Package modules :: Package processing :: Module static :: Class PortableExecutable
[hide private]
[frames] | no frames]

Class PortableExecutable

source code

PE analysis.

Instance Methods [hide private]
 
__init__(self, file_path) source code
 
_get_filetype(self, data)
Gets filetype, uses libmagic if available.
source code
 
_get_peid_signatures(self)
Gets PEID signatures.
source code
 
_get_imported_symbols(self)
Gets imported symbols.
source code
 
_get_exported_symbols(self)
Gets exported symbols.
source code
 
_get_sections(self)
Gets sections.
source code
 
_get_resources(self)
Get resources.
source code
 
_get_versioninfo(self)
Get version info.
source code
 
_get_imphash(self)
Gets imphash.
source code
 
run(self)
Run analysis.
source code
Method Details [hide private]

__init__(self, file_path)
(Constructor)

source code 
Parameters:
  • file_path - file path.

_get_filetype(self, data)

source code 

Gets filetype, uses libmagic if available.

Parameters:
  • data - data to be analyzed.
Returns:
file type or None.

_get_peid_signatures(self)

source code 

Gets PEID signatures.

Returns:
matched signatures or None.

_get_imported_symbols(self)

source code 

Gets imported symbols.

Returns:
imported symbols dict or None.

_get_exported_symbols(self)

source code 

Gets exported symbols.

Returns:
exported symbols dict or None.

_get_sections(self)

source code 

Gets sections.

Returns:
sections dict or None.

_get_resources(self)

source code 

Get resources.

Returns:
resources dict or None.

_get_versioninfo(self)

source code 

Get version info.

Returns:
info dict or None.

_get_imphash(self)

source code 

Gets imphash.

Returns:
imphash string or None.

run(self)

source code 

Run analysis.

Returns:
analysis results dict or None.