Created
August 8, 2023 19:29
-
-
Save albertzsigovits/39d311aac48704dbac20753cf3f761d4 to your computer and use it in GitHub Desktop.
Enum PE section names for large collection of malware
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
import pefile | |
import sys | |
import os | |
dir = '/tmp/mlwr' | |
for dirpath, dirnames, filenames in os.walk(dir): | |
for filename in filenames: | |
with open(os.path.join(dir,dirpath,filename), 'rb') as current: | |
xtract = current.read(2) | |
conv = xtract.decode('ascii',errors='ignore') | |
if conv == 'MZ': | |
try: | |
pe = pefile.PE(os.path.join(dir,dirpath,filename)) | |
for section in pe.sections: | |
asciisection = section.Name.decode('ascii',errors='ignore') | |
print(asciisection) | |
except pefile.PEFormatError as err: | |
print("{} in file '{}'".format(err, filename)) | |
continue |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment