file_analyze_pe
Analyze Windows PE files (EXE/DLL/SYS) by extracting headers, imports, exports, sections, calculating hashes, and identifying packers or suspicious indicators.
Instructions
Perform static analysis on Windows PE files (EXE/DLL/SYS). Extracts headers, imports, exports, sections, calculates hashes (MD5/SHA1/SHA256/Imphash), and detects packers/suspicious indicators.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| file_path | Yes | Path to the PE file to analyze | |
| calculate_hashes | No | Calculate MD5, SHA1, SHA256, Imphash | |
| extract_strings | No | Extract ASCII/Unicode strings (can be verbose) | |
| check_signatures | No | Check for known packer/crypter signatures | |
| detail_level | No | Level of detail: minimal (hashes+type), standard (+ sections/imports), verbose (+ all data) | standard |