[Autogenerated] there are legitimate scenarios where someone has built a
script in python and wants to make it run as a standalone executable One of
the reasons being that on Windows for example,
Python is not installed by default.
Well for this specific use case there is a solution called PI to E X C
which essentially allows you to package a python script into a
standalone executable You would be surprised but Attackers start taking
advantage of this technique to build malicious python scripts and have
them packaged as executable To reduce the chances of detection from an
analysis perspective, this requires us to decomp,
I'll executable to retrieve the python script.
One such tool that can be used to do this is called an compile to
get a better understanding of this workflow.
Please consider the following diagram.
An attacker crafts a malicious script, Then using part two EXC,
a standalone executable is created and using a solution such as un compiled,
can extract the python script for further analysis if you
wish to explore this topic further,
I have added the references for the pie to E X C and un
compiled modules working with large quantities of model
samples can become a challenging task.
A potential solution is called viper.
This is a binary analysis and management framework for marble samples,
exploits and scripts and it's available on GitHub I
encourage you to check it out for yourself to get a
broader view of the threat landscape,
you can make use of honeypots to capture and analyze muller
samples and Python can be of great use to build,
manage and monitor decoys and this can be decoy accounts,
decoy falls or decoy services I also wanted you to take note of
some of the important modules and tools that we've used so far as
well as the links where you can find more information about them
finalizing this module.
I want to do a quick summary of the important topics that we've covered.
We have analyzed malicious documents more precisely,
we identified indicators of compromise using Ole V B A which is
part of the old tools module we extracted the obfuscated V B A
script to conduct further analysis and also integrated all the
V B A into our script.
The next important topic which recovered was detecting packed
executable and we have achieved this by using the pdf file
module and codified two techniques,
1-based on the low number of imported the LLS and functions and
second based on the fall sections marked,
read, write and execute.
I hope you will continue on this Python for cyber defense learning path with
more courses on automation in some of the key info sec areas and with that
said I really want to thank you for your attention and interest and wish you
the best of luck in your journey