modules.processing.static.PortableExecutable

Package modules :: Package processing :: Module static :: Class PortableExecutable |
[hide private]
[frames] | no frames]

# Class PortableExecutable

source code

    object --+
             |
            PortableExecutable

PE analysis.

Instance Methods | [hide private]
__init__(self, file_path) x.__init__(...) initializes x; see help(type(x)) for signature | source code
_get_filetype(self, data) Gets filetype, uses libmagic if available. | source code
_get_peid_signatures(self) Gets PEID signatures. | source code
_get_imported_symbols(self) Gets imported symbols. | source code
_get_exported_symbols(self) Gets exported symbols. | source code
_get_sections(self) Gets sections. | source code
_get_resources(self) Get resources. | source code
_get_versioninfo(self) Get version info. | source code
_get_imphash(self) Gets imphash. | source code
_get_timestamp(self) Get compilation timestamp. | source code
_get_pdb_path(self) Get the path to any available debugging symbols. | source code
_get_signature(self) If this executable is signed, get its signature(s). | source code
run(self) Run analysis. | source code
Inherited from `object`: `__delattr__`, `__format__`, `__getattribute__`, `__hash__`, `__new__`, `__reduce__`, `__reduce_ex__`, `__repr__`, `__setattr__`, `__sizeof__`, `__str__`, `__subclasshook__`

Properties | [hide private]
Inherited from `object`: `__class__`

Method Details | [hide private]

### __init__(self, file_path) (Constructor) | source code
x.__init__(...) initializes x; see help(type(x)) for signature Parameters: `file_path` - file path. Overrides: object.__init__

### _get_filetype(self, data) | source code
Gets filetype, uses libmagic if available. Parameters: `data` - data to be analyzed. Returns: file type or None.

### _get_peid_signatures(self) | source code
Gets PEID signatures. Returns: matched signatures or None.

### _get_imported_symbols(self) | source code
Gets imported symbols. Returns: imported symbols dict or None.

### _get_exported_symbols(self) | source code
Gets exported symbols. Returns: exported symbols dict or None.

### _get_sections(self) | source code
Gets sections. Returns: sections dict or None.

### _get_resources(self) | source code
Get resources. Returns: resources dict or None.

### _get_versioninfo(self) | source code
Get version info. Returns: info dict or None.

### _get_imphash(self) | source code
Gets imphash. Returns: imphash string or None.

### _get_timestamp(self) | source code
Get compilation timestamp. Returns: timestamp or None.

### run(self) | source code
Run analysis. Returns: analysis results dict or None.