{"state_type":"pith_open_graph_state","state_version":"1.0","pith_number":"pith:2021:2LWP3GTAJQSN4ANERHCNLFUZG6","merge_version":"pith-open-graph-merge-v1","event_count":2,"valid_event_count":2,"invalid_event_count":0,"equivocation_count":0,"current":{"canonical_record":{"metadata":{"abstract_canon_sha256":"caa4f4f0b27311b25b1c5d361e6340e9ecd0264b05697a7e72de42f76f4a6a8f","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2021-05-02T22:29:22Z","title_canon_sha256":"f7acdf78bbfb178fe2b08220a3a9016d4a702f2a4e9eb3bf5c08bb473b5afae3"},"schema_version":"1.0","source":{"id":"2105.00565","kind":"arxiv","version":1}},"source_aliases":[{"alias_kind":"arxiv","alias_value":"2105.00565","created_at":"2026-07-05T02:36:55Z"},{"alias_kind":"arxiv_version","alias_value":"2105.00565v1","created_at":"2026-07-05T02:36:55Z"},{"alias_kind":"doi","alias_value":"10.48550/arxiv.2105.00565","created_at":"2026-07-05T02:36:55Z"},{"alias_kind":"pith_short_12","alias_value":"2LWP3GTAJQSN","created_at":"2026-07-05T02:36:55Z"},{"alias_kind":"pith_short_16","alias_value":"2LWP3GTAJQSN4ANE","created_at":"2026-07-05T02:36:55Z"},{"alias_kind":"pith_short_8","alias_value":"2LWP3GTA","created_at":"2026-07-05T02:36:55Z"}],"graph_snapshots":[{"event_id":"sha256:12717623270760683c474ea717c0de5c76c28bf905693f95e155fba3db43a847","target":"graph","created_at":"2026-07-05T02:36:55Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"graph_snapshot":{"author_claims":{"count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57","strong_count":0},"builder_version":"pith-number-builder-2026-05-17-v1","claims":{"count":0,"items":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"formal_canon":{"evidence_count":0,"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"integrity":{"available":true,"clean":true,"detectors_run":[],"endpoint":"/pith/2105.00565/integrity.json","findings":[],"snapshot_sha256":"c28c3603d3b5d939e8dc4c7e95fa8dfce3d595e45f758748cecf8e644a296938","summary":{"advisory":0,"by_detector":{},"critical":0,"informational":0}},"paper":{"abstract_excerpt":"With the continuous rise of malicious campaigns and the exploitation of new attack vectors, it is necessary to assess the efficacy of the defensive mechanisms used to detect them. To this end, the contribution of our work is twofold. First, it introduces a new method for obfuscating malicious code to bypass all static checks of multi-engine scanners, such as VirusTotal. Interestingly, our approach to generating the malicious executables is not based on introducing a new packer but on the augmentation of the capabilities of an existing and widely used tool for packaging Python, PyInstaller but ","authors_text":"Constantinos Patsakis, Vasilios Koutsokostas","cross_cats":[],"headline":"","license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2021-05-02T22:29:22Z","title":"Python and Malware: Developing Stealth and Evasive Malware Without Obfuscation"},"references":{"count":0,"internal_anchors":0,"resolved_work":0,"sample":[],"snapshot_sha256":"258153158e38e3291e3d48162225fcdb2d5a3ed65a07baac614ab91432fd4f57"},"source":{"id":"2105.00565","kind":"arxiv","version":1},"verdict":{"created_at":null,"id":null,"model_set":{},"one_line_summary":"","pipeline_version":null,"pith_extraction_headline":"","strongest_claim":"","weakest_assumption":""}},"verdict_id":null}}],"author_attestations":[],"timestamp_anchors":[],"storage_attestations":[],"citation_signatures":[],"replication_records":[],"corrections":[],"mirror_hints":[],"record_created":{"event_id":"sha256:bd5aaf502cc7307b3c8d393cea59436937ee92b5d147fd907c5ca3a57b952cd0","target":"record","created_at":"2026-07-05T02:36:55Z","signer":{"key_id":"pith-v1-2026-05","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","signer_id":"pith.science","signer_type":"pith_registry"},"payload":{"attestation_state":"computed","canonical_record":{"metadata":{"abstract_canon_sha256":"caa4f4f0b27311b25b1c5d361e6340e9ecd0264b05697a7e72de42f76f4a6a8f","cross_cats_sorted":[],"license":"http://creativecommons.org/licenses/by/4.0/","primary_cat":"cs.CR","submitted_at":"2021-05-02T22:29:22Z","title_canon_sha256":"f7acdf78bbfb178fe2b08220a3a9016d4a702f2a4e9eb3bf5c08bb473b5afae3"},"schema_version":"1.0","source":{"id":"2105.00565","kind":"arxiv","version":1}},"canonical_sha256":"d2ecfd9a604c24de01a489c4d596993799e4abda1daa144011d779220f803847","receipt":{"algorithm":"ed25519","builder_version":"pith-number-builder-2026-05-17-v1","canonical_sha256":"d2ecfd9a604c24de01a489c4d596993799e4abda1daa144011d779220f803847","first_computed_at":"2026-07-05T02:36:55.445900Z","key_id":"pith-v1-2026-05","kind":"pith_receipt","last_reissued_at":"2026-07-05T02:36:55.445900Z","public_key_fingerprint":"8d4b5ee74e4693bcd1df2446408b0d54","receipt_version":"0.3","signature_b64":"ZhaDJBUYRmoHmeoQB4sGk3Z/l6/s650NLvszeXhEoQkZc/o8JFQ2xMLEjmTMD8sMlAH8LXSVEpZsLOLLZk82Aw==","signature_status":"signed_v1","signed_at":"2026-07-05T02:36:55.446454Z","signed_message":"canonical_sha256_bytes"},"source_id":"2105.00565","source_kind":"arxiv","source_version":1}}},"equivocations":[],"invalid_events":[],"applied_event_ids":["sha256:bd5aaf502cc7307b3c8d393cea59436937ee92b5d147fd907c5ca3a57b952cd0","sha256:12717623270760683c474ea717c0de5c76c28bf905693f95e155fba3db43a847"],"state_sha256":"6449938118c3f0304b34e7c45b1ef6ba5a8224b79aca45f41c468c78f7eebf2e"}