def is_suspicious(pe):
    """
    unusual locations of import tables
    non recognized section names
    presence of long ASCII strings
    """

    relocations_overlap_entry_point = False
    sequential_relocs = 0

    # If relocation data is found and the entries go over the entry point, and also are very
    # continuous or point outside section's boundaries => it might imply that an obfuscation
    # trick is being used or the relocations are corrupt (maybe intentionally)
    #
    if hasattr(pe, "DIRECTORY_ENTRY_BASERELOC"):
        for base_reloc in pe.DIRECTORY_ENTRY_BASERELOC:
            last_reloc_rva = None
            for reloc in base_reloc.entries:
                if reloc.rva <= pe.OPTIONAL_HEADER.AddressOfEntryPoint <= reloc.rva + 4:
                    relocations_overlap_entry_point = True

                if (
                    last_reloc_rva is not None
                    and last_reloc_rva <= reloc.rva <= last_reloc_rva + 4
                ):
                    sequential_relocs += 1

                last_reloc_rva = reloc.rva

    # If import tables or strings exist (are pointed to) to within the header or in the area
    # between the PE header and the first section that's suspicious
    #
    # IMPLEMENT

    warnings_while_parsing = False
    # If we have warnings, that's suspicious, some of those will be because of out-of-ordinary
    # values are found in the PE header fields
    # Things that are reported in warnings:
    # (parsing problems, special section characteristics i.e. W & X, uncommon values of fields,
    # unusual entrypoint, suspicious imports)
    #
    warnings = pe.get_warnings()
    if warnings:
        warnings_while_parsing

    # If there are few or none (should come with a standard "density" of strings/kilobytes of data) longer (>8)
    # ascii sequences that might indicate packed data, (this is similar to the entropy test in some ways but
    # might help to discard cases of legitimate installer or compressed data)

    # If compressed data (high entropy) and is_driver => uuuuhhh, nasty

    pass

    unusual locations of import tables
    non recognized section names
    presence of long ASCII strings
    
peutils.py