PortEx

Specifically engineered to handle corrupted or malformed PE files common in malware, ensuring reliable parsing where other libraries might fail, as highlighted in its focus on PE malformation robustness.

Extracts detailed information from all PE structures, including headers, imports, exports, resources, and .NET metadata, providing a thorough static analysis foundation for malware researchers.

Scans for structural anomalies, deprecated values, and format violations, which are key indicators of malware tampering, making it a robust tool for identifying suspicious files.

Offers visualizations of file structure, entropy, and byteplots with customizable colors and sizes, aiding in manual inspection and pattern recognition, as shown in the README example image.

Computes specialized hashes like ImpHash and Rich hashes, along with entropy metrics such as Shannon entropy and Chi-Squared, useful for file fingerprinting and malware classification.