PowerParse

KO | EN

gitlite — search

#hacktoberfest #llm #go #android #rust #deep-learning #docker #nodejs #java #windows #awesome #security #ios #mcp

(★ 63)

PowerShell PE Parser

파일 탐색기

최종 버전 다운로드 (.zip)

- APIs.json
- Export-PE.ps1
- Get-MZHeaders.ps1
- Get-PEInfo.ps1
- Get-PESize.ps1
- Get-Strings.ps1
- Get-TTPs.ps1
- Get-VTScore.ps1
LICENSE
PowerParse.psd1
PowerParse.psm1
README.md

// repository documentation

Was this content helpful?

★ 0 (0 ratings)

# PowerParse v0.01
PowerShell PE Parser designed to help and aid reverse engineers. Module allows initial triage of a PE by supporting modules that do the following: 
* Obtain basic information about a PE. 
* Identify if the PE in question has multiple embedded PEs within it. If there is, an option to export each PE is available. 
* Ability to ship up a VT search. 
* Ability to identify if certain behaviors (TTPs) are performed within the PE.

# Usage

To use this module, type: `Import-Module PowerParse.psd1`.

The following functions are supported:

* `Get-PEInfo` - Obtains information about a PE (type, architectrue, etc), checks to see if multiple PEs are embedded within the binary. Has switches `-Export` to export embedded PEs, `GetVTScore` to get the score of the PE, and `GetTTPs` to run analysis on what behaviors the PE executes.

* `Get-MZHeaders` - Identifies how many PEs are embedded within 1 file.

* `Get-PESize` - Obtains the size of a PE file.

* `Export-PE` - Helper function to export PEs. Used within Get-PEInfo.

* `Get-VTScore` - Obtains the positive results of a PE based off a file's hash. Future versions will allow for more dynamic queries. Need to supply VTAPI for query to work.

* `Get-TTPs` - Uses string matching to identify if certain behaviors are being performed within a PE.

# Acknowledgements
* Matt Graeber - PowerShell Arsenal was a huge inspiration for this module. Also thank you to Matt for reviewing this module and giving suggestions which will be added to future versions. 
* Matt Hand - Talking to me about this module and giving me ideas to implement.

PowerParse

파일 탐색기

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

PowerParse

파일 탐색기

오늘의 추천 프로젝트

Was this content helpful?

Recent Feedback

Download README