mirror of
https://github.com/rad9800/misc
synced 2026-06-08 16:56:08 +00:00
rad9800
70 lines
2.3 KiB
Python
70 lines
2.3 KiB
Python
import sys
|
|
import os
|
|
import hashlib # Generating hashes
|
|
import pefile
|
|
|
|
# https://github.com/erocarrera/pefile/blob/0d5ce5e0193c878cd57636b438b3746ffc3ae7e3/pefile.py#L1324
|
|
def getEntropy(data):
|
|
import math
|
|
from collections import Counter
|
|
|
|
if not data:
|
|
return 0.0
|
|
|
|
occurences = Counter(bytearray(data))
|
|
|
|
entropy = 0
|
|
for x in occurences.values():
|
|
p_x = float(x) / len(data)
|
|
entropy -= p_x * math.log(p_x, 2)
|
|
|
|
return entropy
|
|
|
|
def printImports(pe):
|
|
for imports in pe.DIRECTORY_ENTRY_IMPORT:
|
|
print(imports.dll.decode().lower())
|
|
for i in imports.imports:
|
|
print("\t", hex(i.address), i.name.decode())
|
|
|
|
def getArch(pe):
|
|
if hex(pe.OPTIONAL_HEADER.Magic) == '0x10b':
|
|
return "x86"
|
|
elif hex(pe.OPTIONAL_HEADER.Magic) == '0x20b':
|
|
return "x64_86"
|
|
|
|
def getTimestamp(pe):
|
|
import datetime
|
|
epoch_time = pe.FILE_HEADER.TimeDateStamp
|
|
date_time = datetime.datetime.fromtimestamp(epoch_time)
|
|
return date_time
|
|
|
|
def checkImports(pe):
|
|
if not hasattr(pe, "DIRECTORY_ENTRY_IMPORT"):
|
|
print("NO IMPORTS")
|
|
|
|
if __name__ == "__main__":
|
|
try:
|
|
pe = pefile.PE(sys.argv[1])
|
|
# Architecture is worth noting
|
|
print("File\t\t:", sys.argv[1].split("\\")[-1])
|
|
print("MD5 hash\t:", hashlib.md5(pe.__data__).hexdigest())
|
|
print("SHA256 hash\t:", hashlib.sha256(pe.__data__).hexdigest())
|
|
print("Architecture\t:", getArch(pe))
|
|
print("Timestamp \t:", getTimestamp(pe))
|
|
print("Total Entropy \t:",getEntropy(pe.__data__))
|
|
print("Size \t\t: {:.1f}".format(len(pe.__data__)/1000), "KB")
|
|
print("Sections\t:")
|
|
for section in pe.sections:
|
|
print("\tName\t", section.Name.decode('UTF-8'))
|
|
print("\tSize\t", section.SizeOfRawData, "bytes")
|
|
print("\tEntropy\t", getEntropy(section.get_data()), "\n")
|
|
if not hasattr(pe, "DIRECTORY_ENTRY_IMPORT"):
|
|
print("Imports \t: NONE!")
|
|
else:
|
|
print("Imports \t:")
|
|
printImports(pe)
|
|
strings = "\\\\live.sysinternals.com@SSL\\DavWWWRoot\\strings.exe -accepteula -n 7 " + sys.argv[1]
|
|
os.system(strings)
|
|
except:
|
|
print("python3 pe-properties.py <path to executable>")
|