PDFly Variant Uses Custom PyInstaller Modification, Forcing Analysts to Reverse-Engineer Decryption
A newly identified variant of the PDFly malware has been detected, employing sophisticated techniques that complicate standard analysis methods. This malware utilizes a modified PyInstaller executable, which inhibits the function of conventional…
A newly identified variant of the PDFly malware has been detected, employing sophisticated techniques that complicate standard analysis methods. This malware utilizes a modified PyInstaller executable, which inhibits the function of conventional extraction tools.
This modification poses challenges for security teams attempting to analyze the code and comprehend the threat's mechanics. The altered version modifies key identifiers and encrypts Python bytecode with multiple protective layers, necessitating a manual reverse-engineering process for decryption.
The modified PyInstaller stub includes corrupted strings and uses a custom magic cookie value distinct from standard implementations. This prevents automated tools such as PyInstxtractor from identifying the file structure.
Samplepedia analysts identified the encryption scheme through an in-depth investigation of the malware's internal components. When standard extraction tools failed to process the executable, researchers resorted to disassemblers to locate the modified elements.
A newly identified variant of the PDFly malware has been detected, employing sophisticated techniques that complicate standard analysis methods.
The investigation determined that the encryption was embedded not in the PyInstaller stub itself but in separate bootstrap files that manage archive extraction during runtime. The malware developers employed a complex encryption algorithm to guard the PYZ archive contents against analysis.
Decryption Process and Technical Implementation
The encryption algorithm follows a specific sequence that must be reversed to access the malicious code. Initially, the archived data undergoes XOR decryption using a 13-byte key labeled SCbZtkeMKAvyU. The outcome is then subjected to zlib decompression to restore the original file structure. A second XOR operation applies a 7-byte key named KYFrLmy for further data obfuscation. Finally, the bytes are reversed before Python's marshal module processes them into executable code objects.
Security researchers have developed a generic extractor tool capable of handling multiple variants with differing encryption keys. This tool automatically searches for valid cookie structures in the PE overlay, validating them by checking package length, table-of-contents offset, and Python version fields. Upon locating these structures, the extractor parses the pyimod01_archive.pyc bytecode to extract XOR keys from generator expressions within the ZlibArchiveReader class, facilitating automated decryption of future samples.
Based on reporting by Cyber Security News.