Binary facades: script extraction from compiled macOS malware

Binary Facades: Script Extraction from Compiled macOS Malware

Speakers: Patrick Wardle, Founder (Objective-See), Mac Security Components (W)

Conference: Virus Bulletin

YouTube: https://www.youtube.com/watch?v=bMXnhAdL_Vs

Overview

In this insightful talk, "Binary facades: script extraction from compiled macOS malware," renowned macOS security researcher Patrick Wardle of Objective-See and W delves into a common, yet often misunderstood, technique employed by malware authors: wrapping malicious scripts within seemingly compiled binaries. Wardle highlights how adversaries package scripts (like JavaScript, Python, or Bash) into native macOS executables or application bundles, often to circumvent traditional analysis methods and improve distribution success. The core message of the presentation is to empower malware analysts with efficient strategies to identify these "script-wrapped binaries" and extract their underlying malicious payloads, thereby sidestepping time-consuming and often fruitless binary reverse engineering.

Wardle argues that a significant amount of analyst time is wasted attempting to reverse engineer benign loader executables when the true malicious logic resides in an easily extractable script. By focusing on identifying the specific developer tools abused by malware authors for packaging, analysts can quickly recover the original human-readable script. This approach not only accelerates analysis but also ensures that the actual malicious intent is uncovered, leading to more accurate threat intelligence, signatures, and defensive strategies.

The presentation provides a practical guide, complete with specific examples and tools, for rapidly triaging macOS malware that employs this technique. Wardle emphasizes working smarter, not harder, by leveraging knowledge of common packaging methods to extract scripts, which are inherently easier to analyze than compiled binary code. This talk is crucial for anyone involved in macOS threat intelligence, incident response, or malware analysis, offering actionable techniques to enhance efficiency and effectiveness.

Background

▶ Watch: Introduction: Avoiding reverse engineering compiled script malware (0:00)

The landscape of malware analysis often begins with classifying an unknown file as benign, known malicious, or unknown malicious. While known malicious files can often be quickly triaged with existing signatures, unknown malicious files demand in-depth analysis. Traditionally, if an unknown file is a compiled executable, analysts would reach for complex binary analysis tools like disassemblers and decompilers. However, this approach can be incredibly time-consuming and, as Wardle illustrates, often unnecessary when dealing with a specific class of malware: script-wrapped binaries.

This problem arises because many malware authors, particularly those with less experience (often referred to as "script kiddies"), find it easier to write malicious logic in scripting languages like Python, Bash, or JavaScript. These scripts are often cross-platform, making them versatile for targeting multiple operating systems. However, distributing raw scripts to macOS users presents a challenge: users typically lack the technical knowledge or willingness to execute scripts via the terminal, especially when dealing with dependencies or environment issues. To overcome this, malware authors abuse legitimate developer tools (e.g., Platypus, PyInstaller, Electron, Tauri, OSA compile) to package their scripts into native macOS executables or application bundles. This makes the malware appear as a standard application, increasing the likelihood of execution by an unsuspecting user.

The key issue for analysts is that these executables often act merely as "execution hosts" or "loaders" for the embedded script. If an analyst treats such a binary as a traditional compiled executable and attempts to reverse engineer its machine code, they would primarily be analyzing the benign, legitimate code of the packaging tool's loader. This not only wastes valuable time but also risks generating inaccurate signatures based on benign components, potentially leading to false positives. The real malicious logic, often in human-readable script form, would be overlooked. Therefore, understanding the prevalence and mechanics of script-wrapped binaries is critical for effective and efficient macOS malware analysis.

Key Findings

▶ Watch: Platypus example: Creative Update supply chain attack (8:30)

The central finding of this talk is that a significant portion of macOS malware is not originally written in compiled languages but rather in scripting languages, subsequently wrapped into executables using legitimate developer tools. Wardle demonstrates that by identifying the specific packaging tool used, analysts can bypass complex binary reverse engineering and directly extract the underlying scripts, which are far easier and quicker to analyze. This paradigm shift from binary analysis to script analysis for a specific class of macOS threats leads to several key discoveries:

1. Prevalence of Script-Wrapped Binaries: Malware authors frequently leverage tools like Platypus, PyInstaller, Electron, Tauri, and OSA compile to distribute scripts as native macOS applications, primarily for ease of distribution and execution by end-users.
2. Inefficiency of Traditional RE: Attempting to reverse engineer the compiled loader of a script-wrapped binary is often a waste of time, as the loader itself is usually benign and only serves to execute the embedded script. Signatures created from such loaders would be ineffective or prone to false positives.
3. Tool-Specific Identification and Extraction: Each packaging tool leaves unique artifacts (e.g., specific file structures, strings, linked frameworks, symbols) that allow for its identification. Crucially, each tool also embeds or stores the script in a distinct manner, requiring specific extraction techniques.
4. Accelerated Analysis: Once extracted, scripts are human-readable, making their analysis trivial compared to machine code. This dramatically reduces the time required to understand malware functionality, identify indicators of compromise (IOCs), and develop accurate signatures.
5. Bypassing Obfuscation and Anti-Analysis: While compilation into a binary can be a form of obfuscation, the underlying script is often un-obfuscated. Furthermore, understanding the script's logic (e.g., anti-VM checks in Electron apps) allows analysts to bypass such defenses for dynamic analysis.

Wardle's presentation effectively shifts the focus from "how to reverse engineer the binary" to "how to unwrap the script," demonstrating that this approach is not only more efficient but also more effective at revealing the true malicious intent of the malware.

Technical Deep Dive

▶ Watch: Identifying and extracting Python bytecode from PI installer (16:40)

The core of Wardle's methodology lies in a systematic approach to identifying and extracting scripts from various types of script-wrapped macOS binaries. This involves recognizing the unique fingerprints left by common legitimate developer tools abused by malware authors.

1. Platypus

Platypus is an open-source tool that takes a Bash script and packages it into a native macOS application bundle.

• Identification:
• Presence of script exec classes and script exec controller in disassembly.
• The most reliable indicator: an application bundle containing a script file within its Contents/Resources directory. This file holds the original Bash script.
• Extraction: No complex extraction is needed. The script file is directly available in plain text within the application bundle. Analysts can simply open this file with a text editor to analyze the malicious Bash commands.
• Example: The Creative Update supply chain attack malware and the Eleanor malware both utilized Platypus. In both cases, the malicious logic was found in the Contents/Resources/script file, making analysis straightforward.

2. PyInstaller

PyInstaller packages Python scripts into standalone executables, including macOS binaries.

• Identification:
• Disassembly reveals calls to py main.
• Running strings on the binary will show numerous strings related to "PyInstaller."
• Extraction: PyInstaller compiles the Python script into Python bytecode (.pyc files) and embeds it within the executable.
• First, use a tool like PI inst Extractor to extract the embedded bytecode from the PyInstaller binary.
• Second, use a Python decompiler (e.g., uncompile 6 module, online decompilers) to convert the extracted .pyc bytecode back into human-readable Python source code.
• Example: The Gravity Rat malware was identified as a PyInstaller-wrapped binary. Extracting and decompiling its bytecode revealed the original Python logic.

3. Electron

Electron is a framework for building cross-platform desktop applications using web technologies (HTML, CSS, JavaScript). Malware authors use it to wrap JavaScript-based malware.

• Identification:
• The application bundle will have a dependency on the Electron.framework (visible in the Frameworks directory or by dumping dependencies with ool).
• Extraction: Electron compresses and embeds the JavaScript scripts directly into the application.
• Use the npx utility (part of npm) against the Electron application. npx will extract the embedded scripts into an output directory.
• Look for files like main.js within the extracted content.
• Example: Another variant of Gravity Rat was distributed as an Electron application. Extracting main.js revealed anti-VM logic and persistence mechanisms (e.g., cron job setup) in clear JavaScript. This highlights the importance of extraction, as the anti-VM logic could prevent dynamic analysis in a sandbox.

4. Tauri

Tauri is a framework similar to Electron, allowing developers to build cross-platform desktop applications using web technologies, but it uses Rust for the backend.

• Identification:
• strings output will contain many Tauri-related symbols and strings.
• Disassembly will show class names and methods related to Tauri.
• Extraction: Tauri embeds scripts directly into the executable, often compressing them.
• Wardle noted that ChatGPT identified the compression algorithm as brley.
• A custom Python script can be written to iterate through the binary, identify embedded JavaScript strings, and then decompress them using a Python library that implements the brley algorithm.
• Example: The Rusty Adder malware, attributed to North Korean actors, used Tauri. After extraction and brley decompression, the JavaScript revealed unusual behavior: fetching an application property named "test" and executing it. Further investigation using the X adder utility (which dumps extended attributes on macOS) showed the malicious logic for downloading a second-stage payload stored as an extended attribute in plain text.

5. OSA compile

OSA compile is an Apple utility used to compile AppleScript (a macOS scripting language) into native executables or run-only scripts.

• Identification:
• Presence of a script named main.scpt (either run-only or compiled AppleScript).
• Disassembly of the main binary will show logic related to executing AppleScript.
• Extraction: OSA compile converts human-readable AppleScript into an intermediate binary format.
• Unlike Platypus, simply viewing main.scpt might not yield readable code if it's compiled.
• Specialized AppleScript disassemblers are required to convert this intermediate format back into a reconstructable form.
• Further decompilation may be necessary to obtain the original human-readable AppleScript. Phil Stokes at SentinelOne was cited for his work on this.
• Example: The OSA Minor malware was an OSA compile-wrapped AppleScript. Decompiling it revealed persistence mechanisms, such as writing a property list.

In summary, the technical deep dive underscores that successful analysis of script-wrapped macOS malware hinges on accurately identifying the packaging tool and then applying the correct tool-specific extraction or decompilation method. This targeted approach avoids the pitfalls and inefficiencies of generic binary reverse engineering, directly leading to the malicious script.

Demo / Proof of Concept

▶ Watch: Tori and OSA Compile: Extracting embedded and compiled scripts (22:15)

Patrick Wardle's talk effectively serves as a series of demonstrations and proofs of concept, illustrating the practical application of his methodology against real-world macOS malware samples. Rather than a single, continuous demo, each section dedicated to a specific packaging tool (Platypus, PyInstaller, Electron, Tauri, OSA compile) functions as a mini-demonstration of how to identify and extract scripts.

For Platypus, Wardle showcased the Creative Update malware (involved in a supply chain attack) and Eleanor. He demonstrated that by simply navigating to the Contents/Resources/script path within the application bundle, the plain-text Bash script containing the malicious logic (downloading and executing further components) was immediately accessible. This visually confirmed that no complex reverse engineering of the main executable was necessary.

When discussing PyInstaller, the Gravity Rat malware was used. The demonstration involved showing how strings output on the compiled binary quickly revealed "PyInstaller" artifacts. The subsequent steps, conceptually demonstrated through slides, involved using a tool like PI inst Extractor to get the Python bytecode, and then a Python decompiler to reconstruct the original, human-readable Python script. This illustrated how a multi-step process could still be far more efficient than binary analysis.

The Electron section again used a variant of Gravity Rat. Wardle demonstrated the identification via the Electron.framework dependency. The extraction process was then conceptually shown using the npx utility, leading to the discovery of main.js. The content of main.js was presented, revealing anti-VM logic and persistence mechanisms (cron job), highlighting the direct access to critical malicious functionality.

For Tauri, the Rusty Adder sample was analyzed. This segment served as a proof of concept for dynamic identification and extraction. Wardle described how strings would reveal Tauri artifacts. He then detailed the process of using a custom Python script that leverages a brley decompression library to extract and decompress embedded JavaScript. The resulting JavaScript was presented, showing its unique method of retrieving and executing malicious logic from an extended attribute, which was then confirmed using the X adder utility.

Finally, with OSA compile, the OSA Minor sample was used to illustrate the challenge of compiled AppleScript. While not a direct "grab the script" demo, it served as a proof of concept for the need of specialized AppleScript disassemblers and decompilers (citing Phil Stokes' work) to reconstruct the original script and reveal persistence mechanisms.

Throughout these examples, the common thread was the rapid identification of the packaging method, followed by a targeted, often simple, extraction technique to obtain the human-readable malicious script, thereby proving the efficiency and effectiveness of Wardle's proposed approach over traditional binary reverse engineering.

Defensive Implications

▶ Watch: Talk summary: Identify builder, extract script, analyze easily (27:00)

The insights provided by Patrick Wardle's talk have profound implications for security defenders, shifting the focus from generic binary analysis to informed script extraction. Understanding these techniques can significantly enhance detection, analysis, and response capabilities for macOS malware.

1. Prioritize Script Extraction: Defenders should integrate script identification and extraction as a primary step in their macOS malware triage process. When an unknown executable is encountered, the initial analysis should aim to determine if it's a script-wrapped binary before resorting to time-consuming binary reverse engineering. This means malware analysts should be proficient with tools like strings, ool, npx, and potentially custom scripts for specific compression algorithms.
2. Enhance Static Analysis Signatures: Instead of creating signatures (e.g., Yara rules) based on the often benign loader components of packaging tools, defenders should focus on creating signatures that target the extracted malicious scripts. These script-based signatures are more precise, less prone to false positives, and more resilient to minor changes in the packaging tool's loader code.
3. Improve Dynamic Analysis Strategies: Awareness of anti-analysis techniques embedded directly in scripts (e.g., anti-VM checks in Electron apps) allows defenders to implement specific bypasses or adjust their sandbox environments to ensure the malware executes its full payload. Recovering the script beforehand provides the necessary intelligence to set up effective dynamic analysis.
4. Educate and Train Analysts: Security teams specializing in macOS should ensure their analysts are well-versed in the common script-packaging tools (Platypus, PyInstaller, Electron, Tauri, OSA compile) and their respective identification and extraction methodologies. This specialized knowledge is crucial for efficient incident response.
5. Leverage Open-Source Tools and Community Knowledge: The talk highlights several open-source tools (e.g., PI inst Extractor, npx) and community resources (e.g., uncompile 6, Phil Stokes' research). Defenders should integrate these into their analysis workflows and contribute to the shared knowledge base.
6. Focus on Behavioral Detection: While static script analysis is powerful, behavioral detection remains critical. Even if the initial binary is a benign wrapper, monitoring for the execution of the embedded script, its network connections, file system modifications, and persistence mechanisms will catch the malicious activity. The extracted script's content can inform what specific behaviors to look for.
7. Consider Supply Chain Risks: The "Creative Update" example demonstrates how legitimate tools abused by malware can be part of supply chain attacks. Defenders should be vigilant about unexpected or untrusted application bundles, even if they appear to use common frameworks.

By adopting these defensive strategies, organizations can significantly improve their ability to rapidly detect, analyze, and respond to macOS malware that employs script-wrapping techniques, ultimately strengthening their overall security posture.

Key Takeaways

• Prioritize Script Extraction: For macOS malware, always first try to determine if a binary is merely a wrapper for an embedded script. If so, prioritize extracting and analyzing the script over reverse engineering the compiled binary.
• Identify the Packaging Tool: Different legitimate developer tools (e.g., Platypus, PyInstaller, Electron, Tauri, OSA compile) are abused by malware authors. Each leaves unique fingerprints (file paths, strings, frameworks) that help identify it.
• Apply Tool-Specific Extraction: The method for extracting the malicious script varies depending on the packaging tool. Learn the specific techniques for each (e.g., direct file access for Platypus, PI inst Extractor for PyInstaller, npx for Electron, custom decompression for Tauri, disassemblers for OSA compile).
• Leverage Script Readability: Extracted scripts are human-readable, making analysis significantly faster and easier than compiled binary code. This leads to quicker understanding of malware functionality and more accurate IOC generation.
• Avoid Wasted Effort: Do not waste time reverse engineering benign loader code. Focusing on the script saves time and prevents the creation of ineffective or problematic signatures based on legitimate components.
• Enhance Detection and Response: By understanding these techniques, defenders can create more precise signatures, bypass anti-analysis measures, and develop more effective strategies for macOS malware detection and incident response.

About the Speaker(s)

Patrick Wardle is a prominent figure in the macOS security research community. He is the founder of the Objective-See Foundation, an organization dedicated to creating free, open-source macOS security tools. In addition to his work with Objective-See, Wardle is involved with W, where he contributes to building Mac security components for enterprise tools. He is also the author of "The Art of Mac Malware" book series, which he makes 100% free online, with all royalties from purchased copies donated to the Objective-See Foundation. Wardle is known for his deep expertise in macOS internals, malware analysis, and his commitment to sharing knowledge through public talks, tools, and educational resources.