[improved Analyzer] Add dotnetfile to PE_Info

[mlodic]

We could add .NET written files in PE_Info and, in case it matches, we could run the package dotnetfile (https://github.com/pan-unit42/dotnetfile) to extract static info from it

[g4ze]

hey! @mlodic The approach we want here is to check the file type here, if the file was assembled from .net then we run dotnetfile . what informations should we dump in the results?

[mlodic]

yes. To understand whether a it is a .net file or not there are many tricks, one of those is

            file_type = magic.from_buffer(self.binary)
            if ".Net" in file_type:

Then, from the dotnetfile you can create a dictionary of results based on the suggestions made here by the creator himself:
https://github.com/pan-unit42/dotnetfile/blob/c7ce2c58657ebfca44a27bd464e093af427301d8/examples/dotnetfile_dump.py#L24
Just take the "general information" that are extracted in those prints.

Does it make sense ?

[g4ze]

yes, makes sense.