analyzing-compiled-python-malware
starsforks
How to install analyzing-compiled-python-malware?
meltedinhex/analyst-ai-pack/analyzing-compiled-python-malware
$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-compiled-python-malwareAnalyzes Python-based malware packaged as PyInstaller/py2exe executables by detecting
SKILL.md
| 1 | # Analyzing Compiled Python Malware |
| 2 | |
| 3 | ## When to Use |
| 4 | |
| 5 | - You have an executable that is actually a frozen Python app (PyInstaller, py2exe, cx_Freeze) and |
| 6 | need to identify the packer and locate the embedded Python modules. |
| 7 | - You want to extract `.pyc` files for decompilation. |
| 8 | |
| 9 | **Do not use** this to run the executable — it identifies and locates the embedded archive |
| 10 | statically. Decompile extracted `.pyc` in an isolated environment. |
| 11 | |
| 12 | ## Prerequisites |
| 13 | |
| 14 | - The frozen executable (read inertly). |
| 15 | |
| 16 | ## Safety & Handling |
| 17 | |
| 18 | - Read bytes statically; treat extracted modules as malicious until reviewed. |
| 19 | |
| 20 | ## Workflow |
| 21 | |
| 22 | ### Step 1: Detect the packer |
| 23 | |
| 24 | ```bash |
| 25 | python scripts/analyst.py detect sample.exe |
| 26 | ``` |
| 27 | |
| 28 | Looks for PyInstaller markers (`pyi-`, `PYZ-00.pyz`, the `MEI` CArchive cookie `MEI\014\013\012\013\016`), |
| 29 | py2exe (`PYTHONSCRIPT`, `zipfile.zip`), and embedded `python3x.dll` references. |
| 30 | |
| 31 | ### Step 2: Locate the embedded archive |
| 32 | |
| 33 | Find the CArchive cookie near the end of the file and report the offset and the embedded Python |
| 34 | version string (`python3.x`). |
| 35 | |
| 36 | ### Step 3: Extract and decompile |
| 37 | |
| 38 | Use a PyInstaller extractor to dump the archive, then decompile `.pyc` (matching the detected |
| 39 | Python version) for source recovery. |
| 40 | |
| 41 | ### Step 4: Analyze the source |
| 42 | |
| 43 | Review the recovered Python for C2, persistence, and capability; map to ATT&CK. |
| 44 | |
| 45 | ## Validation |
| 46 | |
| 47 | - The packer is identified by its specific marker, not just the presence of Python strings. |
| 48 | - The CArchive cookie offset and Python version are reported when PyInstaller is present. |
| 49 | - Findings distinguish the bootloader stub from the embedded Python payload. |
| 50 | |
| 51 | ## Pitfalls |
| 52 | |
| 53 | - `.pyc` version mismatch breaking decompilation — match the interpreter version. |
| 54 | - Stripped/obfuscated bytecode (e.g., custom magic) needing header repair before decompiling. |
| 55 | - Encrypted PYZ archives (PyInstaller `--key`) requiring the key. |
| 56 | |
| 57 | ## References |
| 58 | |
| 59 | - See [`references/api-reference.md`](references/api-reference.md) for the detector. |
| 60 | - PyInstaller archive and Python bytecode references (linked in frontmatter). |
People who liked this also viewed
6 picksType
- find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 2026
- grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026
- vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026
- improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026
- setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026
- triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026
