code: def is_suspicious( pe ):
      
  
      relocations_overlap_entry_point = False
      sequential_relocs = 0
  
      # If relocation data is found and the entries go over the entry point, and also are very
      # continuous or point outside section's boundaries => it might imply that an obfuscation
      # trick is being used or the relocations are corrupt (maybe intentionally)
      #
      if hasattr(pe, 'DIRECTORY_ENTRY_BASERELOC'):
          for base_reloc in pe.DIRECTORY_ENTRY_BASERELOC:
              last_reloc_rva = None
              for reloc in base_reloc.entries:
                  if reloc.rva <= pe.OPTIONAL_HEADER.AddressOfEntryPoint <= reloc.rva + 4:
                      relocations_overlap_entry_point = True
  
                  if last_reloc_rva is not None and last_reloc_rva <= reloc.rva <= last_reloc_rva + 4:
                      sequential_relocs += 1
  
                  last_reloc_rva = reloc.rva
  
  
  
      # If import tables or strings exist (are pointed to) to within the header or in the area
      # between the PE header and the first section that's supicious
      #
      # IMPLEMENT
  
  
      warnings_while_parsing = False
      # If we have warnings, that's suspicious, some of those will be because of out-of-ordinary
      # values are found in the PE header fields
      # Things that are reported in warnings:
      # (parsing problems, special section characteristics i.e. W & X, uncommon values of fields,
      # unusual entrypoint, suspicious imports)
      #
      warnings = pe.get_warnings()
      if warnings:
          warnings_while_parsing
  
      # If there are few or none (should come with a standard "density" of strings/kilobytes of data) longer (>8)
      # ascii sequences that might indicate packed data, (this is similar to the entropy test in some ways but
      # might help to discard cases of legitimate installer or compressed data)
  
      # If compressed data (high entropy) and is_driver => uuuuhhh, nasty
  
      pass
docs: unusual locations of import tables
      non recognized section names
      presence of long ASCII strings