Static malware analysis with PEpper

The PEpper is an open source tool for performing static malware analysis on Portable Executable.

Installation

[Email protected]: ~ # git clone https://github.com/Th3Hurrican3/PEpper/

[Email protected]: ~ # cd [Email protected]: ~ # pip3 install -r requirements.txt

[Email protected]: ~ # python3 pepper.py ./malware_dir

Snapshots

CSV output

Application features

• Ύποπτη entropy of ratio
• Ύποπτα names ratio
• Suspicious sizes of codes
• Ύποπτα debugging time-stamp
• Numbers from at export
• Numbers from anti-debugging calls
• Numbers from virtual-machine detection calls
• Numbers from suspicious API calls
• Numbers from suspicious strings
• Numbers from YARA rules
• Numbers from URL who discovers
• Numbers from IP who discovers

And much more…

Note

• Can be run in single or multiple PE (placed in a directory)
• The output of the results will be saved (in its own directory pepper.py) with output.csv
• To use VirusTotal scan, add your private key to "virustotal.py" (Internet connection required)