Basic-File-Information-Gathering-Script - File triage for CTI and malware analysis: hashes,

项目说明

Basic File Information Gathering Script

File triage for malware analysts and CTI engineers: hashes, metadata, strings, entropy, YARA context, and static characteristics that become IOC enrichment and detection leads.

CTI Use

Use this as the first-pass file triage layer before deeper reverse engineering. The output helps answer: what is the file, what indicators does it expose, does it look packed or unusual, and what should be pivoted or hunted next?

Defender Outputs

| Output | Use |
|---|---|
| Hashes | IOC tracking and enrichment |
| Strings | URLs, paths, registry keys, suspicious terms |
| Entropy and byte stats | Packed/encrypted region hints |
| PE/ELF/Mach-O metadata | Static triage and capability clues |
| JSON/CSV | Case notes and automation |
| YARA scan results | Detection seed |

![Python ]()
![LIEF]()

A Python tool to extract comprehensi and characteristics from files. For malware analysts, digital forensics, and SOC engineers.

---

📖 Guide: how to use (with pictures)

→ One Tool to Rule Them All: File Metadata & Static Analysis for Malware Analysts and SOC Teams (Medium article)

Step-by-step guide with screenshots: installation, fileinfo.py vs Basic_inf_gathering.py, hashes, strings, YARA, full static analysis, and MalwareBazaar workflow.

---

Two interfaces

| Script | Use case |
|--------|----------|
| fileinfo.py | Recommended. Batch mode, JSON/CSV, PE/ELF/Mach-O, strings, optional YARA/ssdeep/tlsh. |
| Basic_inf_gathering.py | Single-file, human-readable table only (original behavior). |

---

fileinfo.py — robust & powerful

Features

Hashes: MD5, SHA-1, SHA-256, SHA-384, SHA-512 (single pass); optional ssdeep and tlsh when installed.

Formats: PE (Rich header, o, resources, signature, packing), ELF (entry, interpreter, sections/segments), Mach-O (entry, commands).

Magic numbers: 60+ file types (executables, archives, documents, media).

Strings: ASCII and UTF-16 LE extraction with configurable minimum length.

Output: Human-readable table, JSON, or CSV; optional output file.

Batch: Multiple files and/or recursi (-r).

Optional YARA: Rule scanning when yara-python and a rules file are provided.

Full static analysis (--full): Maximum metadata without decompilation or code analysis:

- Byte-level: null ratio, printable ratio, byte frequency, longest null run.
- Entropy map: per-block entropy to find packed/encrypted regions.
- Head/tail hex dump: first and last bytes for structure inspection.
- String patterns: URLs, IPv4, emails, Windows/Unix paths, registry keys (from raw bytes).
- PE deep: machine type, subsystem, DLL characteristics (ASLR, DEP, etc.), section table (name, size, entropy), full import/export lists, exphash, relocations, TLS callbacks, delay imports, Rich header, resource types, info (File, CompanyName, etc.).
- ELF deep: class, machine, sections/segments, dynamic (NEEDED, RPATH, RUNPATH), exported/imported symbols, notes.
- Mach-O deep: CPU type, file type, dylibs, segments, UUID.
- Containers: ZIP file listing (names, sizes); OLE stream listing (optional olefile).

Installation

Troubleshooting installation

ModuleNotFoundError: No module named 'lief' — Install dependencies inside the project directory with the venv activated (see below). Run the script with the same Python that has the packages (e.g. python3 Basic_inf_gathering.py file.exe after acti the venv).

venv/bin/activate: No such file or directory or venv/bin/python3: No such file or directory — The venv was not fully created. On Debian/Ubuntu you need the python3-venv package:

Then run scripts with python3 fileinfo.py ... or python3 Basic_inf_gathering.py ... while the venv is active.

venv/bin/pip: cannot execute: required file not found — The en is broken (e.g. Python path changed). Recreate it from the project root (where requirements.txt lives), and install the python3-venv package if needed (see above). Then:

No ven system install — You can install dependencies for your user with the system Python (no venv):

Usage

Options

| Option | Description |
|--------|-------------|
| paths | One or more files or directories. |
| -r, --recursive | Recurse into directories. |
| --json | Output JSON. |
| --csv | Output CSV (one row per file). |
| -o, --output | Write output to file. |
| --hashes | Comma-separated: md5, sha1, sha256, sha384, sha512. |
| --no-fuzzy | Disable ssdeep/tlsh. |
| --strings | Extract ASCII + Unicode strings. |
| --min-str-len | Minimum string length (default 6). |
| --no-pe / --no-elf / --no-macho | Skip that format’s analysis. |
| --yara | Path to YARA rules file. |
| --full | Full static analysis: byte stats, entropy map, head/tail hex, string patterns (URLs, IPs, paths, registry), PE/ELF/Mach-O deep (sections, imports/exports, relocs, info, etc.), ZIP/OLE listing. No decompilation. |
| -v, -- | errors to stderr. |

---

Basic_inf_gathering.py — simple single-file

Usage

Single file only.

Output: detailed table to stdout (PE timestamp, imphash, hashes, entropy, permissions, magic, file type, digital signature, entry point, packer).

Dependencies

Python 3.7+

LIEF: pip install lief

cryptography (optional, for PE certificate details): pip install cryptography

---

Examples (fileinfo.py)

---

Testing with real malware (from the wild)

To run the tool on real Windows PE malware and compare with MalwareBazaar metadata:

1. Get a free API key from abuse.ch Authentication (required for MalwareBazaar).
2. Install deps: pip install requests pyzipper
3. Download a sample and run full analysis:

Output (per sample) under malware_samples/<sha256>/:

Extracted binary (or sample.bin if not zipped)

our_analysis.json — full static report from fileinfo.py --full --json

bazaar_info.json — MalwareBazaar metadata (signature, imphash, ssdeep, tags, etc.) for comparison

Compare hashes, imphash, file type, and PE/string findings between our_analysis.json and bazaar_info.json (and any public report you have for that hash).

---

Project layout

fileinfo.py — Main CLI: hashes, PE/ELF/Mach-O, strings, YARA, --full static.

static_analysis.py — Deep static analysis module (byte stats, entropy map, PE/ELF/Mach-O deep, string patterns, ZIP/OLE). Used when --full is set.

download_malware_sample.py — Download real Windows PE samples from MalwareBazaar (abuse.ch), run full analysis, sa metadata for comparison.

Basic_inf_gathering.py — Legacy single-file table script.

Requirements

Python 3.8+ (for fileinfo.py), 3.7+ (for Basic_inf_gathering.py)

LIEF: required for PE/ELF/Mach-O parsing

cryptography: optional, for PE digital signature details

ssdeep / py-tlsh: optional, for fuzzy hashing

yara-python: optional, for YARA scanning

olefile: optional, for OLE/compound document stream listing in --full

---

Related repositories & articles

| Resource | Link |
|----------|------|
| Basic-File-Information-Gathering-Script (this repo) | GitHub · Medium: File Metadata & Static Analysis |
| Static-malware-Analysis-Orchestrator | GitHub — one-command pipeline (triage, strings, PE imports, unpack) · Medium: Full workflow |
| String-Analyzer | GitHub · Medium: String Analyzer Guide |
| PE-Import-Analyzer | GitHub · Medium: PE Import Analyzer Guide |
| Unpacker | GitHub · Medium: Unpacker Guide |
| Author | Medium @1200km |

---

License

See LICENSE for details.

1200km Ecosystem

This project is part of the 1200km security research ecosystem. Use Ad for CTI-to-detection workflows, ATT&CK/ATLAS mapping, actor relevance, IOC enrichment, and analyst-ready reporting.

Ad project hub

Ad documentation

Live ATT&CK/ATLAS workspace

1200km security research ecosystem

项目信息

开发语言：Python

Star 数：4

技术要点

该项目属于防护思路方向的开源资源，代码结构清晰，适合安全研究人员学习参考。项目围绕File triage for CTI and malware analysis: hashes, strings, entropy, metadata, YARA context, JSON and CSV output.展开，提供了可运行的实现，对理解相关安全机制、工具原理与攻防技术具有较高的研究价值。

从技术实现角度看，此类项目的核心在于对底层原理的深入理解与工程化落地。开发者在研究过程中可以结合官方文档与社区讨论，梳理项目的初始化流程、核心模块职责与数据流转，逐步掌握其中的技术细节与设计思路。

使用与学习建议

1. 下载源码压缩包，解压到本地环境。

2. 根据项目类型准备对应的运行环境与依赖。

3. 按照 README 中的步骤完成配置与部署。

4. 在隔离的测试环境中运行验证，避免影响生产系统。

免责声明

本资源来源于开源社区，仅供安全研究、技术学习与合法授权范围内的攻防演练使用，请勿用于任何非法或侵害他人权益的用途。使用本项目产生的一切后果由使用者自行承担。