mrjingl3s / tools

Tools

Example output of pescanner.py

################################################################################\n
Record 0
################################################################################

Meta-data
================================================================================
File:    ff48d847de384e7347ea82f3ba3e8aa06026d6c59d2466c9c12c05b519aed8ef
Size:    2780 bytes
Type:    PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
MD5:     663826b257a5993ea7f1893f76a828fc
SHA1:    b447da837b138ecb0de37faab58f2b81967ac69b
SHA256:  ff48d847de384e7347ea82f3ba3e8aa06026d6c59d2466c9c12c05b519aed8ef
ssdeep:  12:eFGSGuXW0IldLlh6h1Ml0d2zjJgfyB/tfOuS:eFGS5aedGCgakzjmfekH
imphash: b20bbc4956ed445f436ec8c674fab104
Date:    0x534EA299 [Fri Apr  9 17:32:25 2014 UTC]
EP:      0x10001076 .text 0/4
CRC:     Claimed: 0x0, Actual: 0xf4e9 [SUSPICIOUS]
RichHdr: Checksum is valid!

Rich Header
================================================================================
@Comp.id       ID           Version      Count        Description
--------------------------------------------------------------------------------
0x00010000     01           0            8            [---] Unmarked objects
0x00937809     93           30729        3            [IMP] VS2008 SP1 build 30729
0x009d766f     9d           30319        1            [LNK] VS2010 build 30319
0x00af766f     af           30319        3            [---] Unknown

Sections
================================================================================
Name       VirtAddr     VirtSize     RawSize      Entropy
--------------------------------------------------------------------------------
.text      0x1000       0x86         0x200        2.118060
.rdata     0x2000       0x8c         0x200        1.359222
.data      0x3000       0x4          0x0          0.000000    [SUSPICIOUS]
.reloc     0x4000       0x34         0x200        0.149797    [SUSPICIOUS]