file_analyze_pe
Analyze Windows PE files (EXE, DLL, SYS) to extract headers, sections, imports, and exports. Computes MD5, SHA1, SHA256, and Imphash while detecting packers and suspicious indicators for forensic triage.
Instructions
Perform static analysis on Windows PE files (EXE/DLL/SYS). Extracts headers, imports, exports, sections, calculates hashes (MD5/SHA1/SHA256/Imphash), and detects packers/suspicious indicators.
Input Schema
| Name | Required | Description | Default |
|---|---|---|---|
| file_path | Yes | Path to the PE file to analyze | |
| detail_level | No | Level of detail: minimal (hashes+type), standard (+ sections/imports), verbose (+ all data) | standard |
| extract_strings | No | Extract ASCII/Unicode strings (can be verbose) | |
| calculate_hashes | No | Calculate MD5, SHA1, SHA256, Imphash | |
| check_signatures | No | Check for known packer/crypter signatures |