pecheck.py is a wrapper for pefile, ant this update has a couple of new features:
- accept input from stdin (for pipes)
- load PeID userdb.txt by default from same directory as pecheck.py
- extra entry point info
pecheck-v0_4_0.zip (https)
MD5: 27041C56B80B097436076B7366A6F3B2
SHA256: F9C73ED054AE4D5E9F495916D1B028FD8D6E9B2800DCE1993E568E2A2BFD9A71
Didier Stevens 
[…] pecheck.py, written by Didier Stevens, is a wrapper for the Python pefile module used to parse Windows PE files. Let’s explore this tool by analyzing the BACKSPACE backdoor malware described in FireEye’s APT 30 report. If you want to follow along, you can download the sample here (password: infected). As shown in the output below, running pecheck.py against the sample returns file hashes and file/section entropy calculations. Entropy is a measure of randomness, and more entropy indicates a higher likelihood of encoded or encrypted data. While this information is helpful, I want to focus on the “Dump Info:” section shown towards the end of the excerpt. This section basically runs the pefile dump_info() function, which parses the entire file and outputs, well, a lot of data (see the complete output here). […]
Pingback by REMNUX V6 FOR MALWARE ANALYSIS (PART 2): STATIC FILE ANALYSIS | malwology — Tuesday 9 February 2016 @ 12:16