pe_analysis.py

'''          Windows Portable Executable Format Analysis

Malware Data Science Notes

Description:  Uses pefile to examine the PE Format.

usage example from command line: python3 pe_analysis.py ircbot.exe
(make sure script is in same folder to analyze)

pip3 install pefile


Author: N.Sepe
License: MIT License

'''

import pefile
import sys
import os

class LoopArgs:
    def __init__(self, *args, **kwargs):
        number_args = []
        self.args = number_args.append((args,kwargs))
        self.program_name = sys.argv[0]


    def analyze_sections(self, file):
        print("Analyzing Windows Portable Executable Format sections...")
        file = file
        pe = pefile.PE(file)
        for section in pe.sections:
            print(section.Name, hex(section.VirtualAddress),
            hex(section.Misc_VirtualSize), section.SizeOfRawData )

    def number_args(self):
       
        args=[]
        i = 0
        for name in sys.argv[1:]:
            args.append(name)
        if len(args) > 0:
            for command in args:
                print(f"arg{i} = {command}")
                i+=1
        return args

    def run_args(self):
        analyze_sections = self.analyze_sections
        args=[]
        i = 0
        for name in sys.argv[1:]:
            args.append(name)
        if len(args) > 0:
            for command in args:
                if command[-4:] == ".exe":
                    print(f"Found a .exe: {command}")
                    self.analyze_sections(command)
                else:
                    print(f"Did not analyze {command}, it is not a .exe")

    def list_DLLs(self, file=sys.argv[1]):
        # Use pefile to list the DLLs a binary will load and function calls in the DLLs
        print("\nPrinting the DLLs...")
        file = file
        pe = pefile.PE(file)
        for entry in pe.DIRECTORY_ENTRY_IMPORT:
            print(entry.dll)
            for function in entry.imports:
                print(f"\t {function.name}")

    

if __name__ == "__main__":
    a = LoopArgs()
    a.number_args()
    a.run_args()
    a.list_DLLs()