Created
March 23, 2024 10:53
-
-
Save schwartz1375/a21f7f72970d9dd8627eeb97ca2a5a3a to your computer and use it in GitHub Desktop.
Tracking Malware with Import Hashing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
# Tracking Malware with Import Hashing | |
# https://www.mandiant.com/resources/blog/tracking-malware-import-hashing | |
import pefile | |
import argparse | |
import sys | |
def Main(file): | |
print("Interrogating file: '%s'" % file) | |
try: | |
pe = pefile.PE(file) | |
except pefile.PEFormatError as e: | |
print('Aw Snap! PEFormatError: ' + str(e)) | |
sys.exit(1) | |
except: | |
print('Something went wrong loading the file with pefile!') | |
sys.exit(1) | |
print('Import hash (imphash): %s' % pe.get_imphash()) | |
if __name__ == '__main__': | |
parser = argparse.ArgumentParser(description='A rapid file analysis tool') | |
parser.add_argument("file", help="The file to be inspected by the tool") | |
args = parser.parse_args() | |
Main(args.file) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment