Tool
imprint
imprint analyzes Windows PE files by parsing import, delay-import and export directories without executing the image. It maps imported Windows APIs to categories and MITRE ATT&CK techniques, then reports capability patterns with the imports that triggered each finding in text or JSON.
- Targets
- Binary
- Category
- Native analysis tools
- Relationship
- Foundation tool
- Sources reviewed
Requirements & limits
- Prerequisites: A C11 compiler such as gcc, clang or MinGW is required to build it.
- Limits: Imports indicate possible capabilities, not observed execution; dynamically resolved APIs and packed payloads may be hidden.
- License: MIT license.
About this entry
The description was reviewed against primary sources.
Primary sources
- README.md GitHub · hamodywe/imprint · Revision b63df33
- docs/architecture.md GitHub · hamodywe/imprint · Revision b63df33
More in Native binaries
- kdemulator · Tool
- DownUnderCTF: masked-squares flag checker · Case study
- Show Your Work: a measured dissection of REA's evidence architecture · Case study
- Windows loader: static malware analysis with REA and Codex · Case study
- OpenBSD netcat: static REA and Ghidra investigation · Case study
- m0rph: tracing an obfuscated ELF flag checker · Case study