MalFe

Please wait ...

Public Datasets

Ransomware Detection Using PE Resources Rows: 16943 | Cols: 8 | Reports Used: 3093

Description: The PE resources of an executable contain several files embedded ,such as icons, language files, etc. This can be meaningful information for ransomware detection.

Dataset SHA256: 7d68ace6f9a4198398ff8a541b9438da8f06326daeda6008cd0de8ffb8d1718f

Features (sample):

	name	language	filetype	sublanguage	offset	size	label	SHA256
0	RT_CURSOR	LANG_ENGLISH	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	SUBLANG_ENGLISH_US	2910000	308	M	4e0d1edb76747fd945b87dd18299298f0df719edbea946119d91db59a9b6527a
1	RT_CURSOR	LANG_ENGLISH	Targa image data - RGB 64 x 65536 x 1 +32 "\001"	SUBLANG_ENGLISH_US	2910000	308	M	4e0d1edb76747fd945b87dd18299298f0df719edbea946119d91db59a9b6527a
...	...	...	...	...	...	...	...	...
16941	RT_VERSION	LANG_ENGLISH	data	SUBLANG_ENGLISH_US	125298712	876	B	5af327637c70a968c335134436d69ec5a5a296b72bad994d48b8c6b042821903
16942	RT_MANIFEST	LANG_ENGLISH	XML 1.0 document, Unicode text, UTF-8 (with BOM) text, with very long lines (1741), with CRLF line terminators	SUBLANG_ENGLISH_US	125299588	1801	B	5af327637c70a968c335134436d69ec5a5a296b72bad994d48b8c6b042821903

16943 rows × 8 columns

Created by: Palesa
Downloaded 1 times
Comments Enabled: True
Comments: 0

def process(data, filename, sha256, category, malicious):
    try:
        # Implement your data processing here, this function will get called with the data of each 
        # report in the category you have selected along with the filename of the report and hash. 
        # Do your processing and add your data to the features array, and return the features_lables, features, and sha256
        # PLEASE NOTE: THE CODE BELOW SERVES AS AN EXAMPLE ONLY! This example extracts the entropy of the PE Sections. Which can be seen here: https://malfe.cs.up.ac.za/datasets/view/Entropy_of_PE_Sections/5
        ###

features_labels = ["name", "language", "filetype", "sublanguage", "offset", "size", "label"]
        features = []
        label =   "M" if malicious else "B"
        if "static" in data:
            if "pe_resources" in data["static"]:
                for pe in data["static"]["pe_resources"]:
                    features.append([pe["name"], pe["language"], pe["filetype"], pe["sublanguage"], int(pe["offset"], 16), int(pe["size"], 16), label])                  
               
        
        ###
        return features_labels, features, sha256
        
    except Exception as e:
        log("|process error| " + filename + " -> " + sha256 + " (" + str(e) + ")")
        pass

June 18, 2025, 10:58 p.m. Public Create New Vesion Download Dataset (2.3 MB)

Please wait ...

Public Datasets

Ransomware Detection Using PE Resources Rows: 16943 | Cols: 8 | Reports Used: 3093

Reports Used

Dataset Code

Comments

No comments to display