Skip to content

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

License

Notifications You must be signed in to change notification settings

secDre4mer/pe-sieve

 
 

Folders and files

NameName
Last commit message
Last commit date

Latest commit

 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 
 

Repository files navigation

Build status Codacy Badge Commit activity Last Commit

GitHub release GitHub release date Github All Releases Github Latest Release

License Platform Badge Discussions

Twitter URL

FAQ - Frequently Asked Questions

📖 Read Wiki

📦 Uses library: libPEConv

PE-sieve is a tool that helps to detect malware running on the system, as well as to collect the potentially malicious material for further analysis. Recognizes and dumps variety of implants within the scanned process: replaced/injected PEs, shellcodes, hooks, and other in-memory patches.
Detects inline hooks, Process Hollowing, Process Doppelgänging, Reflective DLL Injection, etc.

PE-sieve is meant to be a light-weight engine dedicated to scan a single process at the time. It can be built as an EXE or as a DLL. The DLL version exposes a simple API and can be easily integrated with other applications.

PE-sieve tools family

There are few other tools that use PE-sieve as an engine, but focus on some specific usecases. They offer additional features and filters on the top of its base.

📌 HollowsHunter - if instead of scanning a single process you want to scan multiple processes at once, or even the full system with PE-sieve, this is the tool for you

📌 MalUnpack - offers quick unpacking of supplied malware sample

Clone

Use recursive clone to get the repo together with the submodule:

git clone --recursive https://github.com/hasherezade/pe-sieve.git

Builds

Download the latest release, or read more.

Available also via Chocolatey


logo by Baran Pirinçal

About

Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).

Resources

License

Stars

Watchers

Forks

Packages

No packages published

Languages

  • C++ 76.8%
  • C 21.6%
  • CMake 1.5%
  • Shell 0.1%