HackDig : Dig high-quality web security articles for hacker

py2exe Decompiling - Part 2, (Mon, Jan 30th)

2017-01-30 21:35

In Diary entry py2exe Decompiling - Part 1 we took a quick look at py2exe files.

How can we identify an .exe file generated by py2exe? A quick test is to check if the PE file has a resource PYTHONSCRIPT. I developed a YARA rule for this.

Of course, this YARA rule just detects if a PE file was created with py2exe. It doesnt identify the sample as malware, there are legitimate py2exe applications too.

As mentioned in part 1, unpy2exe supports Python 2, not Python 3.

For Python 3, you can use program decompile-py2exe.

Please post a comment mentioning the py2exe analysis tools you like to use.

Didier Stevens
Microsoft MVP Consumer Security
blog.DidierStevens.com DidierStevensLabs.com

(c) SANS Internet Storm Center. https://isc.sans.edu Creative Commons Attribution-Noncommercial 3.0 United States License.


Source: ssr;pma&50022=diyrots?lmth.yraid/ude.snas.csi

Read:1642 | Comments:0 | Tags:No Tag

“py2exe Decompiling - Part 2, (Mon, Jan 30th)”0 Comments

Submit A Comment

Name:

Email:

Blog :

Verification Code:

Announce

Share high-quality web security related articles with you:)

Tools

Tag Cloud