Malware Analysis - Unpack and Decompile PyInstaller Malware

Learn how to unpack and decompile Python malware packaged with PyInstaller by fixing the header of the main script.

We unpack and decompile a malware that was written in Python and transformed into an executable with PyInstaller. In order to do that we have to fix the header of the main script. Malware analysis courses: malwareanalysis-for-hedgehogs.learnworlds.com/courses Buy me a coffee: ko-fi.com/struppigel Follow me on Twitter: twitter.com/struppigel Previous video about Python decompiling: youtube.com/watch?v=r6BtA8p8kRU&t=755s Structure of .pyc files: nedbatchelder.com/blog/200804/the_structure_of_pyc_files.htm… How to setup Python and Uncompyle6: youtu.be/AkrAhUbCod0 Sample VirusBay: beta.virusbay.io/sample/browse/2510851a7cead4b8c79d0a6d35f8e… Sample Hybrid-Analysis: hybrid-analysis.com/sample/53854221c6c1fa513d6ecf83385518dbd… pyinstxtractor: github.com/extremecoders-re/pyinstxtractor/blob/master/pyins… Easy Python Decompiler: sourceforge.net/projects/easypythondecompiler/ PortexAnalyzer: github.com/katjahahn/PortEx/tree/master/progs HxD: mh-nexus.de/en/hxd/