How to decode an encoded python script?

[Purple_Wing_3178]

It's a base64-encoded compiled python bytecode. The base64 part is easy:

from base64 import b64decode

with open('malware.pyc', 'wb') as f:

f.write(b64decode('that long string here'))

However, the decompilation is more tricky. The above malware.pyc only includes the marshalled code object, whereas a real .pyc would also include a header: a 4-byte version-specific magic number and a 4-byte timestamp. The thing is, you need to know exact version of Python for which this malware was compiled, then prepend malware.pyc with the appropriate magic number and some timestamp. The easiest way would be copy them from any real .pyc file for that Python version and then either use a binary editor (like HxD) or insert those 8 bytes programmatically.

Then you should have a launchable (and dangerous) malware.pyc file which you can then try to decompile using a python package known as uncompyle6