reverse-skills-max/vendor-new/analyst-ai-pack/skills/analyzing-compiled-python-malware/SKILL.md

name, description, domain, subdomain, tags, version, author, license, mitre_attack, d3fend, references

name	description	domain	subdomain	tags	version	author	license	mitre_attack	d3fend	references
analyzing-compiled-python-malware	Analyzes Python-based malware packaged as PyInstaller/py2exe executables by detecting the packer, locating the embedded archive, and identifying bundled .pyc modules for extraction and decompilation. Activates for requests to analyze compiled Python malware, unpack a PyInstaller binary, or extract pyc modules from a frozen Python executable.	cybersecurity	reverse-engineering	reverse-engineering python pyinstaller pyc unpacking	1.0.0	analyst-ai-pack	Apache-2.0	T1027 T1059.006 T1587.001	D3-SDA D3-DA	PyInstaller archive format (CArchive/PKG) — https://pyinstaller.org/en/stable/advanced-topics.html Python bytecode (dis module / .pyc magic) — https://docs.python.org/3/library/dis.html

Analyzing Compiled Python Malware

When to Use

• You have an executable that is actually a frozen Python app (PyInstaller, py2exe, cx_Freeze) and need to identify the packer and locate the embedded Python modules.
• You want to extract .pyc files for decompilation.

Do not use this to run the executable — it identifies and locates the embedded archive statically. Decompile extracted .pyc in an isolated environment.

Prerequisites

• The frozen executable (read inertly).

Safety & Handling

• Read bytes statically; treat extracted modules as malicious until reviewed.

Workflow

Step 1: Detect the packer

python scripts/analyst.py detect sample.exe

Looks for PyInstaller markers (pyi-, PYZ-00.pyz, the MEI CArchive cookie MEI\014\013\012\013\016), py2exe (PYTHONSCRIPT, zipfile.zip), and embedded python3x.dll references.

Step 2: Locate the embedded archive

Find the CArchive cookie near the end of the file and report the offset and the embedded Python version string (python3.x).

Step 3: Extract and decompile

Use a PyInstaller extractor to dump the archive, then decompile .pyc (matching the detected Python version) for source recovery.

Step 4: Analyze the source

Review the recovered Python for C2, persistence, and capability; map to ATT&CK.

Validation

• The packer is identified by its specific marker, not just the presence of Python strings.
• The CArchive cookie offset and Python version are reported when PyInstaller is present.
• Findings distinguish the bootloader stub from the embedded Python payload.

Pitfalls

• .pyc version mismatch breaking decompilation — match the interpreter version.
• Stripped/obfuscated bytecode (e.g., custom magic) needing header repair before decompiling.
• Encrypted PYZ archives (PyInstaller --key) requiring the key.

References

• See references/api-reference.md for the detector.
• PyInstaller archive and Python bytecode references (linked in frontmatter).