Class 04 · KP 16 / 20
A Tiny pefile Snippet
import pefile
pe = pefile.PE("sample.exe")
# Bitness and entry point
print(hex(pe.OPTIONAL_HEADER.Magic)) # 0x10b or 0x20b
print(hex(pe.OPTIONAL_HEADER.AddressOfEntryPoint))
print(hex(pe.OPTIONAL_HEADER.ImageBase))
# Sections: name, virtual size, raw size, entropy
for s in pe.sections:
name = s.Name.rstrip(b"\x00").decode(errors="replace")
print(name, hex(s.Misc_VirtualSize),
hex(s.SizeOfRawData), round(s.get_entropy(), 2))
# Imports (capability hints)
for entry in pe.DIRECTORY_ENTRY_IMPORT:
print(entry.dll.decode())
for imp in entry.imports:
print(" ", imp.name)
# imphash for clustering
print("imphash:", pe.get_imphash())