peanalyst2.py

#Python PE Analyst - MD5-SHA256-Size-DLLs of .exe
#16/04/2019 - [email protected]
#DB MySQL structure: id;filename;md5;sha256;filesize;dump
import datetime
import time
import pefile
import mmap
import hashlib
import pymysql
pymysql.install_as_MySQLdb() 

import MySQLdb
db = MySQLdb.connect(user="root",passwd="",host="localhost",db="test")
cursor = db.cursor()

now = datetime.datetime.now()
global exe_path
exe_path = "cmd4.exe"
fd = open(exe_path, 'rb')
pe_data = mmap.mmap(fd.fileno(), 0, access=mmap.ACCESS_READ)
pe = pefile.PE(exe_path)
#pe = pefile.PE(data=pe_data) 
#pe = pefile.PE(data=pe_data, fast_load=True)
#print(pe)

hasher = hashlib.md5()
hashersha256 = hashlib.sha256()
with open(exe_path, 'rb') as afile:
    buf = afile.read()
    hasher.update(buf)
    hashersha256.update(buf)
print(hasher.hexdigest())
print(hashersha256.hexdigest())

def file_size(fname):
        import os
        statinfo = os.stat(fname)
        return statinfo.st_size

def foo(dll):
	cursor.execute("INSERT INTO pedump VALUES (NULL, %s, %s, %s, %s, %s)", (exe_path,hasher.hexdigest(),hashersha256.hexdigest(),file_size(exe_path),dll))
	data=cursor.fetchall()

print("[*] Listing imported DLLs...")
for entry in pe.DIRECTORY_ENTRY_IMPORT:
	global dll
	dll = '\t' + entry.dll.decode('utf-8')
	foo(dll)
	print(dll)

db.close()