peframe

======= peframe peframe is a open source tool to perform static analysis on Portable Executable malware and generic suspicious file. It can help malware researchers to detect packer, xor, digital signature, mutex, anti debug, anti virtual machine, suspicious sections and functions, macro and much...

PEpper

PEpper 一个开源工具，用于对P ortable E xecutable（可移植可执行文件）进行 恶意软件静态分析 安装 eva@paradise:$ git clone https://github.com/blackeko/PEpper/ eva@paradise:$ cd PEpper eva@paradise:$ pip3 install -r requirements.txt eva@paradise:$ python3 pepper.py ./malwaredir 截图 | ---|--- | 以及更多行…… CSV 输出 以及更多列…… 提取的特征 可疑熵 比率 可疑名...

PortEx

PortEx 欢迎使用 PortEx PortEx 是一个用于便携可执行文件静态恶意软件分析的 Java 库。其重点在于 PE 文件格式的鲁棒性及异常检测。 PortEx 使用 Java 和 Scala 编写，面向 Java 应用程序。 功能特性 读取头部信息：MSDOS 头、COFF 文件头、可选头、节表 读取 PE 结构：导入表、资源、导出表、调试目录、重定位表、延迟加载导入表、绑定导入表 导出节、资源、覆盖数据、嵌入的 ZIP、JAR 或 .class 文件 扫描文件格式异常，包括结构异常、已弃用、保留、错误或非默认值。 可视化 PE 文件结构、局部熵和字节图，支持可变颜色和大小...

pefile

pefile pefile 是一个跨平台的 Python 模块，用于解析和处理可移植可执行 PE 文件。PE 文件头中包含的大部分信息均可访问，所有节的详细信息和数据也是如此。 Windows 头文件中定义的结构将作为 PE 实例中的属性访问。字段/属性的命名将尽量遵循这些头文件中的命名约定。仅为了方便而添加的快捷方式才会偏离该约定。 pefile 需要对 PE 文件的布局有一些基本了解——有了它，就可以探索 PE 文件格式的几乎所有功能。 安装 通过 pip 安装 pefile： pip3 install pefile 功能特性 pefile 可以实现的一些任务包括： 检查头部 分析节...

enumy

Enumy Enumy 是一个 超快便携可执行文件 ，你可以在渗透测试或 CTF 的后利用阶段将其放入目标 Linux 机器上。运行 enumy 将枚举目标主机，查找 常见安全漏洞 。 安装 你可以从 x86 或 x64 的发布标签页下载最终的二进制文件。 静态链接到 musl 将最终的 enumy 二进制文件传输到目标机器。 最新发布 ./enumy 谁应该使用 Enumy 渗透测试人员可以在目标机器上运行，以便为报告提出可追溯的问题。 CTF 玩家可以用它来识别他们可能遗漏的东西。 好奇的人可以查看 enumy 在自己的本地机器上发现了多少问题？ 选项 $ ./enumy64 -h...

peanalyzer

peanalyzer Advanced Portable Executable File Analyzer Python 3.5.2 : Tested Working Usage python peanalyzer.py --file file.exe --show all|file-path|general|dos-header|file-header|optional-header|data-directory|section-headers|imports python peanalyzer.py --file file.exe --disassemble all...

collisions

Colisiones de hash y explotaciones Por Ange Albertini y Marc Stevens. FAQ TL;DR P: ¿Es posible hacer que un archivo obtenga un MD2/MD4/MD5/MD6/SHA1/SHA2/SHA3 arbitrario, o el mismo hash que otro archivo? R: No. P: ¿Se pueden crear 2 archivos diferentes con el mismo hash? R: Con MD5, en unos...

NativePe

NativePe NativePe es una biblioteca de Portable Executable de Windows escrita en Object Pascal para Delphi. El proyecto se centra en el análisis, mapeo, carga, reubicación, manejo de importaciones y exportaciones, volcado, lectura de memoria de procesos y aspectos relacionados con las tripas de...

pdbdownload

Una utilidad para descargar archivos PDB asociados a un Portable Executable PE. Características Descargar símbolos PDB de msdl.microsoft.com. Procesar un solo archivo PortableExecutable PE o un lote de ellos. Demostración...

Astra Linux – Vulnerability in binutils

A issue was discovered in the Binary File Descriptor BFD library also known as libbfd, as distributed in GNU Binutils 2.31. A heap-based buffer overflow in the bfdgetl32 function in libbfd.c allows an attacker to cause a denial of service through a crafted PE file. This vulnerability can be...

Important: clamav1.4

Issue Overview: A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for...

SUSE-SU-2026:22574-1 Security update for clamav

This update for clamav fixes the following issues: Update to version 1.5.3. Security issues fixed: - CVE-2026-20213: out-of-bounds write due to improper boundary checks for content in PE files during scanning bsc1270107. - CVE-2026-20214: out-of-bounds write due to improper boundary checks for...

SUSE CVE-2026-20213

A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PE file...

The vulnerability of the PE-file processing mechanism of the ClamAV antivirus program allows a hacker to induce a service failure.

The vulnerability of the PE-file processing mechanism in the ClamAV antivirus program lies in the copying of buffers without checking the size of the input data. Exploiting this vulnerability allows a malicious actor to cause service failure by sending a specially crafted file...

UBUNTU-CVE-2026-20213

A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PE file...

UBUNTU-CVE-2026-20214

A vulnerability in the FSG file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in FSG...

CVE-2026-20213

A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PE file...

CVE-2026-20213

A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PE file...

DEBIAN-CVE-2026-20213

A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PE file...

CVE-2026-20213

A vulnerability in the PE file format parser of ClamAV could allow an unauthenticated, remote attacker to cause a DoS condition, or possibly other expanded impacts, resulting from memory corruption on an affected device. This vulnerability is due to improper boundary checks for content in PE file...