PDFly Variant Uses Custom PyInstaller Tweaks to Obfuscate Payload, Thwarting Analysis

A researcher dissected two related PyInstaller-packaged droppers—PDFly and PDFClick—that deliberately alter the PyInstaller stub (changing the overlay "cookie") and apply a custom two-stage XOR + zlib encryption to hide embedded Python bytecode. Standard extractors failed, so the analyst patched pyinstxtractor-ng, removed nonessential assertions, incorporated the custom decryption sequence, and developed a generic scanner to recover custom cookies and XOR keys, enabling payload recovery and deeper behavioral analysis.