PEframe is a open source tool to perform static analysis on Portable Executable malware and generic suspicious file. It can help malware researchers to detect packer, xor, digital signature, mutex, anti debug, anti virtual machine, suspicious sections and functions, macro and much more information about the suspicious files.
python3 peframe-cli.py <filename> Short output analysis
python3 peframe-cli.py -i <filename> Interactive mode
python3 peframe-cli.py -j <filename> Full output analysis JSON format
python3 peframe-cli.py -s <filename> Strings outputYou can edit config-peframe.json file in "config" folder to configure virustotal API key.
Prerequisites
python >= 3.6.6 pip3 libssl-dev swig
Download
git clone https://github.com/guelfoweb/peframe.git
Install using PyPI
pip3 install -r requirements.txt
Install on Debian/Ubuntu
bash install.sh
MS Office (macro) document analysis
PE file analysis
- Multinomial malware classification, research of the Department of Information Security and Communication Technology (NTNU) (SergiiBanin and Geir Olav Dyrkolbotn, Norway)
- SANS DFIR Poster 2016 (PEframe was listed in the REMnux toolkits)
- Tools for Analyzing Static Properties of Suspicious Files on Windows (SANS Digital Forensics and Incident Response, Lenny Zeltser).
- Automated Static and Dynamic Analysis of Malware (Cyber Defence Magazine, Andrew Browne, Director Malware Lab Lavasoft).
- Suspicious File Analysis with PEframe (eForensics Magazine, Chintan Gurjar)
- CERT FR Security Bulletin (PEframe was mentioned in the security bulletin CERTFR-2014-ACT-030)
- Infosec CERT-PA Malware Analysis (PEframe is used in the malware analysis engine of Infosec project)
This tool is currently maintained by Gianni 'guelfoweb' Amato, who can be contacted at guelfoweb@gmail.com or twitter @guelfoweb. Suggestions and criticism are welcome.