This script analyzes MZ-PE (MS-DOS) executable.
Project description
Program Executable Analyzer
Description
This script analyzes MZ-PE (MS-DOS) executable file.
This tool is useful for malware analysis or debug/understand compiled dependencies.
- Verify signature and print informations about signature and trust
- Analyze DLLs and imported functions name
- Analyze exported functions name
- Get executable filename at the compiled time
- Get encodings and languages used for compilation
- Print informations about rich headers
- Get timestamps saved in executable
- Print informations about sections and characteristics (permissions, ect...)
- Print the entry point position and section
- Get architecture, system version, resources (Version file, Manifest)
- Get company name, product name, product version, copyright
- Sections names, sizes, addresses and characteristics
- Analyze MS-DOS and NT headers
- When matplotlib is installed, generate charts to compare sections on the disk and in the memory
- When matplotlib and EntropyAnalysis are installed, generate charts for entropy analysis (with sections)
- Extract overlay
TODO: analyze results to detect language and score the risk.
Requirements
- python3
- Python 3 Standard library
Optional
- matplotlib
- EntropyAnalysis
Matplotlib and EntropyAnalysis are not installed by ProgramExecutableAnalyzer because this package can be installed on server without GUI.
You can install optinal required packages with the following command:
python3 -m pip install matplotlib EntropyAnalysis
Installation
pip install ProgramExecutableAnalyzer
Usages
python3 ProgramExecutableAnalyzer.py -h
python3 ProgramExecutableAnalyzer.py executable.exe
python3 ProgramExecutableAnalyzer.py -c executable.exe # No color
python3 ProgramExecutableAnalyzer.py -v executable.exe # Verbose mode
Screenshots
Links
Licence
Licensed under the GPL, version 3.
Project details
Release history Release notifications | RSS feed
Download files
Download the file for your platform. If you're not sure which to choose, learn more about installing packages.
Source Distribution
Close
Hashes for ProgramExecutableAnalyzer-1.0.1.tar.gz
Algorithm | Hash digest | |
---|---|---|
SHA256 | f36d33ec6c571d8b63525d4a1d6ef9c0b670d157b83d1cfdd64feb667b7708fb |
|
MD5 | b5c025da62ac6a45abd56e329b8c9aec |
|
BLAKE2b-256 | 5147fbf76e8c9bc8bac0669b6ab3f64417f8a2aad3f0bcb1c5fc9f1304f7ab6a |