py-covert-scan

Python Covert-Tactics Scanner

The Python sibling of js-covert-scan: detect the tactics Python code uses to hide what it does, and emit atoms. Static, read-only, pure-stdlib.

When to use

A .py (or a package, or source recovered by pyc-decompile) that might be a dropper or be behaving differently under analysis. This surfaces the tactics; it doesn't decide intent.

What it detects — real parallax atoms, tagged method="covert-scan"

Every finding is emitted as a judgment-free parallax atom with method: "covert-scan"; the downstream lens makes the obfuscation/evasion judgment from that provenance. The per-tactic note preserves exactly which tactic was seen (so a LOAD.EVAL finding still says "decode-then-execute" vs plain "exec()/eval()", and a LOAD.DESER finding still says "marshalled code object" vs "pickle deserialization").

LOAD.EVAL / LOAD.DESER / LOAD.REFLECT — hidden code execution (the hallmark of Python malware):

• LOAD.EVAL — decode-then-execute (exec/eval/compile fed by base64/hex/zlib/gzip/lzma/marshal output — the strongest single tell), and plain exec() / eval().
• LOAD.DESER — marshal.loads (marshalled code object) and pickle.load(s) (deserialization can execute code).
• LOAD.REFLECT — __import__() / getattr(__builtins__, …) / importlib.

XFRM.ENCODE — strings built from chr() / long \xNN escapes.

ENVI.ENVCHECK / ENVI.SANDBOX / ENVI.DEBUG — environment-keyed / anti-analysis:

• ENVI.ENVCHECK — platform branching (sys.platform / platform.system()) and timezone/locale checks (time.tzname / locale.getlocale / ZoneInfo).
• ENVI.SANDBOX — VM/sandbox/analyst detection (gethostname, getpass.getuser, /sys/class/dmi, VMware/VirtualBox/QEMU markers).
• ENVI.DEBUG — debugger/tracer detection (sys.gettrace() / ptrace / IsDebuggerPresent).

XFRM.UNICODE — invisible/zero-width/bidi chars and confusable-homoglyph punctuation/letters (same detection as the JS scanner — it's about the source bytes).