Skip to content

TRUST.md

Latest commit

 

History

History
123 lines (78 loc) · 3.56 KB

TRUST.md

File metadata and controls

123 lines (78 loc) · 3.56 KB
Raw

Verifying IDM Queue downloads

Download IDM Queue only from the official repository:

https://github.com/Satan2049/idm-queue/releases

Each release should include:

  • IDMQueue.exe — portable Windows executable
  • SHA256.txt — checksums for release assets (EXE, ZIP, etc.)

Why verify?

PyInstaller executables are sometimes flagged heuristically by antivirus tools. Checksums let you confirm that the file you downloaded matches the one published by the maintainer and was not corrupted or tampered with in transit.

Verify SHA256 on Windows

1. Download both files

From the latest GitHub Release:

  • IDMQueue.exe
  • SHA256.txt

Place them in the same folder (for example Downloads\idm-queue).

2. Generate the hash locally

Open PowerShell in that folder:

Get-FileHash -Algorithm SHA256 .\IDMQueue.exe

You will see output like:

Algorithm       Hash
---------       ----
SHA256          A1B2C3D4...

3. Compare with SHA256.txt

Open SHA256.txt and find the line for IDMQueue.exe. The hash is case-insensitive — compare the full 64-character value.

They must match exactly.

4. Regenerate checksums when building from source

Maintainers and advanced users can reproduce release checksums:

.\scripts\build.ps1
.\scripts\generate-sha256.ps1

This writes SHA256.txt at the repository root and a copy under dist\.

Verify SHA256 on Linux / macOS

shasum -a 256 IDMQueue.exe
# or
sha256sum IDMQueue.exe

Compare the output with the corresponding line in SHA256.txt.

VirusTotal scan (v1.0.3)

Official scan for the published IDMQueue.exe:

https://www.virustotal.com/gui/file/41e289b7cbfd5a9c2e420abe6a9bb37fb47059486b75d6fa1c28455b3730972d

SHA256: 41e289b7cbfd5a9c2e420abe6a9bb37fb47059486b75d6fa1c28455b3730972d

VirusTotal aggregates many antivirus engines. It is useful for additional confidence, not a substitute for checksum verification.

Known heuristic flags (false positives)

Unsigned PyInstaller executables are often flagged by a small subset of engines. For v1.0.3, examples include:

Engine Label
Arctic Wolf Unsafe
Bkav Pro W32.Malware.68560D53
Microsoft Trojan:Win32/Wacatac.B!ml
SecureAge Malicious
Zillya Backdoor.Bladabindi.Win32.34070

IDM Queue is open source (MIT). It does not install persistence, collect telemetry, or download payloads. It only reads text/URLs you provide and invokes IDMan.exe when you click send.

If your local SHA256 matches SHA256.txt from GitHub Releases, the file is the authentic release — even when a few heuristic engines disagree.

How to interpret results

Result Meaning
Majority clean Expected for PyInstaller; still verify SHA256
1–5 heuristic flags Common on unsigned packed EXEs — compare SHA256 first
SHA256 mismatch Do not run — file may be corrupted or tampered

You may report false positives to vendors via VirusTotal, or build from source instead.

Build from source (highest trust)

If you prefer not to run a pre-built binary:

git clone https://github.com/Satan2049/idm-queue.git
cd idm-queue
python -m venv .venv
.venv\Scripts\activate
pip install -r requirements.txt
python main.py

See building.md for packaging your own executable.

Questions?

Open a GitHub Discussion or Issue for verification help — never share secrets or personal download tokens.