PyInstaller Bootloader

A small C or Win32 PE executable produced by PyInstaller --onefile. At runtime it:

1. Locates the CFFI archive appended past the PE sections (the "overlay").
2. Decompresses members with zlib/inflate to a temporary directory, typically %TEMP%\_MEI<XXXX>.
3. Loads an embedded Python DLL from that directory.
4. Resolves CPython C API functions via GetProcAddress and boots the interpreter.
5. Unmarshals and executes the embedded __main__.py bytecode.

From a defender's perspective, the outer binary is benign infrastructure with standard imports (KERNEL32, shell APIs, Python DLL). Threat activity is entirely inside the extracted Python payload.

Variants

• One-file mode: single PE with CFFI archive appended (this analysis).
• One-directory mode: a folder containing the bootloader plus already-extracted files; no overlay.
• Packed with UPX: some actors UPX the PyInstaller binary after build, adding another layer.

Cross-references

• python-packed-payload — the threat logic that lives inside the overlay
• coinminer — family that commonly uses this distribution method