peframe

peframe <sample.exe>

Analyze a PE executable with peframe: imports, sections, entropy, and packing detection in one command.

Run it when you need quick PE analysis: peframe examines the binary and reports imports, sections, packing indicators (high entropy, weird sections), URLs, and suspicious strings — the static summary of the sample in seconds. It's the triage tool: the first pass that decides if the binary deserves deep analysis. In IR, peframe on the extracted payload gives the initial picture — packing (UPX), injection API imports (VirtualAllocEx, WriteProcessMemory), and URLs — before moving to unpacking and the sandbox.

Don't use it as a full analysis: peframe is triage — the indicators it reports (entropy, sections) are clues, not verdicts; a binary with high entropy can be legitimate (compression) and a clean one can be malware. False positives from generic detections (URLs and suspicious strings appear in normal binaries) require review. And note: peframe analyzes the PE on disk — binaries for other platforms (ELF, Mach-O) or scripts don't apply; for those, equivalent tools (capa supports more formats). For import or section detail, finer tools (pescan, dumpbin) complement.