Skip to content

Instantly share code, notes, and snippets.

@pierrehpezier
pierrehpezier / python_FEEDFACE_extraction.py
Created April 17, 2025 12:15
Python interpreter FEEDFACE extraction
"""
RC4 Decryption Utility for Malicious Payload Extraction
"""
import sys
import pathlib
import binascii
from Cryptodome.Cipher import ARC4
def main():
if len(sys.argv) != 3:
import struct
import magic
from PIL import Image
import sys
img = Image.open(open(sys.argv[1], "rb"))
img_data = b""
for x in range(img.width):
if len(img_data) >= 2 and not img_data.startswith(b"MZ"):
print("Not a valid PE file")