PDFly Variant Uses Custom PyInstaller Tweaks to Obfuscate Payload, Thwarting Analysis
## Cybersecurity: Analysis of PDFly Malware
Cybersecurity: Analysis of PDFly Malware
A newly identified malware variant, termed "PDFly," utilizes a significantly modified PyInstaller stub to conceal its Python bytecode. This modification requires analysts to reverse-engineer a custom decryption routine before conducting any substantial analysis.
A related sample, "PDFClick," exhibits similar behavior, suggesting the existence of a small group of PyInstaller-based droppers designed to disrupt standard analysis tools.
Both "PDFly" and "PDFClick" are distributed as executables packaged with PyInstaller. Typically, analysts use tools like pyinstxtractor-ng to extract the embedded Python modules. However, in these cases, the extractor does not recognize the files as PyInstaller executables due to an altered "magic" cookie in the overlay.
Upon inspection with IDA Pro, it was found that the stub's strings were partially corrupted and the cookie value was modified in memory.
To address these challenges, a researcher modified pyinstxtractor-ng by replacing the script's expected magic value with the custom cookie found in the modified stub. Furthermore, an assertion checking for the "PYZ\0" marker within the package was removed, as it was unnecessary for extraction. Despite these modifications, the contents of the PYZ archive remained encrypted.
A newly identified malware variant, termed "PDFly," utilizes a significantly modified PyInstaller stub to conceal its Python bytecode.
Static inspection using tools like CAPA and IDAScope did not reveal any encryption routines within the stub, indicating that decryption was implemented elsewhere. The analysis shifted focus to the bootstrap and pyimod modules, which were not encrypted and could be decompiled.
Using PyLingual, the researcher processed Python 3.13 bytecode from pyimod01_archive.pyc and discovered a custom two-stage XOR scheme wrapped around zlib decompression. The disassembly showed an XOR operation with a 13-byte key followed by zlib decompression and a second XOR operation with a 7-byte key before reversing and unmarshalling.
By incorporating this sequence into pyinstxtractor-ng, the analyst successfully extracted and decrypted the embedded Python bytecode from both PDFly and PDFClick.
Given the variations in cookies and XOR keys across samples, a more generic extractor was developed. This tool scans the PE overlay to identify possible PyInstaller cookies by validating length fields and table-of-contents offsets, dynamically recovering the magic value.
Additionally, a routine parses pyimod01_archive.pyc with Python's marshal module, explores the ZlibArchiveReader.extract method, and automatically extracts XOR keys from <genexpr> constants.
These enhancements allow the modified script to adapt to various PyInstaller-modified samples, effectively recovering their encrypted Python payloads and facilitating further behavioral analysis of PDFly and related threats.
Based on reporting by GBHackers.