11# This file is a part of IntelOwl https://github.com/intelowlproject/IntelOwl
22# See the file 'LICENSE' for copying permission.
33
4- # this analyzer leverage a forked version of PEfile ...
5- # ... that fixes one common problem encountered in a lot of analysis
6- # original repository: https://github.com/erocarrera/pefile
7- # forked repository: https://github.com/mlodic/pefile
8-
94import logging
105import os
116from datetime import datetime
@@ -59,6 +54,55 @@ def dotnetpe(self):
5954 results ["is_dotnet" ] = False
6055 return results
6156
57+ @staticmethod
58+ def _extract_sections (pe ):
59+ sections = []
60+ for section in pe .sections :
61+ try :
62+ name = section .Name .decode ()
63+ except UnicodeDecodeError as e :
64+ name = "UnableToDecode"
65+ logger .warning (f"Unable to decode section { section .Name } { e } )
66+ section_item = {
67+ "name" : name ,
68+ "address" : hex (section .VirtualAddress ),
69+ "virtual_size" : hex (section .Misc_VirtualSize ),
70+ "size" : section .SizeOfRawData ,
71+ "entropy" : section .get_entropy (),
72+ }
73+ sections .append (section_item )
74+
75+ return sections
76+
77+ @staticmethod
78+ def _extract_import_table (pe ):
79+ import_table = []
80+ directory_entry_import = getattr (pe , "DIRECTORY_ENTRY_IMPORT" , [])
81+ for entry in directory_entry_import :
82+ imp = {
83+ "entryname" : entry .dll .decode () if entry .dll else None ,
84+ "symbols" : [],
85+ }
86+ for symbol in entry .imports :
87+ if symbol .name :
88+ imp ["symbols" ].append (symbol .name .decode ())
89+ import_table .append (imp )
90+ return import_table
91+
92+ @staticmethod
93+ def _extract_export_table (full_dump ):
94+ export_table = []
95+ for entry in full_dump .get ("Exported symbols" , []):
96+ symbol_name = entry .get ("Name" , None )
97+ # in case it is a dictionary, we do not mind it
98+ try :
99+ export_table .append (symbol_name .decode ())
100+ except (UnicodeDecodeError , AttributeError ) as e :
101+ logger .debug (f"PE info error while decoding export table symbols: { e } )
102+ # this is to reduce the output
103+ export_table = export_table [:100 ]
104+ return export_table
105+
62106 def run (self ):
63107 results = {}
64108 results ["dotnet" ] = self .dotnetpe ()
@@ -80,25 +124,7 @@ def run(self):
80124 elif pe .is_exe ():
81125 results ["type" ] = "EXE"
82126
83- sections = []
84- for section in pe .sections :
85- try :
86- name = section .Name .decode ()
87- except UnicodeDecodeError as e :
88- name = "UnableToDecode"
89- logger .warning (
90- f"Unable to decode section { section .Name } { e }
91- )
92- section_item = {
93- "name" : name ,
94- "address" : hex (section .VirtualAddress ),
95- "virtual_size" : hex (section .Misc_VirtualSize ),
96- "size" : section .SizeOfRawData ,
97- "entropy" : section .get_entropy (),
98- }
99- sections .append (section_item )
100-
101- results ["sections" ] = sections
127+ results ["sections" ] = self ._extract_sections (pe )
102128
103129 machine_value = pe .FILE_HEADER .Machine
104130 results ["machine" ] = machine_value
@@ -127,32 +153,8 @@ def run(self):
127153 timestamp
128154 ).strftime ("%Y-%m-%d %H:%M:%S" )
129155
130- import_table = []
131- directory_entry_import = getattr (pe , "DIRECTORY_ENTRY_IMPORT" , [])
132- for entry in directory_entry_import :
133- imp = {
134- "entryname" : entry .dll .decode () if entry .dll else None ,
135- "symbols" : [],
136- }
137- for symbol in entry .imports :
138- if symbol .name :
139- imp ["symbols" ].append (symbol .name .decode ())
140- import_table .append (imp )
141- results ["import_table" ] = import_table
142-
143- export_table = []
144- for entry in full_dump .get ("Exported symbols" , []):
145- symbol_name = entry .get ("Name" , None )
146- # in case it is a dictionary, we do not mind it
147- try :
148- export_table .append (symbol_name .decode ())
149- except (UnicodeDecodeError , AttributeError ) as e :
150- logger .debug (
151- f"PE info error while decoding export table symbols: { e }
152- )
153- # this is to reduce the output
154- export_table = export_table [:100 ]
155- results ["export_table" ] = export_table
156+ results ["import_table" ] = self ._extract_import_table (pe )
157+ results ["export_table" ] = self ._extract_export_table (full_dump )
156158
157159 results ["flags" ] = full_dump .get ("Flags" , [])
158160
0 commit comments