peanalyst1.py

#Python PE Analyst - DLLs of .exe
#16/04/2019 - [email protected]
#DB MySQL structure: id;filename;md5;sha256;filesize;dump
import datetime
import time
import pefile
import mmap
import pymysql
pymysql.install_as_MySQLdb() 

import MySQLdb
db = MySQLdb.connect(user="root",passwd="",host="localhost",db="test")
cursor = db.cursor()

now = datetime.datetime.now()
global exe_path
exe_path = "cmd4.exe"
fd = open(exe_path, 'rb')
pe_data = mmap.mmap(fd.fileno(), 0, access=mmap.ACCESS_READ)
pe = pefile.PE(exe_path)
#pe = pefile.PE(data=pe_data) 
#pe = pefile.PE(data=pe_data, fast_load=True)
#print(pe)

def foo(dll):
	cursor.execute("INSERT INTO pedump VALUES (NULL, 'cmd4.exe', 7, %s, 6,%s)", (now,dll))
	data=cursor.fetchall()

print("[*] Listing imported DLLs...")
for entry in pe.DIRECTORY_ENTRY_IMPORT:
	global dll
	dll = '\t' + entry.dll.decode('utf-8')
	foo(dll)
	print(dll)

db.close()