracking how 1Q847 behaviors change over multiple software releases. By adopting differential analysis in your release process, you can detect unexpected changes to a 1Q847 version, which can prevent advanced software supply chain attacks. Read how our technology can help prevent future attacks similar to SolarWinds and 3CX.

Did you know...

... that you can use ReversingLabs’ Spectra Assure platform to perform regular risk assessments of packages you develop in-house?

We recommend continuous software safeness monitoring through CI/CD integrations and pre-release/deployment checks. In addition to basic package information found on this page our platform offers rich reports for developers and DevSecOps that help them remediate all reported issues.

This website uses cookies to ensure the best website experience. By continuing to use this website you are giving your consent to cookies being used. Detailed information about our use of cookies is here.

Popularity

343.2k

Total Downloads

Contributor

Declared Dependencies

Dependents

Top issues

See all issues

Problem

Prevalence in PyPI community

2 packages

found in

Top 100

1 packages

found in

Top 1k

3 packages

found in

Top 10k

160 packages

in community

Next steps

Problem

Prevalence in PyPI community

2 packages

found in

Top 100

2 packages

found in

Top 1k

7 packages

found in

Top 10k

173 packages

in community

Next steps

You should deprecate the use of runtime packers, or enforce digital rights management via less intrusive ways that preserve compatibility with vulnerability mitigation options.

Problem

Prevalence in PyPI community

0 packages

found in

Top 100

0 packages

found in

Top 1k

11 packages

found in

Top 10k

14.01k packages

in community

Next steps

If the software intent does not relate to malicious behavior, investigate the build and release environment for software supply chain compromise.

Avoid using this software package.

Problem

Prevalence in PyPI community

0 packages

found in

Top 100

0 packages

found in

Top 1k

10 packages

found in

Top 10k

14.02k packages

in community

Next steps

Investigate the build and release environment for software supply chain compromise.

Avoid using this software package.

Problem

Prevalence in PyPI community

1 packages

found in

Top 100

0 packages

found in

Top 1k

19 packages

found in

Top 10k

772 packages

in community

Next steps

None

Exploits Unknown

Exploits Exist

Exploited by Malware

Patching Mandated

1Q847

SAFE Assessment

Compliance

Security

Threats

IMPORTANT: All versions of this package have been maliciousLatest version with malware incident detected: over 3 years agoVersion: 1.1.8

INCIDENTS FOR THIS VERSION:

Popularity

Top issues

SQ14101Detected Windows executable files packed with runtime packers that reduce or nullify the effects of vulnerability mitigation protections.Causes risk: mitigation incompatible packershardening

Problem

Prevalence in PyPI community

Next steps

SQ14147Detected Windows executable files with the entry point residing in a writable section making it possible to change code while executing.Causes risk: unsafe code linking practiceshardening

Problem

Prevalence in PyPI community

Next steps

SQ30105Detected presence of known software supply chain attack artifacts.Causes risk: supply chain attack artifactsthreats

Problem

Prevalence in PyPI community

Next steps

SQ30109Detected presence of malicious files through analyst-vetted file reputation.Causes risk: analyst-vetted malware foundthreats

Problem

Prevalence in PyPI community

Next steps

SQ30110Detected presence of malicious files through file reputation or third-party scanners.Causes risk: malicious components foundthreats

Problem

Prevalence in PyPI community

Next steps

Top behaviors

Deletes the value of a registry key.registry

Prevalence in PyPI community

Deletes a registry key and its values.registry

Prevalence in PyPI community

Requests permission to open other processes.permissions

Prevalence in PyPI community

Deletes files in Windows system directories.file

Prevalence in PyPI community

Changes the value of a registry key.registry

Prevalence in PyPI community

Top vulnerabilities

FAQ for 1Q847

What is 1Q847?

Is 1Q847 malicious or is it safe to use?

Is 1Q847 popular?

How do I secure 1Q847 once it is in my app?

Did you know...

Popularity

Top issues

SQ14101Detected Windows executable files packed with runtime packers that reduce or nullify the effects of vulnerability mitigation protections.Causes risk: mitigation incompatible packershardening

Problem

Prevalence in PyPI community

Next steps

SQ14147Detected Windows executable files with the entry point residing in a writable section making it possible to change code while executing.Causes risk: unsafe code linking practiceshardening

Problem

Prevalence in PyPI community

Next steps

SQ30105Detected presence of known software supply chain attack artifacts.Causes risk: supply chain attack artifactsthreats

Problem

Prevalence in PyPI community

Next steps

SQ30109Detected presence of malicious files through analyst-vetted file reputation.Causes risk: analyst-vetted malware foundthreats

Problem

Prevalence in PyPI community

Next steps

SQ30110Detected presence of malicious files through file reputation or third-party scanners.Causes risk: malicious components foundthreats

Problem

Prevalence in PyPI community

Next steps

Top behaviors

Deletes the value of a registry key.registry

Prevalence in PyPI community

Deletes a registry key and its values.registry

Prevalence in PyPI community

Requests permission to open other processes.permissions

Prevalence in PyPI community

Deletes files in Windows system directories.file

Prevalence in PyPI community

Changes the value of a registry key.registry

Prevalence in PyPI community