VioletWorm - game.exe

Basic Analysis

FLOSS was first run with -n 12 and then without any length filtering. Checking the filtered list first gives a quicker view of the output before moving on to a more detailed review.

Around line 100 of the FLOSS output there are indications that the file might be a compiled Python file:

1
Error on file.
2
Py_DecodeLocale
3
Py_IsInitialized
4
Py_PreInitialize
5
PyInitConfig_Create
6
PyInitConfig_Free
7
PyInitConfig_SetInt
8
PyInitConfig_SetStr

And around line 270 it hints at pyInstaller:

1
_pyinstaller_pyz
2
PYZ archive entry not found in the TOC!

At this point, it is worth checking whether the executable can be decompiled back into source code. This is done in two stages: unpacking the executable into compiled Python files and then decompiling the .pyc files into Python source code.

The extraction can be done using pyinstxtractor 1:

1
$ uv run -p 3.14 extractor.py e450b7efc8b429b618d2d22a074a3dd55c07b451eef315e0e20be7d9054ef18c.exe
2
[+] Processing e450b7efc8b429b618d2d22a074a3dd55c07b451eef315e0e20be7d9054ef18c.exe
3
[+] Pyinstaller version: 2.1+
4
[+] Python version: 3.14
5
[+] Length of package: 12344292 bytes
6
[+] Found 38 files in CArchive
7
[+] Beginning extraction...please standby
8
[+] Possible entry point: pyiboot01_bootstrap.pyc
9
[+] Possible entry point: pyi_rth_cryptography_openssl.pyc
10
[+] Possible entry point: pyi_rth_inspect.pyc
11
[+] Possible entry point: loader.pyc
12
[+] Found 164 files in PYZ archive
13
[+] Successfully extracted pyinstaller archive: e450b7efc8b429b618d2d22a074a3dd55c07b451eef315e0e20be7d9054ef18c.exe
14

15
You can now use a python decompiler on the pyc files within the extracted directory
16
remnux@remnux:~/malware/mallearn/python/exe$

The extraction had to be run twice: first with the default Python interpreter, which is 3.11 on this REMnux system, and then again with Python 3.14, as the script suggested, to avoid errors in the next step.

The first two levels of the unpacked directory structure are:

The most suspicious file is probably loader.pyc, although any of the files could be malicious.

Decompilation can be done with many tools; the most common is uncompyle6 2, but it does not support Python 3.14 at the moment, so depyo 3 was used instead (note that using it on REMnux may require upgrading the node version):

1
$ npx depyo e450b7efc8b429b618d2d22a074a3dd55c07b451eef315e0e20be7d9054ef18c.exe_extracted/loader.pyc
2
Processing /home/remnux/malware/mallearn/python/exe/e450b7efc8b429b618d2d22a074a3dd55c07b451eef315e0e20be7d9054ef18c.exe_extracted/decompiled/loader.py...
3
Processed 1 files in 0.082s. In: 864278 bytes (10506252.59 B/s). Out: 854535 bytes (10387815.68 B/s).

Before moving forward with the code analysis, pestudio shows that the sample has an overlay section. This section contains arbitrary data appended to the end of a PE file that is not mapped into memory when the program runs. pestudio automatically detects and analyzes this data because it is a common location for hiding malicious code or additional resources.

The overlay accounts for 98% of the overall file size, or around 11 MB. This is PyInstaller behavior rather than an additional payload, since the extractor specifies that 12,344,292 bytes of data were found in 38 CArchives.

Lastly, capa can be run to see what it detects. The most interesting findings here are data obfuscation and evasion.