Hands-On Artificial Intelligence for Cybersecurity

Pefile

The Pefile library is very useful for analyzing Windows executable files, especially during the phases of static malware analysis, looking for possible indications of compromise or the presence of malicious code in executables. In fact, Pefile makes it very easy to analyze the Portable Executable (PE) file format, which represents the standard for the object files (contained or retrievable as libraries of external executable functions) on the Microsoft platform.

So, not only the classic .exe files, but also the .dll libraries and .sys device drivers, follow the PE file format specification. The installation of the Pefile library is very simple; it is sufficient to use the pip command as used in the following example:

pip install pefile ...