Threat Level: green Handler on Duty: Yee Ching Tok

SANS ISC: py2exe Decompiling - Part 2 SANS ISC InfoSec Forums

Watch ISC TV. Great for NOCs, SOCs and Living Rooms:

Sign Up for Free!   Forgot Password?
Log In or Sign Up for Free!
py2exe Decompiling - Part 2

In Diary entry py2exe Decompiling - Part 1 we took a quick look at py2exe files.

How can we identify an .exe file generated by py2exe? A quick test is to check if the PE file has a resource PYTHONSCRIPT. I developed a YARA rule for this.

Of course, this YARA rule just detects if a PE file was created with py2exe. It doesn't identify the sample as malware, there are legitimate py2exe applications too.


As mentioned in part 1, unpy2exe supports Python 2, not Python 3.

For Python 3, you can use program decompile-py2exe.

Please post a comment mentioning the py2exe analysis tools you like to use.

Didier Stevens
Microsoft MVP Consumer Security


597 Posts
ISC Handler
Jan 30th 2017

Sign Up for Free or Log In to start participating in the conversation!