Skip to content

Latest commit

 

History

History
33 lines (23 loc) · 1.18 KB

README.md

File metadata and controls

33 lines (23 loc) · 1.18 KB

About PEInfo

PEInfo is a utility to query bulk file information for researching. Before using this utility, please fill your API key in PEInfo.ini or disable VirusTotal/Detux feature. (API key of these websites is free after registering an account)

Main features:

  • BasicHash: MD5, SHA1, SHA256
  • ImpHash: Import table hash
  • PEID: Compiler and packer recognition by [userdb.txt] (https://github.com/winest/FixUserDb)
  • CompileTime: Compile time extraction
  • PDB: PDB symbol path extraction
  • ExportFunc: Exported function list
  • VirusTotal: Selected anti-virus engines detection name on VirusTotal
  • Detux: Get sandbox report on Detux

Examples

Run in Windows explorer:

  • Double click "_AddExeToMenu.bat" with Administrator privilege
  • Right click on any file or directory in explorer, and select "PE Info"
  • Check Output folder to get the result

Run in command line:

  • PEInfo.exe -f "Samples\FileList.txt" "C:\Windows\System32\calc.exe;a03fe2d6566d7e9c167216acb55d3f6c"
  • python3 PEInfo.py "C:\Windows\System32\calc.exe;a03fe2d6566d7e9c167216acb55d3f6c"
  • python3 PEInfo.py -f "Samples\FileList.txt"

Author

[ChienWei Hung] (https://www.linkedin.com/profile/view?id=351402223)