{"id":29236985,"url":"https://github.com/bugourmet/pypeof","last_synced_at":"2025-07-03T18:13:07.093Z","repository":{"id":192154284,"uuid":"469148002","full_name":"bugourmet/pypeof","owner":"bugourmet","description":"Python script that detects PE File EOF Data","archived":false,"fork":false,"pushed_at":"2023-09-30T20:16:06.000Z","size":12,"stargazers_count":1,"open_issues_count":0,"forks_count":0,"subscribers_count":2,"default_branch":"main","last_synced_at":"2024-03-24T19:43:32.729Z","etag":null,"topics":["eof","eof-analysis","malware","malware-analysis","pe","pefile","python"],"latest_commit_sha":null,"homepage":"","language":"Python","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/bugourmet.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null}},"created_at":"2022-03-12T17:09:22.000Z","updated_at":"2024-03-24T19:43:37.066Z","dependencies_parsed_at":"2024-03-24T19:53:46.884Z","dependency_job_id":null,"html_url":"https://github.com/bugourmet/pypeof","commit_stats":null,"previous_names":["runtimeterrorist/pypeof","bugourmet/pypeof"],"tags_count":0,"template":false,"template_full_name":null,"purl":"pkg:github/bugourmet/pypeof","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bugourmet%2Fpypeof","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bugourmet%2Fpypeof/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bugourmet%2Fpypeof/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bugourmet%2Fpypeof/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/bugourmet","download_url":"https://codeload.github.com/bugourmet/pypeof/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/bugourmet%2Fpypeof/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":263376672,"owners_count":23457357,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["eof","eof-analysis","malware","malware-analysis","pe","pefile","python"],"created_at":"2025-07-03T18:13:02.260Z","updated_at":"2025-07-03T18:13:07.076Z","avatar_url":"https://github.com/bugourmet.png","language":"Python","funding_links":[],"categories":[],"sub_categories":[],"readme":"# pyPEof\n\n[![GitHub stars](https://img.shields.io/github/stars/runtimeterrorist/pypeof.svg)](https://github.com/runtimeterrorist/pypeof/stargazers)\n[![GitHub license](https://img.shields.io/github/license/runtimeterrorist/pypeof.svg)](https://github.com/runtimeterrorist/pypeof/blob/master/LICENSE)\n[![GitHub forks](https://img.shields.io/github/forks/runtimeterrorist/pypeof.svg)](https://github.com/runtimeterrorist/pypeof/network/members)\n[![GitHub issues](https://img.shields.io/github/issues/runtimeterrorist/pypeof.svg)](https://github.com/runtimeterrorist/pypeof/issues)\n[![GitHub pull requests](https://img.shields.io/github/issues-pr/runtimeterrorist/pypeof.svg)](https://github.com/runtimeterrorist/pypeof/pulls)\n[![GitHub last commit](https://img.shields.io/github/last-commit/runtimeterrorist/pypeof.svg)](https://github.com/runtimeterrorist/pypeof/commits/master)\n\npyPEof is a Python script for detecting suspicious EOF data on a valid PE file.\n\nMalware often appends to EOF payloads,C2 configuration and other malicious data.\n\nThis script\n\n- checks if the PE file is valid then checks image architecture.\n\n- calculates the expected size of the file trough the PE Header and compares it with file size on the disk.\n  (If the size on disk is not equal to the size described by the PE Header then we likely have an infected/modified file.)\n\n- prints the EOF data and prompts user to dump it to a file.\n\nMain goal of this \"project\" was learning more about the PE fileformat and common techniques used by malware authors.\n\nCode is not perfect and improvements/suggestions are welcome.\n\n## Installation 📦\n\nInstall necessary dependencies via pip\nInstall necessary dependencies.\n\n```python\npip install -r requirements.txt\n```\n\n## Usage 📖\n\nRun:\n\n```\n./pyPEOF.py -f pefile.exe\n```\n\nConsole output:\n\n![alt text](images/image.png)\n\n## Contributing 🤝\n\nPull requests are welcome. For major changes, please open an issue first to discuss what you would like to change.\n\n## License 📜\n\n[MIT](https://choosealicense.com/licenses/mit/)\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbugourmet%2Fpypeof","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fbugourmet%2Fpypeof","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fbugourmet%2Fpypeof/lists"}