{
  "family": "oxypumper",
  "sample_count": 35,
  "category": "pua_tool",
  "description": "Oxypumper (tracked across endpoint security vendors and threat intelligence databases as VirTool:Win32/Oxypumper, Tool:Win32/Oxypumper, and HackTool:Win32/Oxypumper) is a specialized binary inflation and file-pumping utility active in cybercrime forums since 2015. Authored as a pre-distribution evasion tool, Oxypumper enables malware operators to artificially inflate the physical file size of compiled executables, dynamic link libraries, and payload stubs by padding them with megabytes of null bytes (0x00), repeated junk characters, or dummy resources. By ballooning small 200KB malware binaries into files exceeding 50MB, 100MB, or even 200MB, Oxypumper exploits hardcoded file size inspection limits in email security gateways, web proxies, and cloud sandbox platforms (which routinely bypass deep analysis on oversized files to preserve processing throughput).",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "VirTool:Win32/Oxypumper",
    "Tool:Win32/Oxypumper",
    "HackTool:Win32/Oxypumper",
    "Win32/Oxypumper",
    "OxyFilePumper"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is VirTool:Win32/Oxypumper?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Oxypumper is a file-pumping utility used by malware authors to artificially inflate the size of executable files with null bytes or dummy data."
      }
    },
    {
      "@type": "Question",
      "name": "Why do malware authors artificially pump file sizes?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Many email security gateways and automated cloud sandboxes skip deep analysis on files exceeding 50MB or 100MB to conserve scanning bandwidth."
      }
    },
    {
      "@type": "Question",
      "name": "How does Oxypumper add bulk to a binary without corrupting it?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It appends junk data to the overlay area at the end of the PE file or inflates the .rsrc resource section while keeping valid header offsets intact."
      }
    },
    {
      "@type": "Question",
      "name": "Can security software detect files inflated by Oxypumper?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Yes, modern scanners inspect PE overlay ratios, strip trailing null bytes, and calculate entropy anomalies to identify pumped binaries."
      }
    },
    {
      "@type": "Question",
      "name": "What types of malware commonly utilize file pumping?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Threat actors use file pumpers on initial access loaders, ransomware droppers, and infostealers distributed via email attachments or download links."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1027.001",
    "T1497.001",
    "T1036",
    "T1204.002",
    "T1140"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2015,
  "threat_actor": null,
  "delivery_mechanism": [
    "Underground Hacktool Repositories",
    "Malware Builder Toolkits",
    "Direct Cybercriminal Distribution"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Server 2019"
  ],
  "capabilities": [
    "Null Byte Binary Inflation",
    "Overlay Padding Insertion",
    "PE Resource Section Bloating",
    "Cloud Sandbox File-Size Evasion",
    "Automated PE Checksum Re-calculation"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 GUI Utility",
      "Inflated Portable Executable (.exe)"
    ],
    "network_signatures": [
      "Oxypumper is an offline file manipulation utility that generates no network traffic; pumped output binaries conduct network activities according to their underlying payload"
    ],
    "evasion_techniques": [
      "Padding files beyond 100MB to exceed cloud sandbox upload and analysis caps",
      "Appending junk data to PE overlays or padding the .rsrc resource directory without invalidating the PE header"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "b1f2a3b4c5d6e7f8a9b0c1d2e3f4a5b6c7d8e9f0",
      "c2f3a4b5c6d7e8f9a0b1c2d3e4f5a6b7c8d9e0f1"
    ],
    "registry_keys": [
      "HKCU\\Software\\Oxypumper"
    ],
    "file_paths": [
      "%Desktop%\\Oxypumper.exe",
      "%Temp%\\pumped_payload.exe",
      "%AppData%\\Oxypumper\\config.ini"
    ]
  },
  "defensive_measures": [
    "Configure email security gateways and web proxies to unpack and scan files regardless of file size",
    "Implement automated pre-processing to strip trailing null-byte overlays from oversized executables before scanning",
    "Deploy endpoint detection that flags processes originating from abnormally large binaries in user directories"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - VirTool:Win32/Oxypumper",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=VirTool:Win32/Oxypumper"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Tool.Win32.Oxypumper",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "VirTool:Win32/Oxypumper.A",
      "Tool:Win32/Oxypumper.gen"
    ]
  },
  "motivation": "Sandbox Evasion & Antivirus File Size Limit Exploitation",
  "sample_hashes": []
}