Pefeats

This utility extracts 119 static features from Portable Executable (PE) files to support machine learning algorithms in detecting packing and malware. Packing compresses executables but is increasingly used to hide malicious code, making detection crucial for security. The project aims to identify which packer was applied to a given file by combining rule-based algorithms, dynamic features from sandbox execution, and AI techniques.

Key Features

• PE Feature Extraction — Extracts 119 static features from executable binaries for analysis
• Packer Detection — Identifies if a file has been packed and determines the specific packing algorithm used
• Rule-Based Matching — Uses rule-based algorithms to match extracted features with known packers
• Dynamic Analysis Integration — Incorporates dynamic features obtained during execution in sandbox environments
• Machine Learning Support — Provides extracted features for use with AI and machine learning algorithms
• Web Application Potential — Designed to potentially be embedded into a web-based tool for broader accessibility

Philosophy

The project focuses on combining existing tools and methodologies to create an effective, efficient, and robust solution for packing detection and classification, extending prior academic research in collaboration with industry partners.