Package: pegreet
pegreetGreet your malware samples before you tear them apart.pegreetis a tool that performs static analysis and feature extraction on Portable Executable files. As a cli app, it should help with first steps in malware analysis / reverse engineering. As a library, it can be used to extract useful information from samples in bulk for use in exploratory data analysis or building malware classification models.Table of ContentsFeaturesScreenshotsInstallationResourcesNotesLicenseFeaturesImplementeddumpgeneral file informationcomputehashes(MD5, SHA1, SHA256, Imphash, SSDEEP)calculateentropydetectpackersvia PEiD signaturesdump info fromheadersdump info fromsectionsdumpimports and exportsannotatesuspicious Windows API functionsdisplay file parsingwarningsdisassemble codefrom entry pointfindstringscategorizestringsTo Dorecognizeknown malicious section namesannotatesuspicious entropyandsize mismatchesextractresourceslookup onVirusTotallookup forpublic sandbox reportscheck file againstYARArulescheckdigital signaturesortstringswithStringSifterextractobfuscated stringswithFLOSScustom output(csv, json, markdown)ScreenshotsInstallationas a module<virtual environment shenanigans>pip install pegreetas a cli apppipx install pegreetUsageas a modulefrom pathlib import Path
import pegreet

pe = pegreet.load(Path('data/samples/petya.exe'))

info_data = pegreet.info(pe)
print(info_data)
print(pegreet.pretty_info(info_data))

strings_data = pegreet.find_strings(pe)
print(strings_data)
print(pegreet.pretty_strings(strings_data))

print(pegreet.disasm(pe, num_lines=40))as a cli app$ pegreet --help

 Usage: pegreet [OPTIONS] COMMAND [ARGS]...

╭─ Options ───────────────────────────────────────────╮
│ --help                        Show this message and │
│                               exit.                 │
╰─────────────────────────────────────────────────────╯
╭─ Commands ──────────────────────────────────────────╮
│ disassemble  disassemble a specified number         │
│              instructions from entry point          │
│ info         print useful info                      │
│ strings      print strings                          │
╰─────────────────────────────────────────────────────╯


$ pegreet info data/samples/petya.exe
...


$ pegreet strings --show-uncategorized data/samples/petya.exe
...


$ pegreet disassemble data/samples/petya.exe 40
...NotesI started this project in 2020 in an attempt to learn about PE files and feature extraction for use in malware data science.There are many other (better) tools available that implement similar functionality (see below). What I tried to do withpegreetis to focus on only the features that are useful to malware analysis to make it easier to digest the information.pegreetalso provides annotations for suspicious indicators that can be used as jumping points for an investigation.Thepefilelibrary was used extensively to implement the parsing of PE files. I would like to explore using theLIEFproject instead as it supports multiple executable formats and it was used in theEMBERdataset. Maybe I'll follow this project up with an 'ELFgreet'.ResourcesSimilar Toolspefile- python library for reading PE infopeframe- PE analysis toolPEpper- PE analysis toolPEcli- PE analysis toolPPEE- PE analysis toolPE Studio- PE analysis toolpev- PE analysis toolpecheck- PE analysis toolPE-bear- PE analysis toolPE-sieve- scans live PEs for suspicious indicators and dumpsPE_unmapper- convert dump to rawIAT Patcher- IAT editorPE file infocorkami PE101andPE102- fantastic visualizationscorkami PE wiki- lots of infocorkami PE POCs- cool/weird stuffPE format layout graph- nice visualizationPE format walkthrough- overlay of PE format on raw hexPE Format- PE documentation by MSAn In-Depth Look into the Win32 Portable Executable File Format Part 1andPart 2- writeups by MSLicensepegreetis distributed under the terms of any of the following licenses:Apache-2.0MIT