import sys import ast import zlib import base64 import marshal if len(sys.argv) < 2: sys.exit(1) path = sys.argv[1] malware = open(path, "r") x = malware.read() malware.close() def iteration(x, i): if i >= 10: return iteration2(x,i) eval_str = ast.parse(x).body[1].value.args[0].value bytes_payload = ast.parse(eval_str).body[0].value.args[0].args[0].value output = marshal.loads(zlib.decompress(base64.b85decode(bytes_payload[::-1]))) # if type(output) == bytes: # filename = str(i) + ".py" # f = open(filename, "w") # f.write(output.decode()) # f.close() # else: # print(output) return iteration(output, i + 1) def iteration2(x,i): if i >= 400: return x if i >= 11: eval_str = ast.parse(x).body[0].value.args[0].args[0].value else: eval_str = ast.parse(x).body[1].value.args[0].args[0].value output = zlib.decompress(base64.b64decode(eval_str[::-1])) # if type(output) == bytes: # filename = str(i) + ".py" # f = open(filename, "w") # f.write(output.decode()) # f.close() # else: # print(output) return iteration2(output, i+1) sc = iteration(x,1) print(sc.decode()) # output = open("source.py", "w") # output.write(sc.decode()) # output.close() # print(ast.dump(ast.parse(sc), indent=4))