Skip to content

Latest commit

 

History

History
29 lines (18 loc) · 1.58 KB

README.md

File metadata and controls

29 lines (18 loc) · 1.58 KB

PowerParse v0.01

PowerShell PE Parser designed to help and aid reverse engineers. Module allows initial triage of a PE by supporting modules that do the following:

  • Obtain basic information about a PE.
  • Identify if the PE in question has multiple embedded PEs within it. If there is, an option to export each PE is available.
  • Ability to ship up a VT search.
  • Ability to identify if certain behaviors (TTPs) are performed within the PE.

Usage

To use this module, type: Import-Module PowerParse.psd1.

The following functions are supported:

  • Get-PEInfo - Obtains information about a PE (type, architectrue, etc), checks to see if multiple PEs are embedded within the binary. Has switches -Export to export embedded PEs, GetVTScore to get the score of the PE, and GetTTPs to run analysis on what behaviors the PE executes.

  • Get-MZHeaders - Identifies how many PEs are embedded within 1 file.

  • Get-PESize - Obtains the size of a PE file.

  • Export-PE - Helper function to export PEs. Used within Get-PEInfo.

  • Get-VTScore - Obtains the positive results of a PE based off a file's hash. Future versions will allow for more dynamic queries. Need to supply VTAPI for query to work.

  • Get-TTPs - Uses string matching to identify if certain behaviors are being performed within a PE.

Acknowledgements

  • Matt Graeber - PowerShell Arsenal was a huge inspiration for this module. Also thank you to Matt for reviewing this module and giving suggestions which will be added to future versions.
  • Matt Hand - Talking to me about this module and giving me ideas to implement.