Skip to main content

Module strings

Module strings 

Source
Expand description

String extraction from PE binary data.

Scans raw bytes for runs of printable ASCII characters and UTF-16LE text. Used to find embedded C2 URLs, file paths, registry keys, and IOC strings.

Constants§

MIN_STRING_LEN
Minimum string length (in characters) to include in the output.

Functions§

compute_entropy
Shannon entropy of a byte slice (0.0 – 8.0).
extract_ascii
Extract ASCII strings of at least min_len consecutive printable chars from bytes.
extract_utf16le
Extract UTF-16LE strings of at least min_len printable chars from bytes.