WCU / Cybersecurity
~/CSC 471/Class 04/KP 16
Class 04 · KP 16 / 20

A Tiny pefile Snippet

import pefile

pe = pefile.PE("sample.exe")

# Bitness and entry point
print(hex(pe.OPTIONAL_HEADER.Magic))            # 0x10b or 0x20b
print(hex(pe.OPTIONAL_HEADER.AddressOfEntryPoint))
print(hex(pe.OPTIONAL_HEADER.ImageBase))

# Sections: name, virtual size, raw size, entropy
for s in pe.sections:
    name = s.Name.rstrip(b"\x00").decode(errors="replace")
    print(name, hex(s.Misc_VirtualSize),
          hex(s.SizeOfRawData), round(s.get_entropy(), 2))

# Imports (capability hints)
for entry in pe.DIRECTORY_ENTRY_IMPORT:
    print(entry.dll.decode())
    for imp in entry.imports:
        print("   ", imp.name)

# imphash for clustering
print("imphash:", pe.get_imphash())