Is "pycalc" on Notepad++ Plugins Safe to Install?

pycalc · notepadpp · v1.0.0

The pycalc plugin enables the execution of python code directly within the editor upon pressing the Enter key.

Risk Assessment

Analyzed
46.76
out of 100
MEDIUM

248 security findings detected across all analyzers

Severity Breakdown

0
Critical
15
High
200
Medium
0
Low
0
Info

Finding Categories

15
Malware Signatures
196
IoC Indicators

YARA Rules Matched

11 rules(15 hits)
postinstall network communication WeakSSLTLSProtocolsShouldNotBeUsed postinstall crypto operations postinstall persistence mechanism postinstall system command postinstall file manipulation DebuggerStatementsShouldNotBeUsed NoUseEval postinstall obfuscation postinstall file download postinstall registry modification

Detailed Findings

48 total

YARA Rule Matches

11 rules

Indicators of Compromise

Network indicators, suspicious strings, and potential IoCs extracted during analysis

URLs
28
IP Addresses
31
Domains
136
Strings
196

All Indicators · 196

Other
detected Email: [email protected]

XIOC detected Email: [email protected]

extracted_from_files

Domain
detected Domain: sslsocket.read

XIOC detected Domain: sslsocket.read

extracted_from_files

IP
detected IP: ::732b

XIOC detected IP: ::732b

extracted_from_files

Domain
detected Domain: crl.microsoft.com

XIOC detected Domain: crl.microsoft.com

extracted_from_files

IP
detected IP: ::53

XIOC detected IP: ::53

extracted_from_files

IP
detected IP: 6.0.0.0

XIOC detected IP: 6.0.0.0

extracted_from_files

Hash
detected MD5 Hash: 33333333333333333333333333333333

XIOC detected MD5 Hash: 33333333333333333333333333333333

extracted_from_files

Hash
detected SHA1 Hash: 2222222222222222222222222222222222222222

XIOC detected SHA1 Hash: 2222222222222222222222222222222222222222

extracted_from_files

Hash
detected SHA256 Hash: 1b256d97b553a9611efca188a3d995a2fff712759044ba480f9a0c9e98fae886

XIOC detected SHA256 Hash: 1b256d97b553a9611efca188a3d995a2fff712759044ba480f9a0c9e98fae886

extracted_from_files

URL
detected URL: http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0

XIOC detected URL: http://crl.microsoft.com/pki/crl/products/MicRooCerAut2011_2011_03_22.crl0

extracted_from_files

URL
detected URL: http://www.microsoft.com/pkiops/docs/primarycps.htm0@

XIOC detected URL: http://www.microsoft.com/pkiops/docs/primarycps.htm0@

extracted_from_files

URL
detected URL: http://www.microsoft.com0

XIOC detected URL: http://www.microsoft.com0

extracted_from_files

URL
detected URL: http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z

XIOC detected URL: http://crl.microsoft.com/pki/crl/products/MicTimStaPCA_2010-07-01.crl0Z

extracted_from_files

URL
detected URL: http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z

XIOC detected URL: http://crl.microsoft.com/pki/crl/products/MicRooCerAut_2010-06-23.crl0Z

extracted_from_files

URL
detected URL: http://www.microsoft.com/PKI/docs/CPS/default.htm0@

XIOC detected URL: http://www.microsoft.com/PKI/docs/CPS/default.htm0@

extracted_from_files

Hash
detected MD5 Hash: 0123456789ABCDEF0123456789abcdef

XIOC detected MD5 Hash: 0123456789ABCDEF0123456789abcdef

extracted_from_files

URL
detected URL: http://ts-ocsp.ws.symantec.com07

XIOC detected URL: http://ts-ocsp.ws.symantec.com07

extracted_from_files

URL
detected URL: https://docs.python.org/3.8/tutorial/.''')

XIOC detected URL: https://docs.python.org/3.8/tutorial/.''')

extracted_from_files

URL
detected URL: http://www.w3.org/XML/1998/namespace

XIOC detected URL: http://www.w3.org/XML/1998/namespace

extracted_from_files

URL
detected URL: http://www.w3.org/2000/xmlns/

XIOC detected URL: http://www.w3.org/2000/xmlns/

extracted_from_files

URL
detected URL: http://python.org/dev/peps/pep-0263/

XIOC detected URL: http://python.org/dev/peps/pep-0263/

extracted_from_files

URL
detected URL: ftp://ftp.unicode.org/.

XIOC detected URL: ftp://ftp.unicode.org/.

extracted_from_files

URL
detected URL: http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a

XIOC detected URL: http://www.microsoft.com/pkiops/crl/MicCodSigPCA2011_2011-07-08.crl0a

extracted_from_files

URL
detected URL: http://ocsp.digicert.com0N

XIOC detected URL: http://ocsp.digicert.com0N

extracted_from_files

URL
detected URL: http://www.digicert.com/CPS0

XIOC detected URL: http://www.digicert.com/CPS0

extracted_from_files

URL
detected URL: http://crl3.digicert.com/sha2-assured-ts.crl02

XIOC detected URL: http://crl3.digicert.com/sha2-assured-ts.crl02

extracted_from_files

URL
detected URL: http://ocsp.digicert.com0C

XIOC detected URL: http://ocsp.digicert.com0C

extracted_from_files

URL
detected URL: https://www.digicert.com/CPS0

XIOC detected URL: https://www.digicert.com/CPS0

extracted_from_files

URL
detected URL: http://ocsp.thawte.com0

XIOC detected URL: http://ocsp.thawte.com0

extracted_from_files

URL
detected URL: http://hdl.handle.net/1895.22/1013

XIOC detected URL: http://hdl.handle.net/1895.22/1013

extracted_from_files

URL
detected URL: http://www.openssl.org/)

XIOC detected URL: http://www.openssl.org/)

extracted_from_files

URL
detected URL: http://schemas.microsoft.com/SMI/2016/WindowsSettings

XIOC detected URL: http://schemas.microsoft.com/SMI/2016/WindowsSettings

extracted_from_files

URL
detected URL: http://crl3.digicert.com/sha2-assured-cs-g1.crl05

XIOC detected URL: http://crl3.digicert.com/sha2-assured-cs-g1.crl05

extracted_from_files

Other
detected Email: [email protected]

XIOC detected Email: [email protected]

extracted_from_files

Other
detected Email: [email protected]

XIOC detected Email: [email protected]

extracted_from_files

URL
detected URL: http://www.cwi.nl)

XIOC detected URL: http://www.cwi.nl)

extracted_from_files

URL
detected URL: http://www.cnri.reston.va.us)

XIOC detected URL: http://www.cnri.reston.va.us)

extracted_from_files

URL
detected URL: https://www.python.org/psf/)

XIOC detected URL: https://www.python.org/psf/)

extracted_from_files

URL
detected URL: http://www.opensource.org

XIOC detected URL: http://www.opensource.org

extracted_from_files

URL
detected URL: http://www.pythonlabs.com/logos.html

XIOC detected URL: http://www.pythonlabs.com/logos.html

extracted_from_files

Domain
detected Domain: ftp.unicode.org

XIOC detected Domain: ftp.unicode.org

extracted_from_files

IP
detected IP: 123.45.67.89

XIOC detected IP: 123.45.67.89

extracted_from_files

Domain
detected Domain: name.nr

XIOC detected Domain: name.nr

extracted_from_files

Domain
detected Domain: locks.nc

XIOC detected Domain: locks.nc

extracted_from_files

Other
detected Email: [email protected]

XIOC detected Email: [email protected]

extracted_from_files

IP
detected Email: [email protected]

XIOC detected Email: [email protected]

extracted_from_files

Domain
detected Domain: h.ar

XIOC detected Domain: h.ar

extracted_from_files

Domain
detected Domain: el.ar

XIOC detected Domain: el.ar

extracted_from_files

Domain
detected Domain: h.bd

XIOC detected Domain: h.bd

extracted_from_files

Domain
detected Domain: v.hm

XIOC detected Domain: v.hm

extracted_from_files

Domain
detected Domain: b.ws

XIOC detected Domain: b.ws

extracted_from_files

Domain
detected Domain: d.ph

XIOC detected Domain: d.ph

extracted_from_files

Domain
detected Domain: q.page

XIOC detected Domain: q.page

extracted_from_files

Domain
detected Domain: q.data

XIOC detected Domain: q.data

extracted_from_files

Domain
detected Domain: o.ar

XIOC detected Domain: o.ar

extracted_from_files

Domain
detected Domain: 5.sz

XIOC detected Domain: 5.sz

extracted_from_files

Domain
detected Domain: v.ye

XIOC detected Domain: v.ye

extracted_from_files

Domain
detected Domain: 1.mg

XIOC detected Domain: 1.mg

extracted_from_files

Domain
detected Domain: l.br

XIOC detected Domain: l.br

extracted_from_files

Domain
detected Domain: oow.sn

XIOC detected Domain: oow.sn

extracted_from_files

Domain
detected Domain: g.ro

XIOC detected Domain: g.ro

extracted_from_files

Domain
detected Domain: g.vc

XIOC detected Domain: g.vc

extracted_from_files

Domain
detected Domain: 8.ag

XIOC detected Domain: 8.ag

extracted_from_files

Domain
detected Domain: x.er

XIOC detected Domain: x.er

extracted_from_files

Domain
detected Domain: cs.cr

XIOC detected Domain: cs.cr

extracted_from_files

Domain
detected Domain: z.th

XIOC detected Domain: z.th

extracted_from_files

Domain
detected Domain: 1a.il

XIOC detected Domain: 1a.il

extracted_from_files

Domain
detected Domain: gغg.sg

XIOC detected Domain: gغg.sg

extracted_from_files

Domain
detected Domain: 0.gn

XIOC detected Domain: 0.gn

extracted_from_files

Domain
detected Domain: h.ie

XIOC detected Domain: h.ie

extracted_from_files

Domain
detected Domain: s4.in

XIOC detected Domain: s4.in

extracted_from_files

Domain
detected Domain: ve.mx

XIOC detected Domain: ve.mx

extracted_from_files

Domain
detected Domain: n.tk

XIOC detected Domain: n.tk

extracted_from_files

Domain
detected Domain: o.to

XIOC detected Domain: o.to

extracted_from_files

Domain
detected Domain: ev.ye

XIOC detected Domain: ev.ye

extracted_from_files

Domain
detected Domain: spec.name

XIOC detected Domain: spec.name

extracted_from_files

Domain
detected Domain: file.read

XIOC detected Domain: file.read

extracted_from_files

Domain
detected Domain: flag.py

XIOC detected Domain: flag.py

extracted_from_files

Domain
detected Domain: c.ro

XIOC detected Domain: c.ro

extracted_from_files

Domain
detected Domain: b.fk

XIOC detected Domain: b.fk

extracted_from_files

Domain
detected Domain: zl.la

XIOC detected Domain: zl.la

extracted_from_files

Domain
detected Domain: v.jp

XIOC detected Domain: v.jp

extracted_from_files

Domain
detected Domain: md5.md

XIOC detected Domain: md5.md

extracted_from_files

Domain
detected Domain: entry.name

XIOC detected Domain: entry.name

extracted_from_files

Domain
detected Domain: descr.py

XIOC detected Domain: descr.py

extracted_from_files

Domain
detected Domain: pickle.name

XIOC detected Domain: pickle.name

extracted_from_files

Domain
detected Domain: parser.st

XIOC detected Domain: parser.st

extracted_from_files

Domain
detected Domain: os.link

XIOC detected Domain: os.link

extracted_from_files

Domain
detected Domain: types.new

XIOC detected Domain: types.new

extracted_from_files

IP
detected Domain: myimport.zip

XIOC detected Domain: myimport.zip

extracted_from_files

IP
detected Domain: zipimporter.is

XIOC detected Domain: zipimporter.is

extracted_from_files

IP
detected Domain: zipimportresourcereader.open

XIOC detected Domain: zipimportresourcereader.open

extracted_from_files

IP
detected Domain: zipimportresourcereader.is

XIOC detected Domain: zipimportresourcereader.is

extracted_from_files

Domain
detected Domain: gd.gb.ge.gh

XIOC detected Domain: gd.gb.ge.gh

extracted_from_files

Domain
detected Domain: datetime.date

XIOC detected Domain: datetime.date

extracted_from_files

IP
detected Domain: itertools.zip

XIOC detected Domain: itertools.zip

extracted_from_files

IP
detected IP: ::7:6d

XIOC detected IP: ::7:6d

extracted_from_files

Domain
detected Domain: www.microsoft.com

XIOC detected Domain: www.microsoft.com

extracted_from_files

IP
detected IP: c::

XIOC detected IP: c::

extracted_from_files

Domain
detected Domain: objects.nr

XIOC detected Domain: objects.nr

extracted_from_files

Domain
detected Domain: packages.fr

XIOC detected Domain: packages.fr

extracted_from_files

Domain
detected Domain: builtinimporter.is

XIOC detected Domain: builtinimporter.is

extracted_from_files

Domain
detected Domain: frozenimporter.is

XIOC detected Domain: frozenimporter.is

extracted_from_files

Domain
detected Domain: fileloader.is

XIOC detected Domain: fileloader.is

extracted_from_files

Domain
detected Domain: code.nr

XIOC detected Domain: code.nr

extracted_from_files

Domain
detected Domain: z1extensionfileloader.is

XIOC detected Domain: z1extensionfileloader.is

extracted_from_files

Domain
detected Domain: extensionfileloader.is

XIOC detected Domain: extensionfileloader.is

extracted_from_files

Domain
detected Domain: object.nr

XIOC detected Domain: object.nr

extracted_from_files

Domain
detected Domain: namespaceloader.is

XIOC detected Domain: namespaceloader.is

extracted_from_files

Domain
detected Domain: z.search

XIOC detected Domain: z.search

extracted_from_files

Domain
detected Domain: file.ru

XIOC detected Domain: file.ru

extracted_from_files

Domain
detected Domain: inspectloader.is

XIOC detected Domain: inspectloader.is

extracted_from_files

Domain
detected Domain: loaderbasics.is

XIOC detected Domain: loaderbasics.is

extracted_from_files

Domain
detected Domain: creation.nr

XIOC detected Domain: creation.nr

extracted_from_files

Domain
detected Domain: module.nz

XIOC detected Domain: module.nz

extracted_from_files

Domain
detected Domain: finder.nr

XIOC detected Domain: finder.nr

extracted_from_files

Domain
detected Domain: fileloader.open

XIOC detected Domain: fileloader.open

extracted_from_files

Domain
detected Domain: os.open

XIOC detected Domain: os.open

extracted_from_files

Domain
detected Domain: f.nl

XIOC detected Domain: f.nl

extracted_from_files

Domain
detected Domain: ytdi.ss

XIOC detected Domain: ytdi.ss

extracted_from_files

Domain
detected Domain: ab.pq.rs

XIOC detected Domain: ab.pq.rs

extracted_from_files

Domain
detected Domain: sys.int

XIOC detected Domain: sys.int

extracted_from_files

Domain
detected Domain: type.fi

XIOC detected Domain: type.fi

extracted_from_files

Domain
detected Domain: os.path.isabs.fr

XIOC detected Domain: os.path.isabs.fr

extracted_from_files

Domain
detected Domain: cpython.run

XIOC detected Domain: cpython.run

extracted_from_files

Domain
detected Domain: codecs.open

XIOC detected Domain: codecs.open

extracted_from_files

Domain
detected Domain: refleak.py

XIOC detected Domain: refleak.py

extracted_from_files

Domain
detected Domain: re.search

XIOC detected Domain: re.search

extracted_from_files

Domain
detected Domain: r.name

XIOC detected Domain: r.name

extracted_from_files

Domain
detected Domain: r.date

XIOC detected Domain: r.date

extracted_from_files

Domain
detected Domain: thread.run

XIOC detected Domain: thread.run

extracted_from_files

Domain
detected Domain: r.nr

XIOC detected Domain: r.nr

extracted_from_files

Domain
detected Domain: i.br

XIOC detected Domain: i.br

extracted_from_files

Domain
detected Domain: python38.py

XIOC detected Domain: python38.py

extracted_from_files

IP
detected Domain: python38.zip

XIOC detected Domain: python38.zip

extracted_from_files

Domain
detected Domain: python.org

XIOC detected Domain: python.org

extracted_from_files

Domain
detected Domain: builtins.id

XIOC detected Domain: builtins.id

extracted_from_files

Domain
detected Domain: msvcrt.open

XIOC detected Domain: msvcrt.open

extracted_from_files

Domain
detected Domain: ocsp.thawte.com

XIOC detected Domain: ocsp.thawte.com

extracted_from_files

Domain
detected Domain: crl.thawte.com

XIOC detected Domain: crl.thawte.com

extracted_from_files

Domain
detected Domain: ts-ocsp.ws.symantec.com

XIOC detected Domain: ts-ocsp.ws.symantec.com

extracted_from_files

Domain
detected Domain: ts-aia.ws.symantec.com

XIOC detected Domain: ts-aia.ws.symantec.com

extracted_from_files

Domain
detected Domain: ts-crl.ws.symantec.com

XIOC detected Domain: ts-crl.ws.symantec.com

extracted_from_files

IP
detected IP: a::

XIOC detected IP: a::

extracted_from_files

IP
detected IP: ::

XIOC detected IP: ::

extracted_from_files

IP
detected IP: 255.255.255.255

XIOC detected IP: 255.255.255.255

extracted_from_files

Domain
detected Domain: lg.hk

XIOC detected Domain: lg.hk

extracted_from_files

Domain
detected Domain: context.name

XIOC detected Domain: context.name

extracted_from_files

Domain
detected Domain: d.data

XIOC detected Domain: d.data

extracted_from_files

Domain
detected Domain: p.prime

XIOC detected Domain: p.prime

extracted_from_files

Domain
detected Domain: n.lb

XIOC detected Domain: n.lb

extracted_from_files

Domain
detected Domain: u.id

XIOC detected Domain: u.id

extracted_from_files

Domain
detected Domain: www.memtest86.com

XIOC detected Domain: www.memtest86.com

extracted_from_files

Domain
detected Domain: c.in

XIOC detected Domain: c.in

extracted_from_files

Domain
detected Domain: ctypes.call

XIOC detected Domain: ctypes.call

extracted_from_files

Domain
detected Domain: collections.abc

XIOC detected Domain: collections.abc

extracted_from_files

Domain
detected Domain: decimal.as

XIOC detected Domain: decimal.as

extracted_from_files

Domain
detected Domain: x.compare

XIOC detected Domain: x.compare

extracted_from_files

Domain
detected Domain: www.w3.org

XIOC detected Domain: www.w3.org

extracted_from_files

Domain
detected Domain: www.digicert.com

XIOC detected Domain: www.digicert.com

extracted_from_files

Domain
detected Domain: asyncio.events

XIOC detected Domain: asyncio.events

extracted_from_files

Domain
detected Domain: ocsp.digicert.com

XIOC detected Domain: ocsp.digicert.com

extracted_from_files

Domain
detected Domain: cacerts.digicert.com

XIOC detected Domain: cacerts.digicert.com

extracted_from_files

Domain
detected Domain: crl4.digicert.com

XIOC detected Domain: crl4.digicert.com

extracted_from_files

Domain
detected Domain: crl3.digicert.com

XIOC detected Domain: crl3.digicert.com

extracted_from_files

Domain
detected Domain: bz2.bz

XIOC detected Domain: bz2.bz

extracted_from_files

IP
detected Domain: bzip.org

XIOC detected Domain: bzip.org

extracted_from_files

Domain
detected Domain: openssl.org

XIOC detected Domain: openssl.org

extracted_from_files

Domain
detected Domain: cryptsoft.com

XIOC detected Domain: cryptsoft.com

extracted_from_files

Domain
detected Domain: www.cwi.nl

XIOC detected Domain: www.cwi.nl

extracted_from_files

Domain
detected Domain: www.cnri.reston.va.us

XIOC detected Domain: www.cnri.reston.va.us

extracted_from_files

Domain
detected Domain: beopen.com

XIOC detected Domain: beopen.com

extracted_from_files

Domain
detected Domain: schemas.microsoft.com

XIOC detected Domain: schemas.microsoft.com

extracted_from_files

IP
detected IP: ::a

XIOC detected IP: ::a

extracted_from_files

Domain
detected Domain: www.python.org

XIOC detected Domain: www.python.org

extracted_from_files

Domain
detected Domain: www.opensource.org

XIOC detected Domain: www.opensource.org

extracted_from_files

Domain
detected Domain: www.pythonlabs.com

XIOC detected Domain: www.pythonlabs.com

extracted_from_files

Domain
detected Domain: hdl.handle.net

XIOC detected Domain: hdl.handle.net

extracted_from_files

Domain
detected Domain: www.openssl.org

XIOC detected Domain: www.openssl.org

extracted_from_files

Domain
detected Domain: microsoft.com

XIOC detected Domain: microsoft.com

extracted_from_files

IP
detected IP: 7::

XIOC detected IP: 7::

extracted_from_files

IP
detected IP: e::a

XIOC detected IP: e::a

extracted_from_files

IP
detected IP: 2::

XIOC detected IP: 2::

extracted_from_files

IP
detected IP: ::6633

XIOC detected IP: ::6633

extracted_from_files

IP
detected IP: ::65

XIOC detected IP: ::65

extracted_from_files

IP
detected IP: ::665

XIOC detected IP: ::665

extracted_from_files

IP
detected IP: d::

XIOC detected IP: d::

extracted_from_files

IP
detected IP: ::7

XIOC detected IP: ::7

extracted_from_files

IP
detected IP: ::bc

XIOC detected IP: ::bc

extracted_from_files

IP
detected IP: f::d

XIOC detected IP: f::d

extracted_from_files

IP
detected IP: 0::

XIOC detected IP: 0::

extracted_from_files

IP
detected IP: ::d

XIOC detected IP: ::d

extracted_from_files

IP
detected IP: 4f::

XIOC detected IP: 4f::

extracted_from_files

Domain
detected Domain: docs.python.org

XIOC detected Domain: docs.python.org

extracted_from_files

Domain
detected Domain: n.ie

XIOC detected Domain: n.ie

extracted_from_files

Domain
detected Domain: code.co

XIOC detected Domain: code.co

extracted_from_files

Security Analysis Summary

Security Analysis Overview

pycalc is a notepadpp extension published by pycalc. Version 1.0.0 has been analyzed by the Risky Plugins security platform, receiving a risk score of 46.76/100 (MEDIUM risk) based on 248 security findings.

Risk Assessment

This extension presents moderate security risk. Several findings were detected that may warrant attention. Users should carefully review the permissions and findings before installation.

Findings Breakdown

  • High: 15 finding(s)
  • Medium: 200 finding(s)

What Was Analyzed

The security assessment covers multiple analysis categories:

  • Malware Detection: YARA rule matching against 2,400+ malware signatures
  • Secret Detection: Scanning for exposed API keys, tokens, and credentials
  • Static Analysis: Code-level security analysis for common vulnerability patterns
  • Network Analysis: Detection of suspicious network communications and endpoints
  • Obfuscation Detection: Identification of code obfuscation techniques

Developer Information

pycalc is published by pycalc on the notepadpp marketplace.

Recommendation

Exercise caution with this extension. Review the detailed findings and ensure the requested permissions align with the extension's stated functionality before installation.

Frequently Asked Questions