Recipe Difficulty: Easy
Python Version: 2.7 or 3.5
Operating System: Any
During the course of an investigation, we may identify a potentially suspicious or unauthorized portable executable file. This executable may be interesting because of the time it was used on the system, its location on the system, or other attributes specific to the investigation. Whether we are investigating it as malicious software or an unauthorized utility, we need to have the capability to learn more about it.
By extracting embedded metadata from Windows executable files, we can learn about the components that make up the file. In this recipe, we will expose the compilation date, useful Indicator of Compromise (IOC) data from the section headers, and the imported and exported symbols.
