blackeko / Pepper
An open source script to perform malware static analysis on Portable Executable
Stars: ✭ 250
Programming Languages
python3
1442 projects
Projects that are alternatives of or similar to Pepper
freki
🐺 Malware analysis platform
Stars: ✭ 327 (+30.8%)
Mutual labels: static-analysis, malware, malware-analysis, yara
Freki
🐺 Malware analysis platform
Stars: ✭ 285 (+14%)
Mutual labels: static-analysis, malware, malware-analysis, yara
binlex
A Binary Genetic Traits Lexer Framework
Stars: ✭ 303 (+21.2%)
Mutual labels: malware, malware-analysis, yara
Analyzer
🔍 Offline Analyzer for extracting features, artifacts and IoCs from Windows, Linux, Android, iPhone, Blackberry, macOS binaries, emails and more
Stars: ✭ 108 (-56.8%)
Mutual labels: static-analysis, malware-analysis, yara
MalScan
A Simple PE File Heuristics Scanners
Stars: ✭ 41 (-83.6%)
Mutual labels: static-analysis, malware, malware-analysis
Yargen
yarGen is a generator for YARA rules
Stars: ✭ 795 (+218%)
Mutual labels: malware, malware-analysis, yara
static file analysis
Analysis of file (doc, pdf, exe, ...) in deep (emmbedded file(s)) with clamscan and yara rules
Stars: ✭ 34 (-86.4%)
Mutual labels: static-analysis, malware-analysis, yara
Engine
Droidefense: Advance Android Malware Analysis Framework
Stars: ✭ 386 (+54.4%)
Mutual labels: static-analysis, malware, malware-analysis
Multiscanner
Modular file scanning/analysis framework
Stars: ✭ 494 (+97.6%)
Mutual labels: malware, malware-analysis, yara
Pecli
CLI tool to analyze PE files
Stars: ✭ 46 (-81.6%)
Mutual labels: malware, malware-analysis, yara
Mobile Security Framework Mobsf
Mobile Security Framework (MobSF) is an automated, all-in-one mobile application (Android/iOS/Windows) pen-testing, malware analysis and security assessment framework capable of performing static and dynamic analysis.
Stars: ✭ 10,212 (+3984.8%)
Mutual labels: static-analysis, malware-analysis
Malwaredatascience
Malware Data Science Reading Diary / Notes
Stars: ✭ 82 (-67.2%)
Mutual labels: malware, malware-analysis
Php Malware Finder
Detect potentially malicious PHP files
Stars: ✭ 1,245 (+398%)
Mutual labels: malware, yara
Florentino
Fast Static File Analysis Framework
Stars: ✭ 92 (-63.2%)
Mutual labels: static-analysis, malware-analysis
Ursadb
Trigram database written in C++, suited for malware indexing
Stars: ✭ 72 (-71.2%)
Mutual labels: malware, yara
Malice
VirusTotal Wanna Be - Now with 100% more Hipster
Stars: ✭ 1,253 (+401.2%)
Mutual labels: malware, malware-analysis
Awesome Yara
A curated list of awesome YARA rules, tools, and people.
Stars: ✭ 1,394 (+457.6%)
Mutual labels: malware-analysis, yara
Malware Feed
Bringing you the best of the worst files on the Internet.
Stars: ✭ 69 (-72.4%)
Mutual labels: malware, malware-analysis
Malwarelab vm Setup
Setup scripts for my Malware Analysis VMs
Stars: ✭ 126 (-49.6%)
Mutual labels: static-analysis, malware-analysis
PEpper
An open source tool to perform malware static analysis on Portable Executable
Installation
[email protected]:~$ git clone https://github.com/blackeko/PEpper/
[email protected]:~$ cd PEpper
[email protected]:~$ pip3 install -r requirements.txt
[email protected]:~$ python3 pepper.py ./malware_dir
Screenshot
 |
 |
 |
 |
and more rows..
CSV output
and more columns..
Feature extracted
- Suspicious entropy ratio
- Suspicious name ratio
- Suspicious code size
- Suspicious debugging time-stamp
- Number of export
- Number of anti-debugging calls
- Number of virtual-machine detection calls
- Number of suspicious API calls
- Number of suspicious strings
- Number of YARA rules matches
- Number of URL found
- Number of IP found
- Cookie on the stack (GS) support
- Control Flow Guard (CFG) support
- Data Execution Prevention (DEP) support
- Address Space Layout Randomization (ASLR) support
- Structured Exception Handling (SEH) support
- Thread Local Storage (TLS) support
- Presence of manifest
- Presence of version
- Presence of digital certificate
- Packer detection
- VirusTotal database detection
- Import hash
Notes
- Can be run on single or multiple PE (placed inside a directory)
- Output will be saved (in the same directory of pepper.py) as output.csv
- To use VirusTotal scan, add your private key in the module called "virustotal.py" (Internet connection required)
-
Credits
Many thanks to those who indirectly helped me in this work, specially:
- The LIEF project and its awesome library
- PEstudio, a really amazing software to analyze PE
- PEframe from guelfoweb, an incredible widespread tool to perform static analysis on Portable Executable malware and malicious MS Office documents
- Yara-Rules project, which provides compiled signatures, classified and kept as up to date as possible
Note that the project description data, including the texts, logos, images, and/or trademarks,
for each open source project belongs to its rightful owner.
If you wish to add or remove any projects, please contact us at [email protected].