Malware Reverse Engineering with PE Tree—OSS Inspired by COVID
summary
PE Tree is an open source Python/PyQt5 tool (based on pefile and capstone) that can dump executables from memory, scan IDA/Rekall/Ghidra databases, and rebuild imports and IAT so reconstructed PE files are runnable. It extracts embedded executables from resources, autonomously resolves API calls to recreate import tables (works on MPRESS, UPX and drivers), finds related samples via certificate pivoting (1.4M VT hits shown), is pip-installable, on GitHub and preinstalled on REMnux.
AI-written summary · about
chapters (6)
- 0:00Introduction to PE tree
- 5:20PE file format walkthrough
- 15:41Analyzing injected DLLs
- 20:53Unpacking executables
- 23:33Recall and memory analysis
- 26:22Ghidra support and conclusion
related talks
23mThe Convergence Of EBPF, Buildroot, And QEMU For Automated Linux Malware Analysis
45m"Advanced Malware Threat: handling obfuscated code using..."
47mReverse Engineering Go Malware: From Manual to AI-Powered Analysis
25mCommSec D1 - A Deep Dive Into Malicious Documents
50mDynamic Analysis of MacOS Malware Using SpriteTree
33mBasic Malware Analysis for Incident Responders
31mUsing Math to Speed Up Security Assessments of Windows Executables
01h 09mDeobfuscate UEFI/BIOS Malware And Virtualized Packers