Threat Level: green Handler on Duty: Didier Stevens

SANS ISC: InfoSec Handlers Diary Blog InfoSec Handlers Diary Blog


Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!

py2exe Decompiling - Part 2

Published: 2017-01-30
Last Updated: 2017-01-30 10:21:23 UTC
by Didier Stevens (Version: 1)
0 comment(s)

In Diary entry py2exe Decompiling - Part 1 we took a quick look at py2exe files.

How can we identify an .exe file generated by py2exe? A quick test is to check if the PE file has a resource PYTHONSCRIPT. I developed a YARA rule for this.

Of course, this YARA rule just detects if a PE file was created with py2exe. It doesn't identify the sample as malware, there are legitimate py2exe applications too.

 

As mentioned in part 1, unpy2exe supports Python 2, not Python 3.

For Python 3, you can use program decompile-py2exe.

Please post a comment mentioning the py2exe analysis tools you like to use.

Didier Stevens
Microsoft MVP Consumer Security
blog.DidierStevens.com DidierStevensLabs.com

Keywords: py2exe yara
0 comment(s)
Diary Archives