Generating Features of Windows Portable Executable Files for Static Analysis using Portable Executable Reader Module (PEFile)

Abstract

The identification of malicious program at an early stage has been proven to be effective in reducing the chance of malware infection on the device or a system. A common approach to do this is through static analysis. Static analysis examines the source code of portable executable (PE) files without actually executing them. Selecting static features that will be used to for static analysis is an arduous process. To address this issue and in preparation for selecting static features for static analysis, this paper explores the use of PEFILE, a Python-based toolkit to analyze PE scripts. PEFILE is a versatile application that analyze malware files in a virtual environment. Four different datasets of malware packages are investigated using PEFILE. Three different algorithms are used to create the final output, namely 1) Extraction algorithm (Feature Extraction), 2) Selection algorithm (Feature Selection) and 3) Dataset Algorithm (Dataset Creation). The selected features from each malware packages are then compared and analyzed.