This is a YARA rule to detect PE files that were created with PyInstaller (a tool to convert Python programs to binary executables).
More info in my ISC Diary entry: Python Malware – Part 1.
/*
Version 0.0.1 2016/05/14
Source code put in public domain by Didier Stevens, no Copyright
https://DidierStevens.com
Use at your own risk
Shortcomings, or todo's ;-) :
History:
2016/05/14: start
*/
import "pe"
rule PE_File_pyinstaller
{
meta:
author = "Didier Stevens (https://DidierStevens.com)"
description = "Detect PE file produced by pyinstaller"
strings:
$a = "pyi-windows-manifest-filename"
condition:
pe.number_of_resources > 0 and $a
}
yara-rules-V0.0.8.zip (https)
MD5: 83D10B0A18D3F8E2C744B8FEA10F5E67
SHA256: 2D47165757F909440F6D1A95FF5C0EA1355B355AE7475D2A0CF821D3B9A6235A
Didier Stevens 