# Analyzing Compiled Python Malware

> Analyzes Python-based malware packaged as PyInstaller/py2exe executables by detecting

- **Type:** Skill
- **Install:** `agentstack add skill-meltedinhex-analyst-ai-pack-analyzing-compiled-python-malware`
- **Verified:** Yes — security-reviewed for prompt injection and unsafe behavior
- **Seller:** [meltedinhex](https://agentstack.voostack.com/s/meltedinhex)
- **Installs:** 0
- **Category:** [Agent Skills](https://agentstack.voostack.com/c/agent-skills)
- **Latest version:** 0.1.0
- **License:** Apache-2.0
- **Upstream author:** [meltedinhex](https://github.com/meltedinhex)
- **Source:** https://github.com/meltedinhex/analyst-ai-pack/tree/main/skills/analyzing-compiled-python-malware
- **Website:** https://meltedinhex.com/

## Install

```sh
agentstack add skill-meltedinhex-analyst-ai-pack-analyzing-compiled-python-malware
```

Requires the [AgentStack CLI](https://agentstack.voostack.com/docs/cli). Works with Claude Code, Cursor, and any MCP-compatible agent.

## About

# Analyzing Compiled Python Malware

## When to Use

- You have an executable that is actually a frozen Python app (PyInstaller, py2exe, cx_Freeze) and
  need to identify the packer and locate the embedded Python modules.
- You want to extract `.pyc` files for decompilation.

**Do not use** this to run the executable — it identifies and locates the embedded archive
statically. Decompile extracted `.pyc` in an isolated environment.

## Prerequisites

- The frozen executable (read inertly).

## Safety & Handling

- Read bytes statically; treat extracted modules as malicious until reviewed.

## Workflow

### Step 1: Detect the packer

```bash
python scripts/analyst.py detect sample.exe
```

Looks for PyInstaller markers (`pyi-`, `PYZ-00.pyz`, the `MEI` CArchive cookie `MEI\014\013\012\013\016`),
py2exe (`PYTHONSCRIPT`, `zipfile.zip`), and embedded `python3x.dll` references.

### Step 2: Locate the embedded archive

Find the CArchive cookie near the end of the file and report the offset and the embedded Python
version string (`python3.x`).

### Step 3: Extract and decompile

Use a PyInstaller extractor to dump the archive, then decompile `.pyc` (matching the detected
Python version) for source recovery.

### Step 4: Analyze the source

Review the recovered Python for C2, persistence, and capability; map to ATT&CK.

## Validation

- The packer is identified by its specific marker, not just the presence of Python strings.
- The CArchive cookie offset and Python version are reported when PyInstaller is present.
- Findings distinguish the bootloader stub from the embedded Python payload.

## Pitfalls

- `.pyc` version mismatch breaking decompilation — match the interpreter version.
- Stripped/obfuscated bytecode (e.g., custom magic) needing header repair before decompiling.
- Encrypted PYZ archives (PyInstaller `--key`) requiring the key.

## References

- See [`references/api-reference.md`](references/api-reference.md) for the detector.
- PyInstaller archive and Python bytecode references (linked in frontmatter).

## Source & license

This open-source skill is cataloged on AgentStack and links to its original source — we do not rehost the code.

- **Author:** [meltedinhex](https://github.com/meltedinhex)
- **Source:** [meltedinhex/analyst-ai-pack](https://github.com/meltedinhex/analyst-ai-pack)
- **License:** Apache-2.0
- **Homepage:** https://meltedinhex.com/

Install and usage instructions live in the source repository linked above.

## Pricing

- **Free** — Free

## Security capabilities

Automated source analysis of v0.1.0 — what this tool can access:

- **Network access:** no
- **Filesystem access:** no
- **Shell / process execution:** no
- **Environment & secrets:** no
- **Dynamic code execution:** no

*"Yes" means the capability is present in the source — more access means more to trust, not that it is unsafe.*


## Versions

- **0.1.0** — security scan: passed — Imported from the upstream source.

## Links

- Listing page: https://agentstack.voostack.com/l/skill-meltedinhex-analyst-ai-pack-analyzing-compiled-python-malware
- Seller: https://agentstack.voostack.com/s/meltedinhex
- Browse the marketplace: https://agentstack.voostack.com/browse

---
Listed on AgentStack — the marketplace for AI agent skills and MCP servers. Every listing is security-reviewed. Creators keep 70%.