{"adoption": {"forks": 494, "observed_at": "2026-08-28T04:08:27.709700+00:00", "stars": 3867}, "canonical_url": "https://ross.abutalabs.com/products/pe-sieve", "card": {"archived": false, "artifact_type": "cli-tool", "description": "Scans a given process. Recognizes and dumps a variety of potentially malicious implants (replaced/injected PEs, shellcodes, hooks, in-memory patches).", "domain": ["security", "reverse-engineering", "windows", "developer-tools"], "enriched": true, "function": ["security", "reverse-engineering", "cli", "developer-tools"], "health_score": 87, "homepage": "https://hshrzd.wordpress.com/pe-sieve/", "language": "C++", "license": "BSD-2-Clause", "license_family": "permissive", "maturity": "active", "member_repos": ["hasherezade/pe-sieve"], "name": "hasherezade/pe-sieve", "platform": ["windows", "cli"], "pushed_at": "2026-06-06T12:46:00+00:00", "repo": "hasherezade/pe-sieve", "stars": 3867, "tags": ["malware-analysis", "memory-forensics", "pe-dumper", "process-scanner", "hook-detection", "process-hollowing", "dll-injection", "incident-response", "libpeconv", "json-reports"], "topics": ["pe-format", "hooking", "pe-dumper", "pe-analyzer", "libpeconv", "process-analyzer", "scans", "anti-malware", "pe-sieve", "malware-analysis", "memory-forensics"], "urls": [], "use_cases": ["detect malware running on a windows system", "dump injected pe files and shellcodes from a process memory", "detect process hollowing and reflective dll injection", "find inline hooks and in-memory patches in a running process", "collect malicious material from a live process for malware analysis", "integrate a process scanner into a security tool via dll api", "scan all running processes for suspicious implants"], "what_it_is": "PE-sieve is a lightweight Windows tool that scans a given process for malicious implants such as replaced or injected PE files, shellcodes, inline hooks, and in-memory patches, then dumps the suspicious material for further analysis. It can be built as a standalone EXE or as a DLL with a simple API for integration into other applications, and it produces JSON reports detailing the indicators found.", "when_to_avoid": ["you need a cross-platform scanner for linux or macos", "you want a full antivirus with real-time protection rather than an on-demand analysis tool", "you need static file analysis of samples on disk instead of live process memory inspection"], "when_to_choose": ["you need to triage a suspicious process on windows and extract its in-memory implants", "you want lightweight, per-process scanning with json reports of indicators", "you need to detect techniques like process hollowing, process doppelgänging, or reflective dll injection", "you want a dll engine you can embed into your own security or incident-response tooling"]}, "data_as_of": "2026-08-30T08:39:29.467469+00:00", "members": [{"path": "/products/pe-sieve", "repo": "hasherezade/pe-sieve", "role": "main", "score": 71}], "provenance": {"archived": {"kind": "observed", "observed_at": "2026-08-28T04:08:27.709700+00:00", "source": "github"}, "artifact_type": {"confidence": null, "enriched_at": "2026-08-29T18:25:50.390975+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "2dd81914f86a8795b2365d1d4eedcf6aad885808ee4447db2abff5e67e3f2f5d", "fetched_at": "2026-08-28T04:08:27.709700+00:00", "kind": "readme", "missing": false, "url": "https://github.com/hasherezade/pe-sieve"}, {"content_hash": "e5f332f42ba7f1d8b1711083fbef173f1b6dc386a0eb14055fdabd076d036fa3", "fetched_at": "2026-08-29T09:20:06.156821+00:00", "kind": "homepage", "missing": false, "url": "https://hshrzd.wordpress.com/pe-sieve/"}], "taxonomy_version": 1}, "description": {"kind": "observed", "observed_at": "2026-08-28T04:08:27.709700+00:00", "source": "github"}, "domain": {"confidence": null, "enriched_at": "2026-08-29T18:25:50.390975+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "2dd81914f86a8795b2365d1d4eedcf6aad885808ee4447db2abff5e67e3f2f5d", "fetched_at": "2026-08-28T04:08:27.709700+00:00", "kind": "readme", "missing": false, "url": "https://github.com/hasherezade/pe-sieve"}, {"content_hash": "e5f332f42ba7f1d8b1711083fbef173f1b6dc386a0eb14055fdabd076d036fa3", "fetched_at": "2026-08-29T09:20:06.156821+00:00", "kind": "homepage", "missing": false, "url": "https://hshrzd.wordpress.com/pe-sieve/"}], "taxonomy_version": 1}, "enriched": {"inputs": [], "kind": "computed", "method": "enrichment_status"}, "function": {"confidence": null, "enriched_at": "2026-08-29T18:25:50.390975+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "2dd81914f86a8795b2365d1d4eedcf6aad885808ee4447db2abff5e67e3f2f5d", "fetched_at": "2026-08-28T04:08:27.709700+00:00", "kind": "readme", "missing": false, "url": "https://github.com/hasherezade/pe-sieve"}, {"content_hash": "e5f332f42ba7f1d8b1711083fbef173f1b6dc386a0eb14055fdabd076d036fa3", "fetched_at": "2026-08-29T09:20:06.156821+00:00", "kind": "homepage", "missing": false, "url": "https://hshrzd.wordpress.com/pe-sieve/"}], "taxonomy_version": 1}, "health_score": {"inputs": ["days_since_push", "days_since_release", "archived"], "kind": "computed", "method": "health_v1"}, "homepage": {"kind": "observed", "observed_at": "2026-08-28T04:08:27.709700+00:00", "source": "github"}, "language": {"kind": "observed", "observed_at": "2026-08-28T04:08:27.709700+00:00", "source": "github"}, "license": {"kind": "observed", "observed_at": "2026-08-28T04:08:27.709700+00:00", "source": "github"}, "license_family": {"inputs": ["license"], "kind": "computed", "method": "license_family"}, "maturity": {"confidence": null, "enriched_at": "2026-08-29T18:25:50.390975+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "2dd81914f86a8795b2365d1d4eedcf6aad885808ee4447db2abff5e67e3f2f5d", "fetched_at": "2026-08-28T04:08:27.709700+00:00", "kind": "readme", "missing": false, "url": "https://github.com/hasherezade/pe-sieve"}, {"content_hash": "e5f332f42ba7f1d8b1711083fbef173f1b6dc386a0eb14055fdabd076d036fa3", "fetched_at": "2026-08-29T09:20:06.156821+00:00", "kind": "homepage", "missing": false, "url": "https://hshrzd.wordpress.com/pe-sieve/"}], "taxonomy_version": 1}, "member_repos": {"kind": "observed", "observed_at": "2026-08-28T04:08:27.709700+00:00", "source": "github"}, "name": {"kind": "observed", "observed_at": "2026-08-28T04:08:27.709700+00:00", "source": "github"}, "platform": {"confidence": null, "enriched_at": "2026-08-29T18:25:50.390975+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "2dd81914f86a8795b2365d1d4eedcf6aad885808ee4447db2abff5e67e3f2f5d", "fetched_at": "2026-08-28T04:08:27.709700+00:00", "kind": "readme", "missing": false, "url": "https://github.com/hasherezade/pe-sieve"}, {"content_hash": "e5f332f42ba7f1d8b1711083fbef173f1b6dc386a0eb14055fdabd076d036fa3", "fetched_at": "2026-08-29T09:20:06.156821+00:00", "kind": "homepage", "missing": false, "url": "https://hshrzd.wordpress.com/pe-sieve/"}], "taxonomy_version": 1}, "pushed_at": {"kind": "observed", "observed_at": "2026-08-28T04:08:27.709700+00:00", "source": "github"}, "repo": {"kind": "observed", "observed_at": "2026-08-28T04:08:27.709700+00:00", "source": "github"}, "stars": {"kind": "observed", "observed_at": "2026-08-28T04:08:27.709700+00:00", "source": "github"}, "tags": {"confidence": null, "enriched_at": "2026-08-29T18:25:50.390975+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "2dd81914f86a8795b2365d1d4eedcf6aad885808ee4447db2abff5e67e3f2f5d", "fetched_at": "2026-08-28T04:08:27.709700+00:00", "kind": "readme", "missing": false, "url": "https://github.com/hasherezade/pe-sieve"}, {"content_hash": "e5f332f42ba7f1d8b1711083fbef173f1b6dc386a0eb14055fdabd076d036fa3", "fetched_at": "2026-08-29T09:20:06.156821+00:00", "kind": "homepage", "missing": false, "url": "https://hshrzd.wordpress.com/pe-sieve/"}], "taxonomy_version": 1}, "topics": {"kind": "observed", "observed_at": "2026-08-28T04:08:27.709700+00:00", "source": "github"}, "urls": {"kind": "observed", "observed_at": "2026-08-28T04:08:27.709700+00:00", "source": "github"}, "use_cases": {"confidence": null, "enriched_at": "2026-08-29T18:25:50.390975+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "2dd81914f86a8795b2365d1d4eedcf6aad885808ee4447db2abff5e67e3f2f5d", "fetched_at": "2026-08-28T04:08:27.709700+00:00", "kind": "readme", "missing": false, "url": "https://github.com/hasherezade/pe-sieve"}, {"content_hash": "e5f332f42ba7f1d8b1711083fbef173f1b6dc386a0eb14055fdabd076d036fa3", "fetched_at": "2026-08-29T09:20:06.156821+00:00", "kind": "homepage", "missing": false, "url": "https://hshrzd.wordpress.com/pe-sieve/"}], "taxonomy_version": 1}, "what_it_is": {"confidence": null, "enriched_at": "2026-08-29T18:25:50.390975+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "2dd81914f86a8795b2365d1d4eedcf6aad885808ee4447db2abff5e67e3f2f5d", "fetched_at": "2026-08-28T04:08:27.709700+00:00", "kind": "readme", "missing": false, "url": "https://github.com/hasherezade/pe-sieve"}, {"content_hash": "e5f332f42ba7f1d8b1711083fbef173f1b6dc386a0eb14055fdabd076d036fa3", "fetched_at": "2026-08-29T09:20:06.156821+00:00", "kind": "homepage", "missing": false, "url": "https://hshrzd.wordpress.com/pe-sieve/"}], "taxonomy_version": 1}, "when_to_avoid": {"confidence": null, "enriched_at": "2026-08-29T18:25:50.390975+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "2dd81914f86a8795b2365d1d4eedcf6aad885808ee4447db2abff5e67e3f2f5d", "fetched_at": "2026-08-28T04:08:27.709700+00:00", "kind": "readme", "missing": false, "url": "https://github.com/hasherezade/pe-sieve"}, {"content_hash": "e5f332f42ba7f1d8b1711083fbef173f1b6dc386a0eb14055fdabd076d036fa3", "fetched_at": "2026-08-29T09:20:06.156821+00:00", "kind": "homepage", "missing": false, "url": "https://hshrzd.wordpress.com/pe-sieve/"}], "taxonomy_version": 1}, "when_to_choose": {"confidence": null, "enriched_at": "2026-08-29T18:25:50.390975+00:00", "kind": "inferred", "prompt_version": 1, "sources": [{"content_hash": "2dd81914f86a8795b2365d1d4eedcf6aad885808ee4447db2abff5e67e3f2f5d", "fetched_at": "2026-08-28T04:08:27.709700+00:00", "kind": "readme", "missing": false, "url": "https://github.com/hasherezade/pe-sieve"}, {"content_hash": "e5f332f42ba7f1d8b1711083fbef173f1b6dc386a0eb14055fdabd076d036fa3", "fetched_at": "2026-08-29T09:20:06.156821+00:00", "kind": "homepage", "missing": false, "url": "https://hshrzd.wordpress.com/pe-sieve/"}], "taxonomy_version": 1}}, "score": {"components": {"activity": 86, "longevity": 100, "rhythm": 35}, "computed_at": "2026-09-03T02:20:16.233290+00:00", "flags": [], "formula": "round(0.45*activity + 0.35*rhythm + 0.20*longevity); archived -> min(score, 10)", "inputs": {"age_days": 3299, "days_push": 88, "days_rel": 354, "gap_med": 49, "n_releases_24m": 4}, "score": 71, "version": 2}, "staleness": {"enrichment_outdated": false, "low_confidence": false, "scrape_days": 9, "stale_scrape": false}}