reverse-skills-max/vendor-new/analyst-ai-pack/skills/analyzing-compiled-python-malware/references/api-reference.md

API Reference: Analyzing Compiled Python Malware

Overview

scripts/analyst.py detects frozen-Python packers (PyInstaller, py2exe, cx_Freeze) by their markers, locates the PyInstaller CArchive magic cookie, and extracts embedded Python version strings. It reads bytes statically and executes nothing.

Dependencies

Package	Version	Purpose
(stdlib)	—	regex, JSON, file IO

Core functions

detect(path)

Returns the detected packer, PyInstaller cookie offset, and Python version strings, plus the recommended next step.

Markers

• PyInstaller: _MEIPASS, PYZ-00.pyz, pyiboot01_bootstrap, CArchive cookie MEI\\014\\013\\012\\013\\016.
• py2exe: PYTHONSCRIPT.
• cx_Freeze: cx_Freeze strings.

Usage

python scripts/analyst.py detect sample.exe

Sources

• PyInstaller archive format (CArchive/PKG, MEI cookie) — https://pyinstaller.org/en/stable/advanced-topics.html
• Python bytecode / .pyc magic (dis module) — https://docs.python.org/3/library/dis.html
• pyinstxtractor extraction workflow (public PyInstaller-unpacking tooling)