PEframe is a open source tool to perform static analysis on (portable executable) malware.
Python
Latest commit dcb0754 Mar 8, 2016 @guelfoweb 5.0.1 bug fix
Permalink
Failed to load latest commit information.
peframe 5.0.1 bug fix Mar 8, 2016
CHANGELOG.rst 5.0.1 bug fix Mar 8, 2016
README.rst 5.0.1 bug fix Mar 8, 2016
setup.py 5.0.1 bug fix Mar 8, 2016

README.rst

PEframe 5.0.1

PEframe is a open source tool to perform static analysis on Portable Executable malware and generic suspicious file. It can help malware researchers to detect packer, xor, digital signature, mutex, anti debug, anti virtual machine, suspicious sections and functions, and much more information about the suspicious files.

Documentation will be available soon.

Usage

$ peframe <filename>            Short output analysis

$ peframe --json <filename>     Full output analysis JSON format

$ peframe --strings <filename>  Strings output

You can edit stringsmatch.json file to configure your fuzzer and virustotal apikey.

Output example

Short data example | Full data (JSON) example

Simple schema

{
        "peframe_ver": string,
        "file_type": string,
        "file_name": string,
        "file_size": int,
        "hash": dict,
        "file_found": dict,
        "url_found": list,
        "ip_found": list,
        "virustotal": dict,
        "fuzzing": list,
        "pe_info": {
                "compile_time": string,
                "dll": bool,
                "sections_number": int,
                "sections_info": list,
                "xor_info": dict,
                "detected": list,
                "directories": list,
                "sign_info": dict,
                "packer_info": list,
                "mutex_info": list,
                "antidbg_info": list,
                "antivm_info": list,
                "apialert_info": list,
                "meta_info": dict,
                "import_function": list,
                "export_function": list,
                "resources_info": list
        }
}

Install

Prerequisites

Python 2.7.x

Install

To install from PyPI:

# pip install https://github.com/guelfoweb/peframe/archive/master.zip

To install from source:

$ git clone https://github.com/guelfoweb/peframe.git

$ cd peframe

# python setup.py install

Talk about...

Other

This tool is currently maintained by Gianni 'guelfoweb' Amato, who can be contacted at guelfoweb@gmail.com or twitter @guelfoweb. Suggestions and criticism are welcome.

Sponsored by Security Side.