PEpper : An Open Source Script To Perform Malware Static Analysis On Portable Executable

PEpper is an open source tool to perform malware static analysis on Portable Executable. Following are some of the features supported by the tool;

  • Suspicious entropy ratio
  • Suspicious name ratio
  • Suspicious code size
  • Suspicious debugging time-stamp
  • Number of export
  • Number of anti-debugging calls
  • Number of virtual-machine detection calls
  • Number of suspicious API calls
  • Number of suspicious strings
  • Number of YARA rules matches
  • Number of URL found
  • Number of IP found
  • Cookie on the stack (GS) support
  • Control Flow Guard (CFG) support
  • Data Execution Prevention (DEP) support
  • Address Space Layout Randomization (ASLR) support
  • Structured Exception Handling (SEH) support
  • Thread Local Storage (TLS) support
  • Presence of manifest
  • Presence of version
  • Presence of digital certificate
  • Packer detection
  • VirusTotal database detection
  • Import hash


eva@paradise:~$ git clone eva@paradise:~$ cd PEpper
eva@paradise:~$ pip3 install -r requirements.txt
eva@paradise:~$ python3 ./malware_dir

CSV Output


and more columns..

Also Read – PwnedOrNot : OSINT Tool To Find Passwords For Compromised Email Addresses


  • Can be run on single or multiple PE (placed inside a directory)
  • Output will be saved (in the same directory of as output.csv
  • To use VirusTotal scan, add your private key in the module called “” (Internet connection required)