Change history for pestudio standard

2023-11-08 21:56:38
Updated by __philippe

Size (in bytes): 23854~~0598~~080

2023-11-08 21:53:29
Updated by __philippe

Version: v9.525
Release date: 2023-069-0318

2023-06-05 11:05:10
Updated by rbon

Version: v9.502
Size (in bytes): 40~~66441~~59880
Release date: 2023-046-2203

2023-04-22 12:06:00
Updated by __philippe

Size (in bytes): 4076764417

2023-04-22 11:56:14
Updated by __philippe

Release date: 2023-034-022

2023-04-22 11:55:19
Updated by __philippe

Version: v9.4850

2023-03-03 11:19:32
Updated by rbon

Version: v9.478
Size (in bytes): 40~~59902~~76717
Release date: 2023-023-032

2023-02-05 09:41:45
Updated by rbon

Version: v9.347
Size (in bytes): 3640599~~178~~02
Release date: 2023-02-0~~5-12~~3

2022-05-14 07:06:03
Updated by Andrew Lee

Version: v9.314
Release date: 2022-035-312

2022-04-06 08:49:01
Updated by Andrew Lee

Version: v9.301
System Requirement:
Release date: 2022-03-314

2022-03-18 02:08:55
Updated by Andrew Lee

Version: v9.2930
Release date: 2022-023-184

2022-02-24 06:51:26
Updated by Andrew Lee

Version: v9.279
Release date: 2022-012-198

2022-01-23 06:53:45
Updated by Andrew Lee

Version: v9.267
Release date: 2022-01-0619
What's new: See: [url]https://www.winitor.com/tools/pestudio/changes.log[/url]

2022-01-06 18:59:29
Updated by Special

Version: v9.256
Release date: 2022-01-~~12-28~~06

2022-01-02 04:40:24
Updated by Andrew Lee

Version: v9.225
Release date: 2021-12-0428

2021-12-10 05:16:24
Updated by Andrew Lee

Version: v9.212
Release date: 2021-11-2-04

2021-11-23 05:19:27
Updated by Andrew Lee

Version: v9.201
Release date: 2021-11-207

2021-11-09 07:04:38
Updated by Andrew Lee

Version: v9.1820
Release date: 2021-101-097

2021-11-06 09:47:13
Updated by __philippe

Categories: [Security - Forensic Tools]

2021-10-09 05:33:53
Updated by Andrew Lee

Version: v9.178
Release date: 2021-109-2409

2021-09-24 08:07:10
Updated by Andrew Lee

Version: v9.167
Release date: 2021-09-0924
What's new: ~~[list][*]~~Staee:[url]https://www.winitor.com/tools/pest udio/chan~~dling .NET str~~geams~~[*]Fix bu~~.logs[/url~~ist~~]

2021-09-10 08:25:17
Updated by Andrew Lee

Version: v9.156
Release date: 2021-089-1209
What's new: [list][*]~~Fix a bug when computing the offset of stri~~Start handling ~~items[*]Add Resource context menu to change the severity of~~.NET s~~igna~~tureams[*]Fix bugs[/list]

2021-08-13 07:37:51
Updated by Andrew Lee

Version: v9.145
Release date: 2021-078-212
What's new: [list][*]~~Add~~Fix a Lib~~raries context menu to toggle bla~~ug when c~~klist~~ omputing the offset ofla string items[*]~~Fix bugs whe~~Add Resource context menu to change the severity modif~~ying~~ isign~~dic~~atour~~'s s~~e~~verity~~ ~~level~~[/list]

2021-07-22 07:51:29
Updated by Andrew Lee

Version: v9.134
Release date: 2021-067-261
What's new: . [list][*]A~~dd Resources context menu to toggle language blacklist flag. Extend File-header detection. Exten~~dd ~~Opt~~Li~~onal-he~~brader ~~det~~ies ction.text menu to Ftoggle blacklist flag[*]Fix bugs when modifying indicator's severity level[/list]

2021-06-27 08:15:32
Updated by Andrew Lee

Version: v9.123
Release date: 2021-06-0526
What's new: ~~[list][*]Add File-Header characteristics[*]Add Option-Header characteristics[*]Add Ordinal name mapping for delay-loade~~. Add ~~libra~~Resourices~~[*]Add detai~~ context menu to toggl~~s to Certificate[*]Extend det~~e~~ction of~~ ~~stri~~lang ~~hints[*]Extend~~ uage blacolkl~~ection o~~ist f ~~DateTime stamp indicators[*]Ext~~lag. Extend File-header detectionn. Extend Optional-headextr mdetection~~us[*]~~. Fix bugs~~[/list]~~

2021-06-05 18:04:29
Updated by Special

Version: v9.0912
Release date: 2020-1~~2-2~~-06-05
What's new: [list][*]Add ~~handling o~~File-Header characteristics[*]Add Option-Header characteristics[*]Add Ordinal name mapping for delay-loaded libraries[*]Add details to Certificate[*]Extend detection of string hints[*]Extend collection of RDateTime stamp indic~~h-he~~ators[*]Extend context mer.nus[*]Fix a bug ~~when handling malformed relocation~~s ~~table.~~[/list]

2020-12-26 18:12:27
Updated by billon

Version: v9.089
Size (in bytes): 36~~3433~~91780
Release date: 2020-11-2-26
What's new: [list][*]~~Exten~~Add ~~context me~~han~~us.[*]Exte~~dlin~~d detection~~ g o~~f embedded~~f fRilch-hesader.[*]Fix a bug when handling malformed relocations table.[/list]

2020-11-28 14:37:26
Updated by billon

Version: v9.078
Size (in bytes): 36~~12587~~34330
Release date: 2020-0911-242
What's new: [list]~~[*]Add Sections > Characteristics field.[*]Show Relocations and Exceptions.~~[*]Ex~~tend support of MUI files.[*]Fixed bugs:[list][*]When retrieving executable hidden in~~ tend~~ata~~ sec~~tion;[*]Ab~~ountext ~~> Ch~~meck nups.[*]Extend daete~~;[*]GUID pd~~ction of embedded files.[/l*]Fix bugst].[/list]

2020-09-26 14:54:32
Updated by billon

Version: v9.067
Size (in bytes): 3601285387
Release date: 2020-089-294
What's new: [list]~~[*]Extend User-Interface to handle XML-based settings.~~[*]Ad~~d setting filters for online-score, i~~d Section~~dicator~~s, ~~mit~~> Characte erist~~c.[*]S~~ics field.[*]Shoow ~~duplicated export~~ Relocations ~~for 64bit e~~and Execuept~~able~~ions.[*]FiExetend ~~bugs:[list][*]When c~~ suppo~~mputing minimum~~rt of MUI ~~str~~fing le~~ngth;~~s.[*]Fixed bugs:[list][*]When retrieving exec~~omp~~ut~~ing fi~~able~~-offset of~~ rehidden in data sectiourn;[*]About > Check updates;[*]GUID pdb.[/list][/list]

2020-08-30 20:18:21
Updated by billon

Software title: pestudio basictandard
Version: v9.056
Synopsis: pestudio shows details about applications and other system files ([i].exe[/i], [i].dll[/i], [i].cpl[/i], [i].ocx[/i], [i].ax[/i], [i].sys[/i] etc.) without starting them including:[list][*]Libraries that are used by an application[*]Functions that are imported by an application[*]Functions (also anonymous) that are exported by an application[*]All functions that are forwarded to other libraries[*]Obsolete Functions that are exported and imported by an application[*]If Data Execution Prevention (DEP) Windows security mechanism is used[*]If Address Space Layout Randomization (ASLR) Windows security mechanism is used[*]If Windows security mechanism Structured Exception Handling (SEH) is used[*]Whether some sections are compressed[/list]pestudio basictandard [url=https://www.winitor.com/features]lacks some features[/url] of pro version.
Size (in bytes): 3602853~~5368~~
Release date: 2020-048-1729
What's new: [list][*]AExtend User-Interface to handle XML-basedd settings.[*]Add setting filters for online-score, indicatorset, mitre etc.[*]Show duplingcated exports d for 64bit executaloble.[*]Fixed bugs:[list][*]When computing minimum string length;[*]When tco hamputindg file-offset ~~[i]s~~of resource~~tting~~s.~~xml~~[/~~i] fi~~l~~e.[*]F~~i~~x bug~~s.t][/list]

2020-04-19 13:36:04
Updated by billon

Writes settings to: NApplication folder

2020-04-19 13:33:28
Updated by billon

Version: v9.045
Size (in bytes): 3532536847
Release date: 2020-04-017
What's new: [list][*]Add swettings dialog to handle [i]setti~~tch upper-case|lower-case Hash value~~ngs.xml[/i] file.[*]Fix ~~Virustotal Impha~~bugs~~h query~~.[/list]

2020-04-18 22:46:07
Updated by billon

Software title: pestudio basic
Synopsis: pestudio shows details about applications and other system files ([i].exe[/i], [i].dll[/i], [i].cpl[/i], [i].ocx[/i], [i].ax[/i], [i].sys[/i] etc.) without starting them including:[list][*]Libraries that are used by an application[*]Functions that are imported by an application[*]Functions (also anonymous) that are exported by an application[*]All functions that are forwarded to other libraries[*]Obsolete Functions that are exported and imported by an application[*]If Data Execution Prevention (DEP) Windows security mechanism is used[*]If Address Space Layout Randomization (ASLR) Windows security mechanism is used[*]If Windows security mechanism Structured Exception Handling (SEH) is used[*]Whether some sections are compressed[/list]pestudio ~~free lacks some features of pro version,~~ bas~~ee compar~~i~~son~~c [url=hthttps:/~~/ww~~/ww.w~~ini~~.winitor.com/featour~~.com/too~~es]l~~s/pestudio/~~ac~~urrent/pe~~ks s~~tudi~~o~~-fe~~me feature~~s.pdf]here~~s[/url] ~~(PDF~~of pro ~~fil~~ve!)rsion.
Download URL: https://www.winitor.com/gtools/pestudio/current/pestudio.~~html~~zip

2020-04-07 18:30:37
Updated by billon

Version: v9.034
Size (in bytes): 3573284~~906~~7
Release date: 2020-034-2807
What's new: [list][*]Add s~~hort/long M~~wit~~re Vie~~ch upper-case|low ~~swit~~er-case Hash values.[*]Fiix bVirustotal Imphash qugsery.[/list]

2020-03-28 17:56:48
Updated by billon

Version: v9.023
Size (in bytes): 3574906~~6301~~
Release date: 2020-03-0128
What's new: [list][*]Add seahor~~ch Virustotal-in~~tel/l~~igence f~~orng sMitre Vingew switch.[*]Fix bugs.[/list]

2020-03-01 14:23:55
Updated by billon

Version: v9.012
Size (in bytes): 356~~5584~~6301
Release date: 2020-023-101
What's new: [list][*]~~Extend in~~Add search Virustotal-intelligencate for strings.[*]Fix bugs.[/list]

2020-02-11 18:01:22
Updated by billon

Version: v9.001
Size (in bytes): 356558~~710~~4
Release date: 20~~19-1~~20-02-0811
What's new: [list][*]~~Detect when compiler time stamp is outside of certificate time stamp range.[*]Add Mitre Tactics detection a~~Extend ind Micator~~e View~~s.[*]Fix bugs.[/list]

2020-01-21 20:38:06
Updated by billon

Similar/alternative apps: [url=https://www.portablefreeware.com/index.php?id=2858]PPEE[/url], [url=https://www.portablefreeware.com/index.php?id=2929]PE Anatomist[/url]

2019-12-27 18:44:59
Updated by billon

Categories: [Programming - Resource Tools]

2019-12-08 09:45:22
Updated by billon

Version: v89.9900
Size (in bytes): 3565872310
Release date: 2019-102-068
What's new: [list][*]Detect when compiler time stamp is outside of certificate time stamp range.[*]Addd Mitre Tactics detection and Mitre ~~Techn~~Vi~~que det~~e~~ction~~w.[*]Fix bugs.[/list]

2019-10-06 05:52:31
Updated by billon

Version: v8.989
Size (in bytes): 3565~~395~~723
Release date: 201~~9-0~~9-140-06
What's new: [list][*]ExAdd Mitre~~nd in~~ Technique d~~icators with fun~~etection~~(s) group(s)~~.[*]Fix bugs.[/list]

2019-09-14 17:37:59
Updated by billon

Version: v8.978
Size (in bytes): 35~~7612~~53953
Release date: 2019-089-114
What's new: [list]~~[*]Change syntax of [i]pestudio.exe[/i] parameters.~~[*]Extennd Iindicators with function(s) group(s).[*]Fix bugs.[/list]

2019-08-11 10:06:53
Updated by billon

Version: v8.967
Size (in bytes): 3577260123
Release date: 2019~~-06~~-08-11
What's new: [list][*]Change syntax of [i]pestudio.exe[/i] parameters.[*]Extend Indicators.[*]Fix bugs.[/list]

2019-06-08 18:08:45
Updated by billon

Version: v8.956
Size (in bytes): 377~~1819~~2602
Release date: 2019-06-018
What's new: [list][*]FiEx ~~a bug when han~~tend~~ling~~ seIndicators.[*]Fionx bugs.[/list]

2019-06-02 10:34:17
Updated by billon

Version: v8.945
License: [url=https://www.winitor.com/features.html]Freree for personal use/Litewarre[/url]
Synopsis: pestudio shows details about applications and other system files ([i].exe[/i], [i].dll[/i], [i].cpl[/i], [i].ocx[/i], [i].ax[/i], [i].sys[/i] etc.) without starting them including:[list][*]Libraries that are used by an application[*]Functions that are imported by an application[*]Functions (also anonymous) that are exported by an application[*]All functions that are forwarded to other libraries[*]Obsolete Functions that are exported and imported by an application[*]If Data Execution Prevention (DEP) Windows security mechanism is used[*]If Address Space Layout Randomization (ASLR) Windows security mechanism is used[*]If Windows security mechanism Structured Exception Handling (SEH) is used[*]Whether some sections are compressed[/list]pestudio ~~standa~~frdee lacks some features of pro version, see comparison [url=https://www.winitor.com/tools/pestudio/current/pestudio-features.pdf]here[/url] (PDF file!).
Size (in bytes): 377~~5054~~1819
Download URL: https://www.winitor.com/~~tools/pestudio/current/p~~gest~~udio~~.~~zip~~html
Release date: 2019-0~~5-2~~6-01
What's new: [~~list][*]Indicate virtualised sections.[*]Handle (very) long strings.[*]Extended:[list][*]Indicators;[*]Detection of anomalies.[/~~list][*]Fix a bug when handling sections.[/list]

2019-05-27 02:19:58
Updated by billon

Version: v8.934
Size (in bytes): 377~~7811~~5054
Release date: 2019-05-0526
What's new: [list][*]Indicate ~~when entry-point i~~virtualised sections ~~located at the beginning of the file~~.[*]~~Fixed:[list][*]A bug when handling exports by ordinals;[*]A bug when h~~Hand~~ling entry-point outsid~~le ~~the first s~~(ve~~ction (a.k.a. MZ-inst~~rucy) long stri~~ons ca~~ncgs.[*]Extendelld:[list][*]Indicatiors;[*]Detection) of anomalies.[/list][*]Fix bugs.[/list]

2019-05-05 11:49:19
Updated by billon

Version: v8.923
Size (in bytes): 37778~~63696~~11
Release date: 2019-045-305
What's new: [list][*]AdInd ~~detect~~icate when entry-poin ~~of au~~t~~o-elevation based the manifest.[*]Fixed:[list][*]A bug when handling~~ is located at the beginning of th~~e original file name of 64bit~~e file.[*]Fixed:[lis;t][*]]A bug g wh~~en ha~~en handlling exports by ordin~~g the m~~a~~nifest of 64bit fi~~les;[*]A bug wh when ~~showi~~ handling ent~~he entro~~ry-py oin t~~he XML~~ ~~rep~~outside the first section (a.k.a. ~~fil~~MZ-instructions cancellation).[/list][/list]

2019-05-01 06:34:26
Updated by billon

What's new: [list][*]Add detection of auto-elevation based the manifest.~~[list]~~[*]Fixed:[list][*]A bug when handling the original file name of 64bit files;[*]A bug when handling the manifest of 64bit files;[*]A bug when showing the entropy in the XML report file.[/list][/list]

2019-05-01 06:33:34
Updated by billon

Version: v8.912
Size (in bytes): 3863469926
Release date: 2019-034-310
What's new: [list][*]~~Extend indi~~Add detec~~ators.[*]~~tion of auto-elevation based the manifest.[list][*]Fiix ed:[list][*]A bug when handling the original file name of 64bit files;[*]A bug when handling the manifest of 64bit files;[*]A bug when showing the entropy in th~~andling ve~~e XML reporyt file.[/l~~ong un~~i~~code~~ st~~rings.~~][/list]

2019-03-31 08:29:23
Updated by billon

Version: v8.901
Size (in bytes): 3634~~7078~~992
Release date: 2019-03-031
What's new: [list][*]~~Detect more a~~Exten~~omalies.[*]Show~~d fi~~rst-bytes-tex~~ndicat ~~of res~~ources.[*]AFix a bug when hand~~d some miss~~ling very long uni~~tems in the XML r~~code~~port~~ fstrilengs.[/list]

2019-03-03 16:13:31
Updated by billon

Version: v8.890
Release date: 2019-023-103

2019-03-03 16:12:40
Updated by billon

Size (in bytes): 364756078
What's new: [list][*]SyDetect more ancomalies.[*]Shro~~nise~~w first-bytes-text of resources.[*]Add some missing ~~the con~~items in~~t of~~ the e XML report wfi~~th th~~le ~~GUI.[*]Fix bugs~~.[/list]

2019-02-10 13:36:14
Updated by billon

Version: v8.889
Size (in bytes): 3868347568
Release date: 2019-012-120
What's new: [list][*]~~Fix a bug when handling export XML file from the CLI.[*]Extend overview of time-date stamps.[*]Handle more malformation of sections and show indi~~Sync~~ators appr~~hro~~priately.[*]Add sample name analy~~nis~~ed in th~~e the c~~aptio~~ontent of pthe XML resportud wioth the GUI.[*]Fix bugs.[/list]

2019-01-12 13:33:53
Updated by billon

Version: v8.878
Size (in bytes): 38~~122~~68348
Release date: 2019-01-012
What's new: [list][*]~~Detect TLS Callback functions~~ Fix a bug when handling export XML f~~or 64b~~itle from ~~execu~~t~~abl~~he CLI.[*]Extend~~s:[list][*]Secti~~ ons v~~iew~~erview of wti~~th "S~~melf-mod~~ifying" tag;[*]MSDN search on i~~ate stam~~ports;[*]Google search on exports;[*]Google search on string~~ps.~~[/list]~~[*]~~Show hashes~~ Handle mo~~f Ce~~r~~tificat~~es tmalfo rmation of sections and s~~e hu~~how intdicators appropringately.[*]FAdd sample name analysed i~~x bug~~n the caption of pestudio GUI.[/list]

2019-01-01 14:13:34
Updated by billon

Version: v8.867
Size (in bytes): 3798912283
Release date: 20189-012-016
What's new: [list][*]~~Add~~ Detect TLS Callback functionse for 64bit executarcble.[*]Extends:[list][*]Sections view with "Self-modifying" tag;[*]MSDN search on imports;[*]Google search on exports;[*]Google search on strings.[/list][*]Show hashes of ~~Googl~~Certificates ~~and~~to ~~Virustot~~ea~~l for re~~s~~ourc~~es hunting.[*]Fix bugs.[/list]

2018-12-16 06:22:44
Updated by billon

Version: v8.856
Size (in bytes): 3798792253
Release date: 2018-12-0516
What's new: [list][*]~~Clean~~ A~~PI classificati~~dd search Go~~n.[*]Extend~~ogle ~~several~~and ~~context men~~Viru~~s.[*]Sh~~sto~~w time date s~~tamp l fofr directsourices.[*]Fix bugs.[/list]

2018-12-05 18:21:52
Updated by billon

Synopsis: pestudio shows details about applications and other system files ([i].exe[/i], [i].dll[/i], [i].cpl[/i], [i].ocx[/i], [i].ax[/i], [i].sys[/i] etc.) without starting them including:[list][*]Libraries that are used by an application[*]Functions that are imported by an application[*]Functions (also anonymous) that are exported by an application[*]All functions that are forwarded to other libraries[*]Obsolete Functions that are exported and imported by an application[*]If Data Execution Prevention (DEP) Windows security mechanism is used[*]If Address Space Layout Randomization (ASLR) Windows security mechanism is used[*]If Windows security mechanism Structured Exception Handling (SEH) is used[*]Whether some sections are compressed[/list]pestudio standard lacks some features of pro version, see comparison [url=https://www.winitor.com/tools/pestudio/current/pestudio-features.pdf]here[/url] (PDF file!).

2018-12-05 17:18:25
Updated by billon

Version: v8.845
Size (in bytes): ~~4006~~378725643
Release date: 2018-112-095
What's new: [list][*]FiClean API classification.[*]Extend several ~~bugs.[*]Add google sear~~c~~h t~~ontext sme~~ctions hash.[*]Compute hashes of Ver~~nus~~ion blob~~.[*]AdShow time d ~~googl~~ate seta~~rch using hashes o~~mp of Vdirectories.[*]Fionx b~~lob~~ugs.[/list]

2018-11-09 19:53:37
Updated by billon

Version: v8.834
Size (in bytes): 4006~~7913~~564
Release date: 2018-11-039
What's new: [list][*]~~Show file hashes with and without ov~~Fix bugs.[*]Add google search to sections hash.[*]Compute hashes of Version blayob.[*]~~Fix~~ Add google search busing whashes of Version ~~hand~~bl~~ing em~~ob~~edded files~~.[/list]

2018-11-03 17:28:32
Updated by billon

Version: v8.823
Size (in bytes): 42067914339
Release date: 2018-1~~0-2~~1-03
What's new: [list][*]~~Extend goog~~Show file ~~search to imphash, hashes of image, pdb, dos-stub,~~hashes with and without overlay ~~to ease hunting.[*]Add underlining items to indicate google search URL link.[*]~~.[*]Fiix~~ed:[list][*]A~~ cra~~sh on Win10;[*]A~~ buug whhenn hand~~ump~~ling sectmbedded fi~~ons.[/~~liest].[/list]

2018-10-22 12:33:47
Updated by billon

Version: v8.812
Size (in bytes): 384261433987
Release date: 2018-108-121
What's new: [list][*]AdExtend google search to imphash, hashes of image, pdb, dos-stub, overlay to ease hunting.[*]Add underlining items to ind seicate google searrch URL link.[*]Fixed:[list][*]A c~~h google for~~ rastrh on Win10;[*]A bug when dumpings visewctions.[*]Show detai/l~~s of v~~irust~~otal report.~~][/list]

2018-08-13 02:00:32
Updated by billon

Version: v8.801
Size (in bytes): 38~~1783~~26987
Release date: 2018-078-152
What's new: [list][*]~~Han~~Add search googlee for strings cview.[*]Show deta~~racter~~ils~~tics speci~~ of~~ic to EFI~~ ~~exec~~virustotable ~~fil~~re~~s.[*]Fix bugs~~port.[/list]

2018-07-15 14:27:05
Updated by billon

Version: v8.7980
Size (in bytes): 3817832~~9504~~
Release date: 2018-07-015
What's new: [list][*]~~Exte~~Hand ~~detection o~~le characteristics specific ~~embedded~~to EFI executa~~ble to al~~ble sfilects.[*]Fionx bugs.[/list]

2018-07-01 16:20:29
Updated by billon

Version: v8.789
Size (in bytes): 38~~149~~279504
Release date: 2018-067-01
What's new: [list][*]FExtend detectixon of embedded ~~a b~~execugtable to ~~when~~all ~~det~~secti~~ng res~~o~~urces type~~ns.[/list]

2018-06-02 06:06:05
Updated by billon

Version: v8.778
Size (in bytes): 3814~~444~~927
Release date: 2018-056-013
What's new: [list][*]~~Compute SHA1 and SHA256 for dos-stub and for de~~Fix a bug~~ger.[*]Extend~~ twh~~e de~~en detect~~ion of embedded file(s)~~ ing resovurce~~rla~~s types.[/list]

2018-05-13 13:37:20
Updated by billon

Version: v8.767
Size (in bytes): 398~~5592~~14444
Release date: 2018-045-0213
What's new: [list][*]~~Fix sorting of Virustotal scores.[*]Exten~~Compute SHA1 and SHA256 for dos-stub and for d ~~context Menu of Vir~~ebu~~stotal vi~~ggewr.[*]AdExtend ~~support of "favori~~the~~-engine"~~ ~~for V~~detectiruon of embedded file(st) in otaverlay.[/list]

2018-04-03 08:45:40
Updated by billon

Version: v8.756
Size (in bytes): 3~~8069~~985592
Release date: 2018-034-023
What's new: [list][*]~~Extend strings detection by indicating presence of API and Librar~~Fix sorting of Vi~~es st~~r~~ing~~us in theotal ~~Imp~~sco~~rt Table~~res.[*]FiExtend ~~fli~~ckontext Mering u of Virustotheal view.[*]Add support of "favorite-engine" for Virustotal.[/list]

2018-03-24 09:36:22
Updated by billon

Version: v8.745
Size (in bytes): 3980697195
Release date: 2018-023-253
What's new: [list][*]Extend strings detection by indicating presence of API and Libraries strings in the Import Table.[*]Fix ~~a bug with the~~ flic~~reatio~~kering of t~~he XML report~~he fvilews.[/list]

2018-02-25 21:21:12
Updated by billon

Version: v8.734
Size (in bytes): 4039697~~008~~19
Release date: 2018-02-0425
What's new: [list][*]~~Add functions groups to the strin~~Fix a bugs Vwi~~ew.[*]Extend functions groups to~~ th the ~~delay-loaded fun~~creations of the XML report file.[/list]

2018-02-05 17:50:36
Updated by billon

Version: v8.723
Size (in bytes): 403~~9688~~70608
Release date: 2018-012-104
What's new: [list][*]~~Show functions that are delay-loa~~Aded~~.[*]Extend:[list][*]Context menu for imports to cope with [i]fun~~ functio~~ns.xml[/i] file;[*]Groups of impo~~ns grtoups~~.[/li~~ to the stringst] View.[*]FiExtend ~~a b~~fu~~g when handl~~nctions groups to the de~~prec~~lay-loatded functions.[/list]

2018-01-15 00:32:11
Updated by billon

Version: v8.712
Size (in bytes): 3968830~~143~~6
Release date: 20178-012-154
What's new: [list][*]Show functions that are delay-loaded.[*]Exxtend:[list][*]Context menu for imports to cope with [i]functions.xml[/i] file;[*]Groups of imports.[/liste][*]Fix a bug when handling deprecated ~~groups o~~f unctimportns.[/list]

2017-12-15 23:52:50
Updated by billon

Version: v8.701
Size (in bytes): 38293057143
Release date: 2017-11-2-15
What's new: [list][*]Ex~~pose the indicators id number in the output XML file.[*]Extended:[list][*]Grouping of utilities;[*]Grouping of imports by~~ type~~s a~~nd ~~col~~groups of imports.~~[/list]~~[/list]

2017-11-27 04:18:15
Updated by billon

Version: v8.6970
Size (in bytes): 382~~168~~9057
Release date: 2017-101-3025
What's new: [list][*]AdExpose the indicators id number in the output XML file.[*]Extend ed:[list][*]Grouping of utilities;[*]Grouping of im~~ports~~ports by types and colors.[*]Extend string/lis ~~"hin~~t~~" detection and mapping.~~][/list]

2017-10-30 15:34:58
Updated by billon

Version: v8.689
Size (in bytes): 38~~0738~~21685
Release date: 2017-10-1530
What's new: [list][*]ExAdd grouping of imports by types and~~ed:[~~ coliorst].[*~~]Signatur~~]Extes nde st~~ection;[*]Strings~~rings "h~~int~~int" detection and mappiping.~~[/list]~~[/list]

2017-10-15 21:54:19
Updated by billon

Version: v8.678
Size (in bytes): 36801573281
Release date: 2017-10-0815
What's new: [list][*]MExtended:[list][*]Signap tures detection;[*]Str~~ings~~ ings "hint" detection ~~their Human-frie~~andly nameapping.[/list][/list]

2017-10-08 20:24:01
Updated by billon

Version: v8.667
Size (in bytes): 36015~~942~~362
Release date: 2017-10-018
What's new: [list][*]~~Add detection of strings "hint" (e.g. GUID, RTTI, ..).[*]Fix a bug when computing the position of the entry-~~Map~~oint when it i~~ s ~~located at~~ t~~he ve~~r~~y beginn~~ings "hint" tof ~~a s~~thectior Human-friendly name.[/list]

2017-10-01 22:10:58
Updated by billon

Version: v8.656
Size (in bytes): 35~~850~~914236
Release date: 2017-109-2401
What's new: [list][*]~~Compute the Sha256 of the image and the overlay.[*]Exten~~Add an d ~~consol~~etection of strings "hidant" (e.g. GUID, ~~the~~ RTTI~~ndicators~~, ..).[*]Fix a a bug wh when computing the position of the entry-point wh~~andling a~~en it is located at the very bueginning ~~typ~~of a section.[/list]

2017-09-25 16:12:14
Updated by billon

Version: v8.645
Size (in bytes): 3568509801
Release date: 2017-09-024
What's new: [list][*]~~Add [f~~Compute the Sha256 onf t=he im~~onosp~~a~~ce][/font] in [i]settings.~~ge and the overlay.[*]Ex~~ml[/i] to hide the whilelist strings.[*]Extend I~~tendic a~~tors.[*]Fix bugs:[list][*]When showing exports of 64bit file;[*]When showi~~n~~g the~~ d coffnset oflidate th~~e Security~~e DIndirecatorys.[/*]Fix a bug when handlisng a debug t]ype.[/list]

2017-09-05 23:58:17
Updated by billon

Version: v8.634
Size (in bytes): 35689~~631~~80
Release date: 2017-089-2104
What's new: [list][*]Added [font=monospace][/font] in [i]settings.xml[/i] to hide the whilelist strings.[*]Exte~~ctio~~n ~~of whitlelist (well-k~~d Inodicators.[*]Fix bugs:[list][*]When showing exports of 64bit file;[*]When) strhowing~~s, deprecated~~ ~~and und~~the offset of the Secu~~ment~~rity Dire~~d fun~~ctionsry.[*]Conso/li~~date indica~~st~~ors.~~][/list]

2017-08-21 14:27:54
Updated by billon

Version: v8.623
Size (in bytes): 36256947631
Release date: 2017-08-121
What's new: [list][*]~~Extended:[list][*]The resource type~~Added d~~ete~~etection~~;[*]Handling of malformed manifest;[*]Handling~~ of whit~~he fi~~leelist (well-known) s~~igna~~tur~~e.[/l~~ings~~t][*]Det~~, deprec~~t "u~~ated and un~~usual"~~ do~~s-st~~cub mented functions.[*]Cons~~sag~~olidate indicators.[/list]

2017-08-13 09:38:28
Updated by billon

Version: v8.612
Synopsis: pestudio shows details about applications and other system files (.exe, .dll, .cpl, ocx, .ax, .sys, etc.) without starting them including:[list][*]Libraries that are used by an application[*]Functions that are imported by an application[*]Functions (also anonymous) that are exported by an application[*]All functions that are forwarded to other libraries[*]Obsolete Functions that are exported and imported by an application[*]If Data Execution Prevention (DEP) Windows security mechanism is used[*]If Address Space Layout Randomization (ASLR) Windows security mechanism is used[*]If Windows security mechanism Structured Exception Handling (SEH) is used[*]Whether some sections are compressed[/list]pestudio standard lacks some features of pro version, see comparison [url=https://www.winitor.com/tools/pestudio/current/pestudio-features.pdf]here[/url] (PDF file!).
Size (in bytes): 361259~~055~~47
Release date: 2017-078-212
What's new: [list][*]Increase performance when loading executable with large collection of exports.[*]Consolidated:[list][*]Switches in [i]settings.xml[/i];[*]API classification.[/list][*]Added:[list][*]Online check of update in the "About" dialog;[*]Support for ARM detection.[/list][*]Indicate missing library.[*]E~~xtend features of s~~xt~~andard version.[*]Fixed bugs~~ended:~~[list][*]When handl~~[li~~ng the Thread-Local Storage (TLS);[*]Of the Manife~~st ~~View;~~][*]WThen resource type detecection;[*]Handlin~~g 64-bit~~g of malformed manifest;[*]Handling of thed file signature.[/list][*]Detect "unusual" dos-stub messages.[/list]

2017-07-23 16:02:43
Updated by billon

Release date: 2017-057-202

2017-07-23 16:01:30
Updated by billon

Version: v8.601
Size (in bytes): 3614891055
Keywords: pe%20studio
What's new: A[list][*]Increase performance when loading executable with large collection of exports.[*]Consolidated:[list][*]Switches in [i]settings.xml[/i];[*]API classification.[/list][*]Added:[list][*]Online check of update in the "About" dialog;[*]Support for ARM detection.[/list][*]Indicate missing library.[*]Extend features of standard~~ed:~~ version.[l*]Fixed bugst]:[list][*]When handling the Thread-Local Storage (TLS);[*]Of the Manifest View;[*]DWhen detecttiong 64-bit ~~of Co~~man~~trol Flow Gu~~arged ~~(CFG)~~files.[*]Detai/l~~s for V~~irust~~otal view.~~][/list]

2017-05-21 21:20:21
Updated by billon

Version: v8.5960
Size (in bytes): 3621~~736~~4891
Release date: 2017-05-201
What's new: ~~[list][*]Show first bytes (hex) of reso~~Added:[list][*]Detection of Control Flow Gu~~rces.[*]Show first bytes (hex and text) of file.[*]H~~anrd~~le empty~~ ~~entry-point~~(CFG).[*]~~Ext~~Dendtails ~~Indicat~~for Virustotal view.[/list]

2017-05-01 23:53:04
Updated by billon

Version: v8.589
Size (in bytes): 362~~007~~1736
Release date: 2017-045-201
What's new: [list][*]FShow first bytes (hex) ~~a c~~of resouraces.[*]Sh ow~~ith~~ first bytes (hex and text) o~~me 64b~~f fitle.[*]Handle empty e~~xecutables~~ntry-point.[*]AdExtend Ind~~ete~~icat~~ion~~ o~~f missing libra~~r~~ies.[*]Extent statu~~s~~-bar~~.[/list]

2017-04-21 20:02:41
Updated by billon

Version: v8.578
Size (in bytes): 3609240071
Release date: 2017-04-210
What's new: [list][*]~~Extended:[list][*]Translations;[*]Exports handling;[*]Imports handling;[*]Signatures.[/list][*]Clean and E~~Fix~~tend~~ ~~indi~~a cra~~tor~~s~~.[*]S~~ho w~~:[list][*]First bytes of entrypoint;[*]F~~i~~rst bytes of~~th ovsome~~rlay;[*]Dos-stu~~ 64bit messxecutagbles.[/*]Add detection of missing libraries.[*]Extent stat]us-bar.[/list]

2017-04-11 12:53:46
Updated by billon

Version: v8.567
Size (in bytes): 3610924~~767~~0
Release date: 2017-024-2610
What's new: ~~. Com~~[list][*]Extended:[list][*]Translations;[*]Exports handling;[*]Imports handling;[*]Signatures.[/list][*]Clean and Extend indicators.[*]Show:[list][*]First bytes of entrypoint;[*]First bytes of~~ile-ratio for resources, sections,~~ overlay ~~and d~~;[*]Dos-stub~~. Extent file~~ sum~~mary. Extent file~~ ess~~ign~~a~~ture det~~ge~~ction~~. F[/li~~x bug~~st][/list]

2017-02-26 23:58:55
Updated by __philippe

What's new: . Compute file-ratio for resources, sections, overlay and dos-stub. Extent file summary. Extent file signature detection. Fix bugs

2017-02-26 19:05:51
Updated by __philippe

Version: v8.556
Size (in bytes): 3609147967
Release date: 2017-012-026
What's new: [list][*]Differentiate between standard and professional (pro) versions of pestudio.[*]Added:[list][*]Detection of overlay;[*]Computation of entropy;[*]Detection of TLS Callback functions;[*]Indicators.[/list][*]Show:[list][*]More details about sections;[*]Overlay strings numbers;[*]Strings location map with colors.[/list][*]Detect duplicated exported symbols.[*]Enhanced unicode strings detection.[*]Differentiate URLs referenced in the certificate.[*]Extented Indicators.[*]Dump PKCS7 Certificate.[*]Fixed:[list][*]Crash;[*]Bug with libraries;[*]Other bugs.[/list][/list]

2017-01-02 17:04:34
Updated by billon

Icon: Updated

2017-01-02 16:59:42
Updated by billon

Website URL: https://www.winitor.com/
Version: v8.4955
Synopsis: pestudio shows details about applications and other system files (.exe, .dll, .cpl, ocx, .ax, .sys, etc.) without starting them including:[list][*]Libraries that are used by an application[*]Functions that are imported by an application[*]Functions (also anonymous) that are exported by an application[*]All functions that are forwarded to other libraries[*]Obsolete Functions that are exported and imported by an application[*]If Data Execution Prevention (DEP) Windows security mechanism is used[*]If Address Space Layout Randomization (ASLR) Windows security mechanism is used[*]If Windows security mechanism Structured Exception Handling (SEH) is used[*]Whether some sections are compressed[/list]pestudio standard lacks some features of pro version, see comparison [url=https://www.winitor.com/tools/pestudio/current/pestudio-features.pdf]here[/url] (PDF file!).
How to extract: Download the ZIP package and extract to a folder of your choice. Delete [i]AddToShell.reg[/i] and [i]RemoveFromShell.reg[/i]. Launch [i]pestudio.exe[/i].
Size (in bytes): 3546097~~383~~96
Download URL: https://www.wini~~tor.c~~tor.com/t/tools/prevstudio/cusrrent/pestudio~~849~~.zip
Release date: 20157-051-032
What's new: [list][*]ADifferentiate between standard and professional (pro) versions of pestudio.[*]Added:[list][*]Detection of overlay;[*]Computation of entropy;[*]Detection of TLS Callback functions;[*]Indicators.[/list][*]Show:[list][*]More details about sections;[*]Overlay strings numbers;[*]Strings location map with colors.[/list][*]Detect duplicated exported symbols.[*]Enhanced unicode strings detection.[*]Differentiate URLs referenced in the certificate.[*]Extented ~~detectio~~In dicators.[*]Dump PKCS7 Certif ~~Win~~icate.[*]Fixed~~ows bui~~:[list][*]Crash;[*]Bug winth selibrarvices.;[*~~]Fixed a~~ ]Other bug ~~when hand~~s.[/l~~ing~~ istrings.[*]~~Leveraged Indicators for embedded files.~~[/list]

2016-12-22 03:12:48
Updated by billon

Similar/alternative apps: [url=https://www.portablefreeware.com/index.php?id=2858]PPEE[/url]

2016-12-09 00:18:32
Updated by webfork

Synopsis: pestudio shows details about applications ~~(.ex~~and other system files (.exe, .dll, .cpl, ocx, .ax, .sys, etc.) without starting them including:[list][*]Libraries that are, .used~~ll,~~ .cby an appl, ication[*]Func~~x, .ax, .sy~~tions, ~~etc.) wi~~th~~out st~~art~~ing them including:[list][*]All libraries that are used by an application.[*]All functions that are imported by an application.[*]All functions (also anonymous) that are exported by a~~ are imported by an application[*]Functions (also anonymous) that are exported by an ap~~plica~~plication.[*]All function~~s that are~~ s that are forrwardded to other libraries.[*]O~~bsolete~~ bsolete F~~unct~~unctions t thaat are exported and imported by an application[*]If Dat a~~re e~~ Ex~~port~~e~~d and~~ cutimpon Prte~~d by an appl~~vention (DEP) Windows security mecha~~tio~~n.ism is used[*]~~Whethe~~If Addr ~~the Dat~~ess Space ~~Exec~~Layout~~ion~~ ~~Preve~~Rantido~~n (DEP~~mization (ASLR) Window~~s security~~ s security mechanism iss used.[*]If W~~hether the Addr~~indows se~~ss Spa~~c~~e Layo~~urity ~~Rando~~mizechatnionsm (AS~~LR) W~~tructured Exceptindo~~ws security mecha~~n~~ism is used.[*]Whether Structured~~ ~~Exception Ha~~Handling - (SEH ~~Windows security mechanism~~ ) is usesed.[*]Wh~~ether some sec~~ether some sections are compressed.[/list]

2016-05-19 19:12:09
Updated by billon

Version: v8.5149
System Requirement:
Size (in bytes): 354738~~1121~~3
Download URL: https:~~//ww~~//w~~.wi~~inittor.com/toools/previous/pestudio85149.zip
Release date: 2015-085-1703
What's new: [list][*]Renamed pestudioprompt.exe into pestudiox.exe.[*]Added virustotal scoring of hardcoded URL.[*]Added detection of pipes.[*]Added Network Watchdog to update Virustotal score automatically.[*]Added XML switches to define the colors of the front-end.[*]Fixed ordinaAdded detection of Windows buil ~~functions mapping for 64bi~~t ~~images.[*]Fixed a crash when handl~~ing oservice~~rlay~~s.[*]Fixed a bug when ~~retriev~~handling ~~the De~~scrtri~~ptio~~ngs.[*]Leveraged ~~of the~~ Indelica~~y-l~~toadrs for embedded ~~librar~~files.[/list]

2015-08-18 18:32:06
Updated by Checker

Version: v8.501
Size (in bytes): 35~~47607~~81121
Download URL: http://www.winitor.com/tools/pestudio8501.zip
Release date: 2015-058-0517
What's new: [list][*]~~Fixe~~Renamed pestudioprompt.exe into pestudiox.exe.[*]Added virustotal scoring of hardcoded URL.[*]Added detection of pipes.[*]Added Network Watchdog to update Virustotal score automatically.[*]Added XML switches to define the colors of the front-end.[*]Fixed ordinal functions mapping for 64bit images.[*]Fixed a crash when handling overla y.[*]Fixed a bug wh~~en ha~~endl retrieving the De~~xpo~~script~~ed fu~~ionc of t~~ions~~he delay-lofaded ~~54b~~li~~t execut~~brablries.[/list]

2015-05-19 01:30:10
Updated by billon

Software title: PpeSstudio
Synopsis: PpeSstudio shows details about applications (.exe, .dll, .cpl, ocx, .ax, .sys, etc.) without starting them including:[list][*]All libraries that are used by an application.[*]All functions that are imported by an application.[*]All functions (also anonymous) that are exported by an application.[*]All functions that are forwarded to other libraries.[*]Obsolete Functions that are exported and imported by an application.[*]Whether the Data Execution Prevention (DEP) Windows security mechanism is used.[*]Whether the Address Space Layout Randomization (ASLR) Windows security mechanism is used.[*]Whether Structured Exception Handling - SEH Windows security mechanism is used.[*]Whether some sections are compressed.[/list]
How to extract: Download the ZIP package and extract to a folder of your choice. Launch [i]PpeSstudio.exe[/i].

2015-05-06 19:37:28
Updated by Checker

Version: v8.4950
Size (in bytes): 3547~~383~~607
Download URL: http://www.winitor.com/tools/pestudio84950.zip
Release date: 2015-05-035
What's new: [list]~~[*]Added detection of Windows builtin services.~~[*]Fix~~ed a~~ ed a bug w~~hen~~hen handl~~ing strings.[*]Levera~~ing e~~d Indicators f~~xpor ~~embedd~~ted functions of 54bit executables.[/list]

2015-05-04 19:26:33
Updated by Checker

Version: v8.489
Size (in bytes): 34754745383
Download URL: http://www.winitor.com/tools/pestudio8489.zip
Release date: 2015-045-1703
What's new: [list][*]~~Extended Thresholds.[*]Extended I~~Added detection of Windows bui~~cators.[*]Show virustotal score for Over~~l~~ay (when available).[*]Fixed an~~tin iss~~ue in the Debug det~~ervic~~tion~~es.[*]Fixed an ~~iss~~bug whe n handlin g stri~~mport~~ngs.[*]Leve~~d symbols by o~~raged Indi~~nal~~ cators for 64embitedded files.[/list]

2015-04-17 21:06:59
Updated by Checker

Version: v8.478
Size (in bytes): 34617745800
Download URL: http://www.winitor.com/tools/pestudio8478.zip
Release date: 2015-034-0817
What's new: [list][*]~~Adde~~Extended cThresho~~mpu~~lds.[*]Ext~~atio~~en ofded I~~mpo~~ndicators.[*]Show virustotal s ~~Has~~core for Overlay (when (avai~~mph~~lashble)~~.[*]Added detection of~~ .[*]Fixed an isstrue ings the Demb~~edded in n~~ug detectio~~n-PE files~~n.[*]EFix~~tend~~ed ~~detection~~an issue ofin imporocted ssymbols by or ~~types.[*]Fixe~~d ~~a ha~~in~~gup.[*]Upd~~a~~ted~~l for AV64bit filiest.[/list]

2015-03-08 18:53:48
Updated by Checker

Version: v8.467
Size (in bytes): 3461855070
Download URL: http://www.winitor.com/tools/Ppe~~Studio/Current/PeS~~studio847.zip
Release date: 20~~000-00~~15-03-08
What's new: [list][*]Added ~~new~~ computation of Imports Hash (imphash).[*]Added detection of streingsh embedded in non-PE fildes.[*]Extended detection of processor types.[*]Fixed a ~~cras~~h ~~with m~~a~~lformed files~~ngup.[*]~~Corrected du~~Up~~lic~~datesd ~~during~~AV ~~col~~l~~ect~~i~~on of functions statis~~st~~ics~~.[/list]

2015-01-09 18:35:17
Updated by Checker

Version: v8.456
Size (in bytes): 3438557307
What's new: [list][*]Added ~~Virustotal aging and submi~~new thresholds.[*]Extended detection.[*]Fixed a crash with malfon rmedat files.[*]ExCorrect~~end~~ed ~~Lang~~duplica~~ges d~~tets during collecttion of functions sta~~nd mapp~~tingstics.[/list]

2014-12-10 17:59:12
Updated by Checker

Version: v8.445
Size (in bytes): 3435927530
What's new: [list][*]Added ~~PeID S~~Virustotal aging~~nature detection of Exec~~ and su~~table e~~bm~~bedded~~ i~~n Re~~s~~ourc~~sion dates.[*]~~Added PeID Signature detection of~~ Ex~~ecu~~t~~able emb~~ended Languages ded etection ~~Overl~~aynd mapping.[/list]

2014-11-28 18:24:45
Updated by Checker

Version: v8.434
Size (in bytes): 335~~3686~~9275
What's new: [list][*]Added ~~XML-based det~~Pe~~ction of PeID~~ID Signanature~~s.[*]Added XML-based detection of~~ ~~OIDs.[*]Add~~detection of Executable e~~d XML-~~mbased d~~etect~~ed in Reso~~n of~~ useragcents.[*]~~Ext~~Added PeID Signature detection of Executable embedded bin Overla~~cklists~~y.[/list]

2014-11-24 12:18:00
Updated by Checker

Version: v8.423
Size (in bytes): ~~211~~311353686
What's new: [list][*]Added ~~detection of references to Fire~~XML-based detection of PeID Signatures.[*]Added XML-based detection oxf APOIDs.[*]Adddded XM~~D5 Blacklist for a file and i~~L-based detect~~s Res~~ion of usercagesnt.[*]Exten~~ded de~~ted blacklist~~ion of Overlay~~s.[/list]

2014-11-03 17:25:39
Updated by Checker

Version: v8.412
Size (in bytes): 209113~~674~~115
What's new: [list][*]~~Extended validation~~ Added detection of references to Firefox API.[*]Added MD5 Blacklist for a f ~~Sect~~ile and its Resonurces.[*]~~Resolve Ope~~Exten~~SSL~~ded ordetection~~als API~~ tof ~~User f~~Over~~iend~~lay ~~names~~.[/list]

2014-10-26 16:18:17
Updated by Checker

Version: v8.3941
Size (in bytes): 20936~~2158~~74
What's new: [list][*]Extended validation of S~~mall c~~ectio~~smetic issues.[*]Added Indicators and Threshold~~ns.[*]FResolve OpenSSL ordi~~xed a bug when h~~nandl~~ing the imp~~s API tort Us ~~of som~~er frimendly nagmes.[/list]

2014-10-15 17:22:29
Updated by Checker

Version: v8.389
Size (in bytes): 20~~493~~642158
What's new: [list][*]~~Added~~Small cosmetic issues.[*]Added Indicatores ~~Indicators and Thresholds.[*]Added Functions Groups classification.[*]Resources wit~~and Th ~~unknown Signature and containing only text are now tagged as T~~re~~xt.[*]Fixed a bug when handling the Characteristic~~s ho~~f the FileHeader~~lds.[*]~~Add~~Fixed a bug whe~~d MD5, SHA1~~ n hand Vling the imporuts~~total Sc~~ ore f sorme Ovimage~~rlay~~s.[/list]

2014-10-10 12:48:35
Updated by Checker

Version: v8.378
Size (in bytes): 120491438964
What's new: [list][*]Added more Indicators and Thresholds.[*]Added Functions Groups classification.[*]Resources with unknown Signature and containing only text are now tagged as Text.[*]Fix~~ed a bug~~ed a bug whhen handling the Charactenristics of the FileHeader.[*]Added MD5, SHA1 hanndl Ving rustotheal Score for Overlay.[/list]

2014-09-05 16:45:38
Updated by Checker

Version: v8.357
Size (in bytes): 1905143896
What's new: [list][*]~~Added XML Threshold of~~Fixed a ~~num~~b~~er of Antivir~~u~~s detectin~~g twhen ~~image~~ has ndlin~~fec~~g thed .[/list]

2014-08-23 16:02:51
Updated by Checker

Version: v8.345
Size (in bytes): 19058916
What's new: [list][*]~~Extended Imported Symbols View.[*]Extended Indicato~~Added XML Thres~~.[*]Adde~~hold ~~XML Thresh~~ o~~lds f~~f number o~~r several values.[*]Added XML "pre~~f~~ered"~~ Antiivirus Endetecting the image as infe ~~Name~~cted.[/list]

2014-08-22 16:36:45
Updated by Checker

Version: v8.334
Size (in bytes): 190~~7024~~5891
What's new: [list][*]Extended Imported Symbols View.[*]Extended Indicators.[*]Added XML Thresholds for several values.[*]Added XML ~~Thr~~ "prefered" Antivirus~~hold~~ oEngine ~~Libr~~Narime~~s count~~.[/list]

2014-08-16 17:57:43
Updated by Checker

Version: v8.323
Size (in bytes): 1904270124
What's new: [list][*]Added XML Thres~~upport for White listing of Libraries per name in PeStudi~~ho~~WhiteListLibraries.xm~~l~~.[*]Fixe~~d ~~a bug in the collectio~~ on ~~of l~~Libraries count.[/list]

2014-08-14 18:56:33
Updated by Checker

Version: v8.312
Size (in bytes): 1901542061
What's new: [list][*]~~Extended Sections View.[*]Extended Bl~~Added support for White listing of Libraries per na~~cklists.[*]Extended detection.[*]Extended the XML report~~me ~~result~~in~~g of~~ PeStudioWh~~e analysis.[*]Fixed upda~~ite ~~of V~~LirustotLibra~~l Lookup~~ries.xml.[*]Fiixeded ~~Ordinal to Name m~~a~~pping for~~ 64bug in the imcollection of libragries.[/list]

2014-08-12 17:22:00
Updated by Checker

Version: v8.301
Size (in bytes): 1~~8738~~9015206
What's new: [list][*]~~Images analysed are n~~Extended Sectio~~w parsed i~~n s~~eparated~~ ~~Thr~~Vieadw.[*]EEx~~tended det~~te~~ctio~~n ~~of Overlay.[*]Added Thresholds for Image S~~ded Blackli~~ze.[*]Added Threshold~~s ~~for Certifica~~t~~e Size~~s.[*]~~Added Defaul~~Ext ~~Thr~~e~~shol~~nded ~~for R~~destectio~~urces~~n.[*]FiExtended athe XML report crasesulting of the ~~when a~~analysing s.[*]Fixed update of Virustotal Lookup.[*]Fixed Ordinal to Name mapping for 64biit filmages.[/list]

2014-07-06 09:41:53
Updated by Checker

Version: v8.2630
Size (in bytes): 18738~~601~~52
What's new: [list][*]~~Begin detection of Fu~~Images analysed are now parsed in separated Thread.[*]Extended detection of Overlay.[*]Added Thresholds for Image Size.[*]Added Thresholds for Certifictate Size.[*]Added Default Threshold for Reso~~ns req~~u~~iring Ac~~rces~~s Rights (privileges) to be set~~.[*]EFixtend~~ed Th~~ a crash when analysing sho~~lds~~me ~~detec~~64bit fionles.[/list]

2014-05-04 12:32:21
Updated by Checker

Version: v8.256
Size (in bytes): 17~~072~~826015
What's new: [list][*]Begin detection of Functions requiring Access Rights (privileges) to be set.[*]Exteende~~d featu~~d Thre~~s and black~~sholidst detection.[/list]

2014-04-29 17:44:36
Updated by Checker

What's new: [list][*]Extended features and blacklist detection.[/list]

2014-04-29 17:44:10
Updated by Checker

Version: v8.245
Size (in bytes): 170~~4604~~7282
What's new: ~~[list][*]Extended features and blacklist detection.[/list]~~

2014-04-24 17:41:36
Updated by Checker

Version: v8.234
Size (in bytes): 17046~~939~~046
What's new: [list][*]Extended ~~blackli~~features~~t and~~ ~~Features detection.[*]Fixed a bug when h~~and blackli~~ng 64-bi~~st ~~Imag~~destection.[/list]

2014-04-16 18:44:24
Updated by Checker

Version: v8.223
Size (in bytes): 16~~88170~~93946
What's new: [list][*]Added detection of bound Libraries.[*]Setup detection of Common folder variables ([url=http://www.microsoft.com/security/portal/mmpc/shared/variables.aspx#startup]http://www.microsoft.com/security/portal/mmpc/shared/variables.aspEx~~#startup[/url]).[*]Setup~~ tende~~tection of~~d ~~KNOWNFOLDERID const~~blacklist and Fea~~nts represen~~t ~~GUIDs ([~~ur~~l=http://msdn.microsoft.com/en-us/library/dd378457(v=vs.85).aspx]http://m~~es d~~n.microsof~~et.ectio~~m/e~~n~~-us/l~~.[*]Fixed a brug when ha~~ry/~~nd~~d378~~ling 64~~57(v=vs.85).~~-bit Images~~px[/url])~~.[/list]

2014-04-15 16:31:30
Updated by Checker

Version: v8.212
Size (in bytes): 16~~6641~~88170
What's new: [list][*]~~Det~~Added detection of bound Libraries.[*]Setup detection of C~~lipboard Chain h~~o~~oking~~mmon folder variables ([url=http://www.microsoft.com/security/portal/mmpc/shared/variables.aspx#startup]http://www.microsoft.com/security/portal/mmpc/shared/variables.aspx#startup[/url]).[*]~~Ext~~Se~~nded Blacklist~~tup detection of KNOWNFOLDERID cofnstants represent APGUI~~.[*]Extended~~Ds ([url=http://msden.microsofte.com/en-us/library/dd378457(v=vs.85).aspx]http://msdn.mion crosof ~~Undo~~t.cuom/ente-us/library/dd ~~API~~378457(v=vs.85).aspx[/url]).[/list]

2014-04-11 18:54:02
Updated by Checker

Version: v8.201
Size (in bytes): 166641788
What's new: [list][*]~~Extended b~~Detect Clipboard Chain hooking.[*]Extended Blacklistt of API.[*]Exte~~nded the dete~~nded detectio~~n o~~n of SUndocumarent~~car~~ed ~~usage~~API.[/list]

2014-04-09 16:32:20
Updated by Checker

Version: v8.1920
Size (in bytes): 16506192788
What's new: [list][*]Extended blacklist of API.[*]DExtended the de~~ct Mouse and Keyboard Even~~t~~s pr~~ectio~~gram~~n of Smarticard us~~ynth~~age~~sis~~.[/list]

2014-04-07 16:41:26
Updated by Checker

Version: v8.189
Size (in bytes): 1645019~~110~~2
What's new: [list][*]Extended ~~detection of fi~~blacklist of API.[*]Dete~~s embed~~ct Mouse ande Keyboard i Events ~~Res~~prougrammatice s ayn~~d Ov~~the~~rlay~~sis.[/list]

2014-04-03 17:15:02
Updated by Checker

Version: v8.178
Size (in bytes): 164~~263~~9110
What's new: [list][*]~~Added support for detection of Undocumen~~Extended dete~~d API (PeStudioFunc~~ctionn of filesUn embedded in Resourc~~ume~~es antd Ove~~d.xm~~rl)ay.[/list]

2014-03-31 15:54:33
Updated by Checker

Version: v8.167
Size (in bytes): 16094882631
What's new: [list][*]FAdded support for detectixon of Undocumented ~~a bug~~API wh(Pen StudioFunctionsUnvdokicumen~~g PeS~~tuedio.ex~~e fro~~m ~~the prompt with a fi~~le).[/list]

2014-03-28 12:58:45
Updated by Checker

Version: v8.156
Size (in bytes): 160~~869~~9488
What's new: [list][*]~~Extended Hooking detect~~Fi~~on.[*]E~~x~~tend~~ed Bla~~cklist~~ bug whe~~d functio~~ns invoking PeStudio.exe from thect prompt wionth a file.[/list]

2014-03-26 18:29:31
Updated by Checker

Version: v8.145
Size (in bytes): 15608699~~4224~~
What's new: [list][*]Extended ~~detection of Overlay for InnoS~~Hooking detectupion.[*]~~Show~~ Extended Blacklis~~hri~~ted function~~ked~~s ~~DOS-Hea~~dertection.[/list]

2014-03-25 13:59:50
Updated by Checker

Version: v8.134
Size (in bytes): 159~~059~~4224
What's new: [list][*]Extended detection of Overlay for InnoSetup.[*]~~Added Pe~~S~~tudi~~hoWw sh~~iteListLibra~~rinked DOS-Heade~~s.xml~~r.[/list]

2014-03-23 20:33:01
Updated by Checker

Version: v8.123
Size (in bytes): 1590594~~4283~~
What's new: [list][*]ShExtended detection owf Overlay.[*]Added PeS~~igna~~tudioWhiteListLibraries.~~[*]B~~xml~~acklist Well-Known SID~~.[/list]

2014-02-27 19:03:59
Updated by Checker

Version: v8.112
Size (in bytes): 1543142583
What's new: [list][*]~~Fixed a bug w~~Sh~~en Dumping a resource.[*]Images in Wind~~ow~~s directories are considered as trusted.[*]Exte~~ Overlay Sign~~ded Fe~~ature~~s detection~~.[*]~~Extended~~ Blacklisti Well-Kngown SID.[/list]

2014-02-25 19:27:46
Updated by Checker

Version: v8.101
Size (in bytes): 1543~~605~~125
What's new: [list][*]Fixed a bug when Dumping a resource.[*]Images in Windows directories are considered as trusted.[*]Extended Features detection.[*]Extended Blacklist ~~DNS a~~in~~d IP APIs~~g.[/list]

2014-02-18 19:31:23
Updated by Checker

Version: v8.109
Size (in bytes): 15223605581
What's new: [list][*]~~Added detection of M~~Blackli~~cro~~soft ~~Detour.[*]Added detection of Hooki~~DNS angd IP APIs.[/list]

2014-02-17 16:18:08
Updated by Checker

Version: v8.089
Size (in bytes): 1521025481
What's new: [list][*]Added detection of AMicrosoft Detour.[*]Added detectioItn of Hooking.[/list]

2014-02-16 14:17:02
Updated by Checker

Version: v8.078
Size (in bytes): 1521054~~016~~
What's new: [list][*]A~~llow RAW-dumping using the context menu of any resource.[*]Extended Features detection.[*]Add~~dded ~~Dete~~ detection o of ~~Resources re~~AusetoIt.[/list]

2014-02-14 07:07:04
Updated by Checker

Dependencies: ~~None~~

2014-02-13 19:11:28
Updated by Checker

Version: v8.067
Size (in bytes): 1514830156
What's new: [list][*]~~Extended Feat~~Allow RAW-dumping using the context menu of any resource~~s detection.[*]Extended Blacklisting~~.[*]~~Show~~ Extended Fe~~fault Icon of the Image being analysed (which often helps~~ a~~s firs~~t ~~suspicio~~ures detection.[*]Addied Detecation of Resources r)euse.[/list]

2014-02-06 19:22:38
Updated by Checker

Version: v8.056
Size (in bytes): 14~~46972~~83015
What's new: [list][*]Extended Features detection .[*]Extetendded B~~lac~~lacklisting.[*]~~Extend~~Show default Icon of the Image being analysed (which often hedlps as first suspicious ind~~ete~~icat~~ion~~ o~~f embedded IP Ad~~r~~esses~~).[/list]

2014-01-31 18:20:35
Updated by Checker

Version: v8.045
Size (in bytes): 14384631972
What's new: [list][*]~~Added Feature detec~~Extioen ~~of R~~ded Fe~~gul~~atur ~~Expression~~es ~~(Rege~~detection .[*]Ex)tended Blacklisting.[*]~~Adde~~Extended d ~~Featur~~e ~~detec~~t~~ion of Servi~~ec~~e Con~~trion olf ~~Manag~~ermbedded IP ~~(SCM)~~Adresses.[/list]

2014-01-28 18:39:44
Updated by Checker

Version: v8.034
Size (in bytes): 14386~~070~~31
What's new: [list][*]Added ~~"Anomalies" Indi~~Feature detecatoion of Regular Expressions (Regex).[*]Added deFeaturec detectioon of ~~fak~~ Se Mrvic~~ros~~e Cofnt ~~executab~~rol~~es[*]Exte~~ Man~~ded "Fe~~atuger~~es"~~ (SCM).[/list]

2014-01-27 19:12:06
Updated by Checker

Version: v8.023
Size (in bytes): 143~~222~~6070
What's new: [list][*]Added ~~PeStudioFeatures.xml.[*]Added "Features" as part of the "Indicators". Features translates the APIs, and other data into "Features~~" ~~of the executable being analysed (e.g. The~~ A~~PI "FindFirstUrlCacheEntry()" is tra~~nsomal~~ated as "The~~ i~~mage access~~es ~~the~~ " I~~E P~~ndicator~~otecte~~s.[*]Added detection of ~~Stor~~fagke" FeMicrosoft executables[*]Extended "Feature).s" [/list]

2014-01-23 20:56:07
Updated by Checker

Version: v8.012
Size (in bytes): 14~~1579~~32226
What's new: [list][*]~~Extented PeStudioO~~Added PeStudioFeatures.xml.[*]Added "Features" as part of the "Indicators". Features translates the APIs, and other data into "Fealtures~~.xml~~" fo~~r LD~~f the executable being analysed (e.g. The AP bI "FindFirstUrlCacheEntry()" is otr~~din~~alns~~.[*]A~~lated~~ded a~~ as "Thre image accesses the IE Proltected f Stor ~~siz~~age" ~~of Custom Resources.[*]Extended P~~FeSatu~~dioTh~~re~~sholds.xml~~).[/list]

2014-01-19 14:30:29
Updated by Checker

Version: v8.001
Size (in bytes): 141527913
What's new: [list][*]~~Fixe~~Extented ~~a c~~PeStudioOrdinals.xml for LDAP by ordina~~sh when dis~~ls.[*]Added ab Threshol~~ing~~d for Vsirze of CusTto~~tal~~m ~~query~~Resources.[*]~~Show the Signature of~~ Extheended ~~files Embedd~~PeStud i~~n t~~oThre ~~Custom Res~~sho~~urce~~lds.xml.[/list]

2014-01-16 16:48:46
Updated by Checker

Version: v78.9900
Size (in bytes): 141452091
What's new: [list][*]~~Added Min/Max Threshold checks on HTML Resource size and Extented PeStu~~Fixed a crash when di~~oThreshold~~s~~.xm~~abl~~.[*]Exte~~in~~ted~~g ~~PeStud~~VirusTo~~Indicators.xml~~tal query.[*]~~Exten~~Show tedhe PeS~~tud~~ignature oOrf the files Embedded inal the Cus.xtoml Resources.[/list]

2014-01-15 17:47:57
Updated by Checker

Version: v7.989
Size (in bytes): 1410477520
What's new: [list][*]~~Extended PeStudioBl~~Added Min/Max Threshold checks on HTML~~istF~~ Resource size and Extented PeStudioThresholds.xml.[*]Extented PeStudioIndicationrs~~.xm~~.xml.[*]Extendted PeStudioBOrdinal~~ackLi~~s~~tLibraries.~~.xml~~.[*]Correct an issue when showing the Resources friendly names at the GUI~~.[/list]

2014-01-13 17:54:35
Updated by Checker

Version: v7.978
Size (in bytes): 14104~~992~~77
What's new: [list][*]Extended PeStudio~~Thresho~~BlackListFunctions.xml.[*]Extended PeStudioBlackListLibraries.xmml .[*]Correct an issue when showing tohe ~~dete~~Resourc~~t th~~es friendly Min/Max mes~~ize~~ ~~of M~~a~~nifes~~t the GUI.[/list]

2014-01-08 16:51:21
Updated by Checker

Version: v7.967
Size (in bytes): 13404998273
What's new: [list][*]~~New classification of Strings.[*]E~~Ext~~ended detection (and Indicator) of File Version Informatio~~en ~~suspicious fi~~deld~~s.[*]Extended~~ PeS~~tudioOrdinals.xml.[*]Corrected Ordinals mapping for 64 bit images.[*]Better visualization of Relocations entries.[*]Added Detection of Blacklisted Function of Delayed-loaded Libraries.[*]Added S~~tuppdioThr~~t for String~~es ~~Table~~holds.~~[*]A~~xml to d~~ded Det~~etect the Min/Max size onf oManif ~~Self-R~~e~~gistering DLL~~st.[/list]

2014-01-07 17:02:27
Updated by Checker

Version: v7.956
Size (in bytes): 1359827369
What's new: [list][*]~~Added detect~~New classification of Strings.[*]Extended detection (~~and In~~and Indiicato~~r) of a~~r) of File Version Information~~onym~~ suspiciouss fields.[*]Exptended PeStudioOrdinals.xml.[*]Corrrected Fu Ordinals mappincg for 64 bit images.[*]Bettier visualization of Relocations entries.[*]Ad~~ded~~ded deDet~~ectio~~ection (of Blancklisted ~~Indi~~Func~~ator) o~~tion of Delayed-loaded Libraries.[*]Added Support for ~~mul~~Stri~~ple Execut~~ngs Table ~~Section~~s.[*]Adde~~d detection (and Indicator) of mul~~d Detecti~~ple insta~~on~~ce Imported Functions~~ ~~Names.[*]Add~~of Self-Re~~d PeStud~~gi~~oEvasions.xml to~~ s~~uppo~~ter~~t the detection of attempts Evasions (Antidebugg~~ing~~).[*]Added (part of) exported MFC42 ordinals to~~ ~~PeStudioOrdinal~~DLLs~~.xml~~.[/list]

2013-12-23 22:19:14
Updated by Checker

Version: v7.945
Size (in bytes): 135895369
What's new: [list][*]~~Map Version Translation Information to user friendly stri~~Added detection (and Indicator) of anonymous Exported Functions.[*]Added detection (and Indicator) of multiple Executable Sections.[*]Added detection (and Indicator) of multiple instance Imported Functions Names.[*]Added PeStudioEvasions.xml to support the detection of attempts Evasions (Antidebugging).[*]~~Show~~Added (part of) Ve~~rsion~~xported MFC42 Tor~~anslat~~dion ~~Information Black~~alis t~~ed Languages.[*]Extented~~o PeStudioOrdinals.xml ~~to Resolve SNMP functions imported by Ordinals back to their original names~~.[/list]

2013-12-16 17:26:54
Updated by Checker

Version: v7.934
Size (in bytes): 13325801956
What's new: [list][*]Map Version Translation Information to user friendly string.[*]Show Version Translation Information Blacklisted Languages.[*]Extented PeStudioOrdinals.xml to Resolve SNMP functions imported by Ordinals back to their original names.[/list]

2013-12-14 16:45:46
Updated by guinness

Version: v7.893
What's new: ~~[list][*]Extended anomalies detection of File Version Information fields.[/list]~~

2013-12-05 16:27:47
Updated by Checker

Version: v7.889
Size (in bytes): 1331280671
What's new: [list][*]~~Added~~ Extended anomalies detec~~tion~~ tion of File Versigion Informat~~ure f~~iorn ~~the Resourc~~fields.[/list]

2013-12-04 12:15:22
Updated by Checker

Version: v7.878
Size (in bytes): 13~~295~~310672
What's new: [list]~~[*]Extended detection of embedded IP Addresses.[*]Extended malicious usage of Resource Icons.~~[*]Ad~~ded n~~dewd ~~Indic~~detection of signator ure foor ~~suspicious~~ the Resosourcce ~~Icon~~s.[/list]

2013-12-03 14:53:14
Updated by Checker

Version: v7.867
Size (in bytes): 132957288
What's new: [list][*]~~Added Support for Sections -> Conte~~Exttended Mdetection of embedded IP Addresses.[*]Extended malicious usagenu ->of DResoumprce Icons.[*]Addeded new ~~Supp~~Indicatort for ~~Dum~~suspi~~ng ICO as~~cious R~~AW and ICO.fil~~esource fIco~~rmat~~ns.[/list]

2013-11-30 18:40:55
Updated by Checker

Version: v7.856
Size (in bytes): 1325728860
What's new: [list][*]~~Extended detection of suspicious debugger fields (invalid content - e.g.: flame).[*]A~~Addedd PeS~~tudioF~~uncpport~~ionsMapping.XML to map Fun~~ for Section ~~Names (e.g. Sy~~st -> Context MemFnu~~nction036~~ -> Dump.[*]Added Support~~o RtlGe~~ for Dumping ICO as RAW and ICO.file form )at.[/list]

2013-11-28 17:40:24
Updated by Checker

Version: v7.845
Size (in bytes): 13258~~213~~60
What's new: [list][*]~~Better d~~Extended detection of suspicious debugger fie~~tect~~lds (invaliond cofntent ~~hard~~-~~coded IP~~ ~~Address~~es.g.: flame).[*]Added ~~Tag in~~ed PeStu~~dioBlackListStrings.xml to hide the strings that are Im~~dioFunctionsMapp~~orted Libraries (w~~i~~th the~~ ng~~oal t~~.XML to comap Func~~entrate~~ tionn Names~~trings that~~ r(e~~all~~.g. Sy ~~mat~~stemFunction036 to RtlGernRandom ).[/list]

2013-11-20 17:32:52
Updated by Checker

Version: v7.834
Size (in bytes): 132~~4694~~8213
What's new: [list][*]~~Extended PeStudio~~B~~lackListFun~~etter detection of hard-coded IP Addresses~~.xml~~.[*]Added Tag in PeStudioBlackListStrings.xml to hide the strings that are Imported Libraries (with the goal to concentrate on strings that really matter).[/list]

2013-11-16 17:08:42
Updated by Checker

Version: v7.823
Size (in bytes): 132~~193~~4694
What's new: [list][*]~~Consolidated Indicators about blacklist~~Extended RPesoSturdioBlaces kL~~ang~~istFu~~ages.~~nctions.xml.[*]Added Tag in PeStudioBlackListShtrings.xml to hide the strings that are Imported Libraries (with th~~e Resources Tree~~ e goal~~eaf~~ ito con ~~Red wh~~centrate on ~~a Re~~soutr~~ce La~~ing~~uage ha~~s ~~been de~~that re~~cted as~~ally Blma~~cklis~~ttedr).[/list]

2013-11-14 20:11:26
Updated by Checker

Version: v7.802
Size (in bytes): 132193~~200~~9
What's new: [list][*]~~Extended Blacklist of Libraries.[*]Map dynamically loaded libra~~Consolidated Indicatories ~~to the content of PeSt~~abou~~dioB~~t blackLilist~~Lib~~ed Resources Langua~~rie~~ges~~.xml~~.[*]~~Map dynamically loaded functions t~~Show the e Resourcoes Tree leaf in~~tent~~ ~~of P~~Re~~Stu~~di when a Reso~~Bla~~urcke L~~istF~~anguage has been detected as Blacklions~~.xml~~ted.[/list]

2013-11-12 18:19:03
Updated by Checker

Version: v7.780
Size (in bytes): 13132~~84858~~00
What's new: [list][*]~~Added Detection and Indic~~Extended Bla~~tor for ComSpe~~c~~.[*]Added Corre~~kl~~ation between str~~ingst of ~~and~~ Li~~mpo~~br~~ted Symbols.[*]Added Detection and Indicator for MIME64 Encoding~~ aries~~tring~~.[*]~~Added Detection~~ Mandp Idyndamiccally loaded libra~~tor f~~ries to the content orf hPeStudioBlackListLibrar~~d-c~~ies.xml.[*]Map dynamically lodaded Ifunctions to the content of P ~~Adress~~eStudioBlackListFunctions.xml.[/list]

2013-11-09 15:52:17
Updated by Checker

Version: v7.768
Size (in bytes): 12798164858
What's new: [list][*]Added ~~PeStud~~Detection and Indicator for ComSpec.[*]Added Correlation between strings and impoOrted~~inals.x~~ Symbol ~~to map Imp~~s.[*]Added Detection and Indicator for MIME64 Encoding strteing.[*]Added OrDetection and Indincals t~~o thei~~or fo~~rigin~~r ha~~l Fun~~rd-ctionded IP ~~Nam~~Adresses.[/list]

2013-11-08 14:51:32
Updated by Checker

Version: v7.756
Size (in bytes): 12~~6120~~79816
What's new: [list][*]FAdded PeStudioOrdinals.xml to map Importedd ~~a bug w~~Ordinals tho their original ~~Exported Symb~~Functio~~ls of 64~~n ~~bit I~~Namages.[/list]

2013-11-05 17:56:17
Updated by Checker

Version: v7.745
Size (in bytes): 126124608
What's new: [list][*]~~Added detection of GINA.[*]Extended Directories Validation.[*]Added~~Fixed a bug ~~Valid, Miss~~wi~~ng,~~th ~~Empty fields for Directories.[*]Extended PeStudioBlackLis~~t~~Librari~~he~~s.xml.[*]~~ Export~~end~~ed PeS~~tudi~~ymbols of 64 bit I~~ndic~~ma~~tor~~ges~~.xml~~.[/list]

2013-11-04 18:02:51
Updated by Checker

Version: v7.734
Size (in bytes): 1256124~~055~~6
What's new: [list][*]~~Extended validation of Debug fields.[~~Added detection of GINA.[*]Exte~~nded PeStudioIndicators.xml.[*]Added Context Menu at the image level.[*]Add~~nded CeDir~~tifi~~ecatories ~~validity h~~ Vandl~~ing~~idation.[*]Added ~~Ind~~Vali~~cator I~~d, iMissing, Empty fields for Directories.[*]Exthended oPeStudioBlackList~~put XM~~L ibraries.xml.[*]Extended PepStudioIndicatorts.xml.[/list]

2013-11-02 16:25:41
Updated by Checker

Version: v7.723
Size (in bytes): 1253741055
What's new: [list][*]CrExtended validation of Debug fields.[*]Extended PeSt~~udioBlackListL~~udioIndibrcatories.xml f.[*]Added Co~~r th~~ntext Menu at the image level.[*]Added DCert~~ection of blackli~~ificates validitedy ~~Libr~~harndliesng.[*]Added Indica ~~new~~tor Ind i~~cat~~n the orutput XML ~~in P~~re~~StudioIndicat~~por~~s.xml~~t.[/list]

2013-11-01 14:03:31
Updated by Checker

Version: v7.712
Size (in bytes): 125374~~9992~~1
What's new: [list][*]~~Fixed a b~~Created PeStugdioBlackListLibraries.xml for the Detection of blacklisted Libraries.[*]Added a newh Indicator in Pe~~n ha~~StudioIndli~~ng empty Relo~~catio~~n Tab~~rs.xmle.[/list]

2013-10-31 17:08:05
Updated by Checker

Version: v7.701
Size (in bytes): 124942992
What's new: [list][*]~~Created PeStudioPrompt.e~~Fixe~~, a stand-alone version of PeStu~~d~~io run~~ a bug when handling e~~xclusively at the pro~~mpty Relocation Table.[/list]

2013-10-30 16:25:30
Updated by Checker

Version: v7.6970
Size (in bytes): 1~~173538~~249429
What's new: [list][*]FiCreated PeStudioPrompt.exe, a stand-alone version of PeStudio ~~a problem when d~~runni~~sab~~ng exclusingvely at the Lpro~~oku~~mp t~~o VT~~.[/list]

2013-10-29 17:30:58
Updated by Checker

Version: v7.689
Size (in bytes): 1173~~467~~538
What's new: [list][*]~~Added detection of Debug~~ Fi~~le without PDB extension.[*]Added detection~~xed a pro~~f De~~b~~ug Fi~~l~~e name different than the image na~~em~~e.[*]Changed Sections~~ ~~UI.[*]C~~whaenge d Virus~~Tot~~abling the UILookup to VT.[/list]

2013-10-28 12:15:13
Updated by Checker

Version: v7.678
Size (in bytes): 1173467~~198~~
What's new: [list][*]Added ~~Query MSDN context menu for Exported Functi~~detection~~s.[*]S~~ of Debug File witho~~w Gaps~~ut inPDB Eexptension.[*]Added detection of Debug File name differtent than the image name.[*]Changed ~~Fun~~Section~~s Table~~s UI.[*]~~Ext~~Changend~~ed PeSt~~ Viru~~dio~~sT~~ranslati~~o~~ns.xml.[*]Extended PeS~~t~~udioIndic~~a~~tors.xm~~l UI.[/list]

2013-10-25 16:59:33
Updated by Checker

Version: v7.667
Size (in bytes): 116~~564~~7198
What's new: [list][*]Added Query MSDN context menu for Exported Functions.[*]Show moGaps in Exported Functions Table.[*]Extended PeStudioTranslations.xml.[*]Extended Pe StudioInd~~eta~~ils cato~~f Vi~~rus~~Tota~~.xml.[/list]

2013-10-24 16:43:32
Updated by Checker

Version: v7.656
Size (in bytes): 116~~3709~~5641
What's new: [list][*]~~Added detection of PeCompact co~~Show m~~press~~or~~.[*]Fix~~e d etails of ~~bug w~~VirusTot~~h Ctr~~al+T.[/list]

2013-10-23 15:44:00
Updated by Checker

Version: v7.635
Size (in bytes): 116~~1885~~3709
What's new: [list][*]Extended PeStudioThresholds.xml (which enables your to define your own thresholds).[*]Extended PeStudioTranslations.xml (which enables you to change the text at the UI).[*]Extended PeStudioSettings.XML (which enables you to change the behaviour of PeStudio).[*]Ad~~ded R/W support UI P~~de~~Stu~~d~~ioS~~ detectiong of PeCompact compressor.~~XML~~[*]Fixed a bug with Ctrl+T.[/list]

2013-10-22 16:48:48
Updated by Checker

Version: v7.623
Size (in bytes): 1156~~323~~1885
What's new: [list][*]Extended PeStudio~~BlackListFunctions.x~~Thresholds.xml (which enables your to define your own thresholds).[*]Extended PeStudioTranslations.xml (which enables you to change the text at the UI).[*]Extended PeStudioSettings.XML (which enables you to change the behaviour of PeStudio).[*]~~Fixed an Issu~~Added R/W support UI ~~when~~ clPeStudiosSetting ~~all file~~s.XML.[/list]

2013-10-12 18:05:44
Updated by Checker

Version: v7.612
Size (in bytes): 115603423
What's new: [list]~~[*]Added detection of missing Trust Information inside Manifest.[*]Extended PeStudioIndicators.xml.~~[*]Extended PeStudio~~Trans~~BlackListFunctions.xml.[*]Fixed an Issue when closing all files.[/list]

2013-10-12 11:26:02
Updated by Checker

Version: v7.601
Size (in bytes): 11~~4888~~56034
What's new: [list][*]Added ~~a switch (see PeStudioBlackListStrings.x~~detection of missing Trust Inform~~l) for case-sensitiveness when scanning the black strings.[*]Added a switch (see PeStudioBl~~a~~ckListS~~trion in~~gs.xml) for substrings when scanning the black~~ side Manifest~~rings~~.[*]~~Add~~Extend ~~Support for Win~~ed PeStudioIndicatowrs Fi.xml.[*]Extended RPeStud~~irect~~ioTranslations.xml.[/list]

2013-10-09 09:36:03
Updated by Midas

Screenshot: Updated

2013-10-09 05:56:00
Updated by Checker

Version: v7.5960
Size (in bytes): 114~~432~~8885
What's new: [list][*]Added ~~DOS~~a switch (see PeStudioBlackListStrings.xml) for case-sensitiveness when scanning the black strings.[*]Added a switch (see PeSttudioBlackListStrings.xml) for subbstrings when scanning the blatck st~~he UI~~rings.[*]A~~dded new Indicator related to the (sus~~dded Supp~~icious) size~~ ort for ~~the DOS Stub.[*]Added PeStu~~Wind~~ioThresh~~o~~lds.xml that contain~~ws ~~the Min, Max values use~~File Red ~~as th~~ire~~sholds.[*]Fixed enabling/disabli~~ction~~g Virustotal lookup switch~~.[/list]

2013-10-07 17:22:54
Updated by Checker

Version: v7.589
Size (in bytes): 1140432558
What's new: [list][*]Added ~~filtering of Windows (standa~~DOS Stub at the UI.[*]Added new Indicator related to the (suspicious) size of the DOS Stub.[*]Added PeStudioThreshold vs.xml that c~~ust~~o~~m) R~~ntains the Min, Max values used asou thr~~ces~~esholds.[*]AdFixed enabling/d fiisabl~~ter~~ing ~~of obf~~ Viru~~scated Sec~~stio~~ns.[*]Added fi~~tal~~tering of~~ flo~~rwarded ex~~okup~~orted~~ ~~Symbol~~s~~.[*]Added Indicator about Expired Certif~~witc~~ate(s)~~h.[/list]

2013-10-06 13:34:55
Updated by Checker

Version: v7.578
Size (in bytes): 113405~~379~~58
What's new: [list][*]Added ~~test of Exported Bl~~filtering of Windows (standard vs. custom) Resources.[*]Added filtering of obfuscated Sec~~klis~~tions.[*]Added ~~Func~~ filterionsg of forwarded exported Symbols.[*]~~Ext~~Added Ind~~ed PeS~~icator about Expired Certi~~oInd~~ficatore(s~~.xml~~).[/list]

2013-10-03 17:52:16
Updated by Checker

Version: v7.557
Size (in bytes): 11~~2898~~35379
What's new: [list][*]~~Extended Validation Han~~Added test of Exported Blacklisted Functiongs.[*]Extend~~ed Certif~~ed PeStudioIndicateors ~~Hand~~.xml~~ing~~.[/list]

2013-10-02 17:30:49
Updated by Checker

Version: v7.545
Size (in bytes): 1123867985
What's new: [list][*]E~~nable to open ANY image (to show the results with VirusTotal).[*]Added Creation, Last Access and Last Write times.[*]Extended validation and reflect it on the Tree View.[*]Extende~~xtended V~~ersion Informat~~ali~~on h~~dation Handliing.[*]~~Adde~~Extended ~~Dep~~Cer~~eca~~ted ific~~olum~~ates Han ~~to the Importe~~d ~~Symbo~~l~~s v~~iewng.[/list]

2013-09-29 18:14:50
Updated by Checker

Version: v7.534
Size (in bytes): 11~~1961~~23867
What's new: [list][*]Enable to open ANY image (to show the results with VirusTotal).[*]Add~~ed CTRL-~~ed Creation, Last Access and ~~CTR~~L~~-A supp~~ast Write times.[*]Extended validation and reflect it on the Tree View.[*]Extended Version Informat fiorn handl~~l v~~i~~ews~~ng.[*]Added ~~details fo~~Depr Reloca~~tio~~ted column~~s.[*]Ex~~ to the Import~~end~~ed PeS~~tudioTranslati~~ymbonls~~.xml.[*]Added translation of~~ ~~Machine Type.[*]F~~vixe~~d a hangup~~ w~~hen running on XP~~.[/list]

2013-09-27 11:43:57
Updated by Checker

Version: v7.523
Size (in bytes): 111~~266~~9613
What's new: [list][*]~~Extente~~Added CTRL-C and CTRL-A support for all views.[*]Added details for dRelocations.[*]Extended PeStudioTranslations.xml.[*]Added trailns ~~abou~~lation of SeMacthionse Type.[*]Fixed a bhangug p w~~ith t~~heen Certunni~~ficates~~ng on XP.[/list]

2013-09-26 12:07:24
Updated by Checker

Version: v7.512
Size (in bytes): 111~~1554~~2666
What's new: [list][*]~~Added PeStudioRemoveFromExplorerConte~~Ex~~tMenu.reg file to remove PeStudio from Explorer co~~tente~~xt menu.[*]Added validation of OptionalHeader.CheckSum.[*]Added result of OptionalHeader.CheckS~~d details abou~~m valida~~t~~ion as~~ ~~Indi~~Secatiorns.[*]~~Released Image~~Fixed a beug wingth ~~analysed~~the Ce~~arl~~rtificaters.[/list]

2013-09-25 16:00:23
Updated by Checker

Version: v7.501
Size (in bytes): 11~~08933~~11554
What's new: [list][*]Added ~~more details for each Certificate found in an addi~~PeStudioRemoveFromExplorerContextMenu.reg file to remove PeStudi~~ona~~o from Explorer ~~View.[*]Ex~~conte~~nde~~xt menu.[*]Added validation of OptionalHeader.CheckSum.[*]Added Bresult of OptionalHeader.Check~~listed F~~Sum validation~~ction~~ as lIndiscator.[*]~~Extend~~Released OImage b~~solet~~e ~~Functio~~ing analysed earlister.[/list]

2013-09-23 16:48:26
Updated by Checker

Version: v7.4950
Size (in bytes): 11089~~5704~~33
What's new: [list][*]Added ~~Cer~~more details ficor eatch Certificates ~~Expira~~found in an addition onal V~~alid~~iew.[*]Extended Blacklist~~y Ch~~ed Funcktions list.[*]AdExtendeed ~~Dump~~ Obso~~f I~~lete Fundicatiorns~~.[*]Added Dump of~~ ~~Man~~lifest.[/list]

2013-09-19 21:28:52
Updated by Checker

Version: v7.489
Size (in bytes): 1089957054
What's new: [list][*]Added Conertificatexts ~~menu for Ce~~Expirtation Validifty Check.[*]Added Dump of Indicateors.[*]Added Dump of ~~Cert~~Manif~~icat~~est.[/list]

2013-09-18 15:10:54
Updated by Checker

Version: v7.478
Size (in bytes): 1080981905
What's new: [list][*]~~Raw~~ Add~~iscovery of fun~~ed~~amental characteristics of the~~ C~~ertificate(s) embedded in the~~ontext Im~~age.[*]Exte~~en~~ded~~u for ~~Ind~~Certificatores.[*]Added Dump forf Certificates.[/list]

2013-09-16 16:57:08
Updated by Checker

Version: v7.467
Size (in bytes): 1079809981
What's new: [list][*]~~Corrected execution of PeStud~~Raw di~~o from the command prompt.[*]Image~~s ~~that~~ c~~annot be~~ o~~pened (~~ve~~.g.~~ry ~~invali~~of fundamental focharacteristics of the Cermat~~,...)~~ ificarte (s~~hown in Gr~~) embedded in the Imayge.[*]Exten~~ded Tree Context Menu~~ded Indicators for ViCer~~usTot~~tificaltes.[/list]

2013-09-15 13:02:09
Updated by Checker

Version: v7.456
Size (in bytes): 106796899
What's new: [list][*]~~Extended Tree Context Menu.[*]Add~~Corrected execution of PeStudio from the command Rprompt.[*]Imagelos that ca~~tio~~nnot Tabe opened (e.g. invalid format,...) are s ~~disc~~hovewn in Gray.[*]AdExtended ITree Context Men~~dicator abo~~ut ~~Relocati~~fo~~n Items~~ r Vi~~n PeSt~~ru~~dioIndic~~sTota~~tors.xm~~l.[/list]

2013-09-11 18:10:44
Updated by Checker

Version: v7.445
Size (in bytes): 106968910
What's new: [list][*]~~Added discovery of registered Exception handlers of 64bit Images.[*]Added Indicators for regis~~Extended Tree Context~~ered Exception ha~~ Men~~dlers.[*]Added discovery of static~~ u~~sage of Thread Local Space (TLS)~~.[*]Ad~~ded Indicator for usage of~~ded ~~Thr~~Re~~ad L~~location Tables ~~Spa~~discove ~~(TLS)~~ry.[*]~~Ext~~Added Inted Fiicator about Relocation Items in PerStudingoIndicators.xml.[/list]

2013-09-08 10:46:49
Updated by Checker

Version: v7.434
Size (in bytes): 1069910~~843~~
What's new: [list][*]Added ~~a Filtering m~~discovery of registered Exception hanidlersm of 64bint Images.[*]Added Indicators for registered Exception handlers.[*]Added discovery of static usage of Thread Local Space (TLS).[*]Added Indicator for usage of Th~~e Pa~~rserad Local Space (TLS).[*]~~Add~~Extented ~~a UI to f~~Filter ~~accord~~ing ~~to the presence of Certificate~~.[/list]

2013-09-05 17:06:22
Updated by Checker

Version: v7.423
Size (in bytes): 1043608423
What's new: [list][*]~~Correct~~Added a F~~ileVersion shown when point~~iltering tmech~~e image.[*]Extended context me~~anism inu ~~for impor~~thed ~~lib~~Paraser~~ies~~.[*]~~Exten~~Added a UI to filter according t~~ext me~~o the presenuce ofor rCe~~sour~~rtificates.[/list]

2013-09-04 16:35:15
Updated by Checker

Version: v7.412
Size (in bytes): 1048366842
What's new: [list][*]~~Implemented t~~Corrected FileVersion sh~~e "default_view" (see PeStudioSettings.xml).[*]Added general Informati~~on wn when p~~oint~~ointing ~~an Image root.[*]Added Tree coloring (e.g. V~~the i~~rusTot~~malge.[*]Extended context menu for imported ~~sco~~librarie)s.[*]AExtend~~ded Tre~~ed context menu for resources.[/list]

2013-09-02 17:09:37
Updated by Checker

Version: v7.401
Size (in bytes): 10428668
What's new: [list][*]~~Fixed the~~ Implemented the "default_view" (see PeStudioSettings.xml).[*]Added gene~~pendenc~~ral Information when pointing an Image root.[*]Added Tree coloring (e.g. VierusTotal score).[*]Added Tree co~~f th~~ntext nme~~w UI of PeSt~~nu~~dio~~.[/list]

2013-08-31 14:55:37
Updated by Checker

Version: v7.3940
Size (in bytes): ~~7233~~1042866
What's new: [list][*]~~Adde~~Fixed ~~context-m~~the dependen~~u for all l~~ci~~sts.[*]Added Accelerators.[*]Added Close All Imag~~es ~~but~~of the new UI of PeStudion.[/list]

2013-08-29 17:08:54
Updated by Checker

Version: v7.389
Size (in bytes): 72331~~9133~~0
What's new: [list][*]~~Redesign of the User Interface.[*]Support loading of multiple images.[*]Demangled the Parser programmatic interface~~Added context-menu for all lists.[*]~~Issue: When loading too many images simultaneously, the VT results are not retrieved for some images. This is "normal" since the current key PeStudio is using is restricted as far as the~~ Added Accelera~~mount of reques~~t ~~pro seconds is c~~o~~nce~~r~~ned~~s. ~~This issue will be han~~[*]Addled ~~with VT unti~~ Cl ~~in the n~~osext vAll Imagersi button.[/list]

2013-08-28 16:06:05
Updated by Checker

Version: v7.378
Size (in bytes): 719~~82995~~133
What's new: [list][*]~~Added detection of empty fields in the Version Information~~Redesign of the User Interface.[*]Support loading of multiple bimages.[*]Demangled the Parser programmatic interfacke.[*]~~Added Indicat~~Issue: When loading too many images simultaneously, the VT results are not retrieved for some images. This is "normal" since the current key PeStudio is using is restricted as far as the amount of request pro seconds is concer "Tned. This issue will be handled with V~~ers~~T until ion ~~field '%s' is Empty"~~the ~~(e.g The Ve~~next versiion ~~field 'CompanyName' is Empty)~~.[/list]

2013-08-14 16:08:06
Updated by Checker

Version: v7.367
Size (in bytes): 9~~994~~872995
What's new: [list][*]Added ~~Sup~~detection of empty fields in the Version Information block[*]Added Indicator "The Version field '%s' is Empty" (e.g The Ver~~t of~~ simon field 'CompanyNagme' is Emp~~acked wi~~t~~h FSG.~~y)[/list]

2013-08-12 16:57:28
Updated by Checker

Version: v7.356
Size (in bytes): 99949287
What's new: [list][*]~~Bett~~Adderd Support ~~imp~~o~~rts~~f dimages packed wit~~ection~~h FSG.[/list]

2013-08-11 13:36:05
Updated by Checker

Version: v7.345
Size (in bytes): 99~~1330~~9492
What's new: [list][*]~~Handled misal~~Better i~~gne~~menports det ~~of V~~ersction ~~buffer~~.[/list]

2013-08-09 16:06:07
Updated by Checker

Version: v7.334
Size (in bytes): 999138930
What's new: [list][*]~~Better va~~Handlied misalignement of Version obuff cer~~tificat~~.[/list]

2013-08-07 16:37:13
Updated by Checker

Version: v7.323
Size (in bytes): 9993389
What's new: [list][*]~~Fix~~Be~~d a crash wi~~t~~h f~~ter vali~~les depen~~dating on ~~a sp~~ of cecrtific ~~libr~~aryt.[/list]

2013-08-06 18:54:51
Updated by Checker

Version: v7.312
Size (in bytes): ~~1012216~~999338
What's new: [list][*]HFixed a cra~~ndled an is~~sueh w~~hen~~ith files depending lo~~adi~~n~~g the~~ a s~~ame image multip~~pecific l~~e t~~i~~mes~~brary.[/list]

2013-08-03 09:23:17
Updated by Checker

Version: v7.301
Size (in bytes): ~~9994~~10125216
What's new: [list][*]~~Correct Load Configuratio~~Handled an D i~~rectory va~~ssue when lidoatdion~~.[*]Added detec~~g t~~ion of~~he ~~in-proces~~s ~~COM Server (~~ame. imag~~. BHO Pl~~e mugltin)ple times.[/list]

2013-08-01 14:41:44
Updated by Checker

Version: v7.2930
Size (in bytes): 99~~7813~~9425
What's new: [list][*]~~Handle malformed~~ Correct Load Configuration Directory validatio~~r empty App Paths e~~n~~tries~~.[*]~~Show/Hi~~Ad~~e Virustotal TAB from the UI and Show/Hide the Virustotal XML Section accor~~d~~ing to th~~e ~~swi~~d detech tion Pof in-process COM S~~tudioVi~~erver~~usTota~~ (e.g. BHO Plugin).~~xml~~[/list]

2013-07-31 16:24:00
Updated by Checker

Version: v7.279
Size (in bytes): ~~14212~~997813
What's new: [list][*]~~Supp~~Handle malformed or empty ~~usage of PeStudio from the Command Prom~~App Paths ent.ries[*]Sthow/Hide Virustotal TAB from the UI and Show/Hide the Virustotal XML Section accorteding to the aswitch in "PeStuudio HVirusTota~~ndbook.pdf"~~l.xml[/list]

2013-07-30 13:36:47
Updated by Checker

Version: v7.267
Size (in bytes): ~~996999~~1421213
What's new: [list][*]~~Added Validity~~Support usage ~~checks (and~~of ~~Indicators) on Sec~~PeStudion ~~Heade~~fr~~s (e.g. fil~~om the Comm~~iss~~a~~lign~~nd Promenpt).[*]~~Fix~~Started a "PeStudio H~~A1 issue~~andbook.pdf".[/list]

2013-07-27 14:36:09
Updated by Checker

Version: v7.0326
Size (in bytes): 9~~55444~~96999
What's new: [list][*]Added Validity checks (and~~etection of MPRESS compression[*]Added detectio~~ In ~~of UPX evas~~di~~on (one or more standa~~cator~~d UPX section name~~s ~~changed~~)~~[*]Added computation~~ ofn Section HA1eaders (e.g. ofile ~~the~~ missalimag~~e a~~n~~alyz~~mednt).[*]Fixed isSHA1 issue ~~with right mouse copy at the UI~~.[/list]

2013-06-22 13:03:07
Updated by Checker

Version: v7.023
Size (in bytes): 945~~936~~5444
What's new: [list][*]Added ~~Items in Bla~~deteckltiston of XMLPRESS ~~fil~~compre.[*]PeStudioSettings.xml now centralizes the names (which are not hardcoded anymore) of the others XML files.[*]The Blacklist engine can now be switched ON and OFF in the XML file enumerating the Blacklisted strings.[*]The minimum length of strings detected is now determined in the Blacklist XML file.[*]Show more details about the content of ollybugs images.ssion[*]~~Cleaning up~~ Added detec~~omments in~~ thison ~~ChangeL~~o~~g.txt~~f ~~file.~~UPX evasion (one or more standard UPX section names changed)[*]~~Fix~~Added ~~an issue wi~~ computation of SHA1 of the ~~str~~inmagse enanalyzed[*]Fixed issue with right merouse copy at~~ion.~~ the UI[/list]

2013-06-19 19:24:45
Updated by Checker

Version: v7.012
Size (in bytes): 94~~1427~~5936
What's new: [list][*]Added ~~a new~~ Items in Blacklist XML file.[*]PeeStudioSettings.xml now centralizes the names (which are not hardcoded anymore) of the others XML files.[*]The Blacklist engine can now be switched ON and OFF in the XML file enumerating the Blacklisted strings.[*]The minimudm length of strings detected is noSw determined ings the Black~~List.xml file.Thi~~lis t XML fiile ~~contain~~.[*]Show more details about the conthe ~~lis~~nt of ~~"black~~ol~~isted" strin~~lybug~~s which wil~~s images.[*]Cl ~~be used to det~~ectaning ~~sus~~up~~icious~~ scommentris ings thins tCh~~e Im~~a~~ge. You mus~~ngeLog.txt ~~manua~~filly e.[*]Fixed~~it this file to~~ a~~dd strings to your~~n ~~convenience. The "blacklisted" strings will be shown a~~is ~~Indicator~~s ~~and at the UI in th~~ue S with strings ~~Tab.[*]Added validation on N~~enumbeer ~~of Sec~~ations.[/list]

2013-06-16 11:45:32
Updated by Checker

Version: v67.9901
Size (in bytes): 9~~33508~~41427
What's new: [list][*]Added ~~suppo~~a new PeStudioStringsBlackList.xml file.This file contains the list of "blacklisted" strings which will be used to detect ~~for s~~suspi~~cious imported file names (e.g. unprinta~~cious strings in the Image. You must manually edit this file to add strings to your convenience. The "bllacklisted" strings will be shown as Indicators and a~~me, no~~t ~~null~~the UI in the Stermings Ta~~ted)~~b.[*]Ad~~ded PeStudioSettings.xml and h~~ded vandli~~ng VirusT~~datio~~tal switch ON/OFF based~~n on ~~this XML file[*]Enhan~~Number of Sec~~ed valida~~tioon ~~of EAT (ollybug~~s.~~exe)~~[/list]

2013-06-14 16:09:01
Updated by Checker

Download URL: http://www.winitor.com/tools/PeStudio/Current/PeStudio.zip

2013-06-14 16:08:19
Updated by Checker

Version: v6.989
Size (in bytes): 93~~225~~3508
What's new: [list][*]~~Detect INVALID DAT~~A ~~found in the VERSION_INFO~~ dded support for suspicious imported file names (e.g. unprintable name, not null trearminated)[*]Added (sPeStudiomSe ~~malw~~ttings.xml and handling Vir~~e place c~~ustTomtal s~~tream in standard Windows Resour~~witch ON/OFF based on this) XML file[*]E~~xte~~n~~ded support for~~ hanc~~orkami m~~ed val~~forme~~id sa~~mples[*]Added more items in~~tion of ~~Pest~~EAT (ollybu~~dioIndicators~~g.exmle)[/list]

2013-06-13 16:12:47
Updated by Checker

Version: v6.918
Size (in bytes): 93225349
What's new: [list][*]~~All lists sup~~Detect INVALID DATA found in the VERSION_INFO stream (some malware place custom stream in standard Windows Resources)[*]Extended supportt for ~~right-cli~~cork ~~context menu~~ami malformed samples[*]A~~dded ord~~dded more items ing ~~by number i~~PestudioIn ~~all lists[*]Adde~~d ~~size~~ i~~n St~~cator~~ings Li~~st.xml[/list]

2013-06-05 07:19:02
Updated by Checker

Version: v6.891
Size (in bytes): 9~~596~~328349
What's new: [list][*]A~~dded~~ll lists support right-click context Dmetection of ZM instead of MZ at the begin of the image[*nu[*]Add~~ed Query of Imported Functions at MSDN using the C~~ed o~~ntext Menu[*]F~~rderi~~xed a~~ng by bnug mber in all list~~he XML report~~s[*]~~Filter Direc~~Added size in Storiengs Lis ~~types on~~ t~~he UI~~[/list]

2013-05-17 15:19:22
Updated by Checker

Version: v6.6089
Size (in bytes): 9~~167~~597628
What's new: [list][*]Added ~~Support for dumping the Sections into~~ Detection of ZM instead of MZ at the begin of the ima ~~file from the GUI using the ri~~g~~ht-mous~~e ~~click~~[*]Adde~~d S~~d Qu~~pport fo~~ery duof Imp~~ing the Res~~ourctesd iFunctions a ~~file from the GUI~~t MSDN using the Context Menu[*]Fixed a bug in the XML report[*]Filter Dighrect~~-mou~~ories types on the ~~click~~UI[/list]

2013-04-14 18:29:33
Updated by Checker

Version: v6.5560
Size (in bytes): 9~~423~~136797
What's new: [list][*]Added ~~full RAW access to~~Support for dumping the Sections into a file from the GUI~~con~~ us iting the right-mouse click[*]~~Corr~~Addecd Support for dumping the Resourceds ~~handl~~ing to~~f obsolete Functions[*]Created~~ hand fil~~ing o~~e f ~~Res~~ro~~urces CodePag~~m thes vGUI usiang ~~PeS~~tudhe right-mo~~Cod~~use~~Pages.XML~~ ficleick[/list]

2013-04-12 17:33:05
Updated by Checker

Version: v6.505
Size (in bytes): 9~~78089~~42313
Screenshot: Updated
What's new: [list][*]Added ~~detection of 7zSFX files embedded in Resources[*]Added Mapping of Language Code of StringFileInfo to H~~fu~~man friend~~l~~y name into the XML~~l RAW accepss to Ico~~rt[*]Added Mappi~~n~~g of~~s items[*]Co~~de Pag~~rrected handling of obsolete ~~of S~~Functrion~~gFileInfo to Human friendly name into the XML Report~~s[*]~~Icon at the UI is now direc~~Creat~~ly load~~ed ~~from t~~he andling of Resesource usin CodePages ~~our own~~via PeStudintoCodePagers.XML facile[/list]

2013-04-06 17:57:49
Updated by Checker

Version: v6.450
Size (in bytes): 97~~5254~~8089
Screenshot: Updated
What's new: [list][*]~~Dump the content of S~~Added detection of 7zSFX files embedded in Resources[*]Added Mapping of Language Code of StringFileInfo to Human friendly name into the XML Report[*]Added Mapping~~FileInfo in t~~ of Code Page of StringFileInfo to Human friendly name into the XM~~L report~~L Report[*]~~Dump~~ Icon at the cUI is now directly loaded fronm the Resource using our own~~t of VarFileInto~~ in the ~~XML r~~rface~~port~~[/list]

2013-04-04 18:41:14
Updated by Checker

Version: v6.340
Size (in bytes): 9667529154
Screenshot: Updated
What's new: [list][*]~~Corrected a bug in the Console version of PeSt~~Du~~dio[*]Added Version VS_VERSIONINFO raw data in the XML Re~~mpor t~~[*]Added~~he ~~Versi~~con ~~VS_FIXEDFILEINFO raw data in the XML Report[*]Should an error take place when handling an image, shows its description at the UI and in t~~tent of StringFileInfo in the XM~~L file~~L report[*]~~Added Indicator "The image masq~~Du~~erades UPX com~~mp~~ression" (sections are named as UPX, BUT~~ the ~~image is NOT~~ co~~mpr~~nte~~ssed~~nt of VarFileInto win th UPe X!)ML report[/list]

2013-03-30 16:51:09
Updated by Checker

Screenshot: Updated

2013-03-30 16:50:33
Updated by Checker

Version: v6.230
Size (in bytes): 96624912
What's new: [list][*]~~Added Indicator "The imag~~Corrected a ~~Fil~~bug in the Console version of PeStudio[*]Added Version VS_VERSIONINFO raw data in the XML Report[*]Added Version ~~is %s"~~VS_FIXEDFILEINFO raw data in the XML Report[*]Should an error take place when handling an image, shows its description at the UI and in the XML file[*]A~~dded~~ dded Indiccator "The image masquerades UPX compression" (sections are named as UPX, BUT the ima~~tor "Th~~ge ~~image~~ is enNOT cryomptressed with UPX ~~(version %s, level %i~~!)~~"[*]Added UPX information details in XML report file~~[/list]

2013-03-24 16:23:25
Updated by Checker

Version: v6.120
Size (in bytes): ~~875~~9620412
Screenshot: Updated
What's new: [list][*]Release Image analyzed when handling a new one[*]Enable Reporting for invalid images[*]Show number of Items in Report Tab at the UI[*]Added Search String feature at the UI[*]Added Indicator "The image is a Executable"[*]Added Indicator The image is a Dynamic-Link Library (DLL)"[*]Added Indicator "The image size on the Disk (as reported) is %i Bytes"[*]AdAdded d Indicator "Th~~e File is Not a Windows Portable Executable (PE) image"[*]PeStudioFunctionsDepracated.XML is now loaded once[*]PeStudioIndicators.XML is not loaded once[*]H~~e ima~~ndle missin~~g Pe~~StudiIndicato~~ File Vers~~.XML~~ion files %s"[*]CAdded Indicator~~rected Offset~~ ~~Addr~~"The image is encrypted with UPX (vers~~ses~~ iofn ~~String~~%s ~~det~~, level %i)"[*]Adde~~cti~~d UPX information details in XML report file[/list]

2013-03-17 17:40:42
Updated by Checker

Version: v6.010
Size (in bytes): 9483753620
Screenshot: Updated
What's new: [list][*]Release Image analyzed when handling a new one[*]Enable Reporting for invalid images[*]Show number of Items in Report Tab at the UI[*]Added Search String feature at the UI[*]Added Indicator "The image is a Executable"[*]Added Indicator The image is a Dynamic-Link Library (DLL)"[*]Added Indic~~ato~~ator "The he imag~~e f~~e size on the Dilesk (as creponrtaed) ins %i ~~unused~~ By~~tes (Cave~~tes)"[*]Added I~~ndicator~~ ndicator "The File is Not a Wimndows Portagble ~~Nam~~Exe hcutas b~~een Changed"~~le (PE) image"[*]~~Added I~~PeStudioFundicat~~or "The~~ i~~mage~~ onsDepr~~igin~~a~~l nam~~cate wad.XML is ~~%s"[*]Added Indicator "The image contains %i bytes of Code"[*]Ad~~now loaded once[*]PeStud ioIndicato~~r "The im~~rs.XML is not loagded contce[*]Hain~~s %i emb~~dle~~dded~~ Vmis~~ual~~sing PeSt~~ylesheet~~ udiIndicators.XM~~L Items(s)"~~L file[*]ACorrected Offset Ad~~ed In~~d~~icato~~r ~~"Th~~esses of ~~ima~~String~~e contains %i Custom Resource Item(~~s~~)"[*]Added~~ Indetecti~~cator "The image contains %i Built-i~~on ~~Resources Item(s)"~~[/list]

2013-02-16 16:03:11
Updated by Checker

Version: v6.600
Screenshot: Updated
What's new: [list]Version 6.60. Added Indicator "The image file contains %i unused Bytes (Caves)". Added Indicator "The image Name has been Changed". Added Indicator "The image original name was %s". Added Indicator "The image contains %i bytes of Code". Added Indicator "The image contains %i embedded Visual Stylesheet XML Items(s)". Added Indicator "The image contains %i [*]Added Indicator "The image file contains %i unused Bytes (Custom Resource Item(s)". Added Indicator "The image contains %i Built-in Resources Item(s)"Version 5.55[*]Added Indicator "The image references (%s) Debug Symbols"[*]Added Indicator "The image has %i Writable and Executable Section(s)"[*]Added Indicator "The image has %i Writable and Shared Section(s) which can be used as Attack Verctor"[*]Added Indicator "The image does NOT use Data ~~Execution Pre~~ve~~ntion (DEP~~s) ~~as Mitigation technique~~"[*]Added I~~ndicato~~ndicator "TThe ~~image does NOT use Address Sp~~imacge ~~Layout Rando~~ Nam~~ization (ASLR)~~e has ~~Mitigatio~~been ~~technique"~~Changed"[*]Added Indicator "The image original name was %s"[*]A~~dded~~ dded Indndicator "The image contains %i bytes of Code"[*]Added Indicator "Th~~e im~~e imag~~e d~~e contains %i embedded Vis NOual Stylesheet XML Items(s)"[*]Added Indicator "The image contains %i Custom Resource Item(s)"[*]Adde ~~Safe Structure~~d Ex Indicepatio~~n H~~r "The image contain~~dling~~s %i Built-in Resources Item(~~...~~s)"[/list]

2013-02-15 22:19:40
Updated by Ruby

Version: v56.5560
Size (in bytes): 94~~447~~8353
What's new: [list]~~[*]Added Indicator "The image references (%s) Debug Symbols"[*]Added Indicator "The image has %i Writable and~~Version 6.60. Added Indicator "The image file contains %i unused Bytes (Caves)". Added Indicator "The image Name has been Changed". Added Indicator "The image original name was %s". Added Indicator "The image contains %i bytes of Code". Added Indicator "The image contains %i embedded Visual Stylesheet XML Items(s)". Added Indicator "The image contains %i Custom Resource Item(s)". Added Indicator "The image contains %i Built-in Resources Item(s)"Version 5.55[*]Added Indicator "The image references (%s) Debug Symbols"[*]Added Indicator "The image has %i Writable and Executablee Section(s)"[*]Added Indicator "The image has %i W~~rita~~ritable and ~~Shared Section(s) which can be used as Attack Verctor"[*]Added Indi~~ Shared Secatiorn(s) "Twhiche can be used as Attack Verctor"[*]Added Indicator "The image d~~oes~~ oes NOT us~~e Dat~~e Data Execu~~tion~~tion Prevention (DEP~~) as Mitigation technique"[*]Added Ind~~) as Mitigation technique"[*]Added Indicator "The e image d~~oes NOT use Ad~~oes NOT use Address Space Layou~~t Ran~~t Randoomization (ASLR) as M~~itigation~~ itigation technique"[*]Added Inddicator "The e imag~~e does~~ e does NOT us~~e S~~e Safe Stru~~ctu~~ctured Exceptio~~n Handling (SafeSE~~n H~~) as Mitigation technique"[*]Added I~~and~~icator "The image does NOT use Cookies placed on the Stack (GS) as Mitigation technique"[*]Fixed a bug by readi~~ling ~~Symbols[/list]~~(...

2013-02-14 17:50:02
Updated by Checker

Version: v5.505
Size (in bytes): 940549473
What's new: [list][*]Added Indicator "The image references (%s) Debug Symbols"[*]Added Indicator "The image has %i Writable and Exexports %i Symbols"[*]Added Indicator "The image exports %i Obsolete Symbols"[*]Added Indicator "The image exports %i Anonymous Symbol(s)"[*]Added Indicator "The image exports %i Forwarded Symbol(s)"[*]Added Indicator "The image exports %i Decorated Symbol(s)"[*]Added Indicator "The image imports %i Symbol(s)"[*]Added Indicator "The image imports %i Obsolete Symcutabol~~(s)"[*]Added Indicator "The imag~~e ~~imports %i Anonymous Symbol(s)"[*]Added Indi~~Sec~~ator "The image impor~~t~~s %~~i ~~Forwarded Symb~~oln(s)"[*]Added Inndicator "Th~~e im~~e image ha~~ge import~~s %i ~~Deco~~Writatble and S~~ymbol(s)~~hared Section(s) which can be used as Attack Verctor"[*]Adde~~d Colle~~d Indicator "The image do~~n of IMAGE_BOU~~es N~~D_IMPORT_~~OT use Data Execution Prevention (DE~~SCRI~~P~~TOR det~~) ails ~~in XML Rep~~ Mitigatiorn technique"[*]Added Indicator or "The image does NOT use Address Space Layout Randomization (ASLR) as Mitigation technique"[*]Added Indicator "Th~~e i~~e imaagee does NOT use Safe Structured isException ~~bou~~Handlindg (SafeSEH) as Mitigation technique"[*]Added Indicat~~o %i Lib~~or "The imarge does NOT use Cookies placed on the Stack (GS) as Mitigation technique"[*]Fixed a bug by reading Symbols[/list]

2013-02-12 20:19:24
Updated by Checker

Version: v5.450
Size (in bytes): 934035493
Screenshot: Updated
What's new: [list][*]~~Extende~~Added Indicator "The image exports %i Symbols"[*]Added Indicator "The image exports %i Obsolete Symbols"[*]Added Indicator "The image exports %i Anonymous Symbol(s)"[*]Added Indicator "The image exports %i Forwarded Symbol(s)"[*]Added Indicators r "The image exports %i Decorated Symbol(s)"[*]Added Indicator "The image imports %i Symbol(s)"[*]Added Indicator "The image imports %i Obsolete Symbol(s)"[*]Added Indicator "The image imports %i Anonymous Symbol(s)"[*]Added Indicator "The image imports %i Forwarded Symbol(s)"[*]Added Indicator "The image imports %i Decorated Symbol(s)"[*]Added Collection ofor IMAGE_BOUND_IMPORT_DE~~mbedded Resourc~~SCRIPTOR details in XML Report[*]~~Corrected missing Dep~~Added Ind~~enc~~icator "The~~s for so~~ image ~~types~~ is bound tof im%i Libragries"[/list]

2013-02-08 17:23:58
Updated by Checker

Version: v5.340
Size (in bytes): 9~~286~~308393
What's new: [list][*]~~Renamed *.XML files to P~~Extended Indicators for Embedde~~Studio*.XML[*]Interfaces to PeParser (PeParser.h an~~d PRe~~Par~~s~~er.lib) are now pa~~our~~t of the Pa~~c~~kage.[*]Added Ind~~e~~xing of String~~s[*]~~Added~~Corrected missing D~~etectio~~epen ~~of duplicate~~d Sencties for sonme types of Naimages[/list]

2013-02-07 15:07:43
Updated by Checker

Version: v5.230
Size (in bytes): ~~85435~~928608
Screenshot: Updated
What's new: [list][*]AlRenamed *.XML files to PeStudio*.XML[*]Interfaces to PeParser (PeParser.h and PeParser.lib) are now part of the Package.[*]Added Indexing of Strinings[*]Added lDete~~ngth~~ c~~hoice f~~tion or fi duplticated Serctiong Na~~t the UI[*]Added~~ more ~~item~~s ~~in Indicators.XML~~[/list]

2013-02-06 11:51:06
Updated by Checker

Version: v5.020
Size (in bytes): 875~~109~~4352
Screenshot: Updated
What's new: [list][*]~~The~~Allow Sttring~~s contained in the file analyzed can now be exported to the output XML file[*]Added valida~~s lengt~~ion~~h Cch~~eck~~oice fo~~f AddressOfEntryPoint~~r filteldring at the UI[*]Addeded nmorew items in Indicators.XML[/list]

2013-02-04 00:46:40
Updated by webfork

Screenshot: Updated
Forum topic ID: 06788

2013-02-03 22:30:24
Updated by Checker

Screenshot: Updated

2013-02-03 22:24:25
Updated by Checker

Version: v45.900
Size (in bytes): 87518409
What's new: [list][*]AdThe Strings contained in the file analyzede can now be exported to the output XML file[*]Added validachtion~~eType~~ iCheck of AddressOfEn ~~Indicat~~tryPo~~rs.XML~~int field[*]Added ~~Fil~~neSw i~~gna~~turems in Indicators.XML[/list]

2013-01-30 20:40:48
Updated by Checker

Version: v4.890
Size (in bytes): 8~~6920~~71840
Screenshot: Updated
What's new: [list][* Version 4.80. Add items in Indicators.XML. Custom Resources are shown in orange color* Version 4.70. Corrected handling of Certificate Directory. Corrected coloring of Indicators* Version 4.60. Increased detection for obfuscated images. Increased stability of the tool against malformed images. Added better support for obfuscated images . Extented Indicators of Malformations (IOM). Created a new file (Indicators.XML) containing the Indicators shown at the UI and in the XML report that can be created by the tool. ]Addded ~~better det~~ MachineType in Indicatio~~n of~~ rs.XM~~issin~~L[*]Added FileSignature Librn Indicators.XML[/liest]

2013-01-28 06:30:58
Updated by Ruby

Version: v4.780
Size (in bytes): 86~~8385~~9201
What's new: [* Version 4.80. Add items in Indicators.XML. Custom Resources are shown in orange color* Version 4.70. Corrected handling of Certificate Directory. Corrected coloring of Indicators* Version 4.60. Increased detection for obfuscated images. Increased stability of the tool against malformed images. Added better support for obfuscated images . Extented Indicators of Malformations~~t][*]~~ (IOM). C~~orrected ha~~reated a new file (Indicators.XML) containing the Indicators shown at the UI and in the XML report that can be created by the tool~~ing of Certificate Directory[*]Cor~~. Added better detect~~ed color~~ing on of ~~Ind~~Micssing Librator~~s[/l~~iest]

2013-01-26 12:53:29
Updated by Checker

Version: v4.570
System Requirement:
Size (in bytes): 8~~4912~~68385
Screenshot: Updated
What's new: [list][*]Correct ~~discov~~ed handling of Certificate Directory[*]Corrected coloring of ~~Delay-loa~~Ind~~ed l~~ibrcatories[/list]

2012-10-28 19:46:13
Updated by Checker

Version: v4.450
Size (in bytes): 84906126
What's new: [list][*]~~When handling a resour~~Correct disc~~es only image, s~~omve ~~validit~~ry chof De~~cks~~ larey-loaded dli~~ffe~~brarients[/list]

2012-10-26 14:38:52
Updated by Checker

Version: v4.340
Size (in bytes): 84890661
What's new: [list][*]EWhen handling a resources onhly image, some vanlidity chec~~ed detection~~ks ofare devicffe dr~~iver imag~~ents[/list]

2012-10-25 11:30:06
Updated by Checker

Version: v4.230
Size (in bytes): 848~~407~~966
What's new: [list][*]Renamed parameters for command prompt (see Prompt support description above)[*]Added detection of CAB files embedded as Resource in an Image[*]Added detection of PDF files embedded as Resource in an Image[*]Added detection of RIFF files embedded as Resource in an Image[*]Added detection of GIF files embedded as Resource in an Image[*]Added detection of PNG files embedded as Resource in an Image[*]Added detection of Delphi Forms embedded as Resource in an Image[*]Added detection of "requireAdministrator" E~~xecutio~~n ~~Level from t~~h~~e M~~a~~nifest[*]Corrected custom Resourc~~ncesd deetection of device driver images[/list]

2012-10-23 16:23:03
Updated by Checker

Version: v4.120
Size (in bytes): 846384017
What's new: [list][*]~~Added Co~~Renamed parameters for command prompt (see Prom~~man~~pt support description above)[*]Added detection of CAB files embedded as Resource in an Image[*]Added detection of PDF files embedded as Resource in an Image[*]Added detection of RIFF files embedded as Resource in an Image[*]Added detection of GIF files embedded as Resource in an Image[*]Added detection of PrNG files embedded as Resource in an Impage[*]Added detection of ~~suppo~~Delphi Forms embedded as Resourtce in an Image[*]Ad~~ded~~ ded detection of "requireAdministrator"T Execution Level from the imMa~~ge exports XY Symbols" as new I~~ndicafestor[*]~~Add~~Corrected ~~more obsolete f~~ cuncstio~~ns in the WindowsFunctionsDep~~m Resource~~cated.xml file~~s (de~~livered with th~~tecti~~s pr~~o~~ject)~~n[/list]

2012-10-03 17:55:52
Updated by Checker

Version: Vv4.10
Screenshot: Updated

2012-10-03 17:53:51
Updated by Checker

Version: V4.010
Size (in bytes): 8463~~4364~~01
What's new: [list][*]NAdded Cow fully support 64bit Images on 32bit Platform[*]Validate IMAGE_OPTIONAL_HEADER.SectionAlignment[*]Validate IMAGE_OPTIONAL_HEADER.FileAlignment[*]Validate IMAGE_OPTIONAL_HEADER.SizeOfUninitializedData[*]Validate IMAGE_OPTIONAL_HEADER.SizeOfInitializedData[*]Validate IMAGE_OPTIONAL_HEADER.SizeOfCode[*]Validate IMAGE_OPTIONAL_HEADER.NumberOfRvaAndSizes[*]Validate IMAGE_OPTIONAL_HEADER.SizeOfImage[*]Validate IMAGE_FILE_HEADER.SizeOfOptionalHeader[*]Validate IMAGE_FILE_HEADER.NumberOfSections[*]Validate IMAGE_FILE_HEADER.TimeStamp[*]Validate IMAGE_FILE_HEADER.PointertoSymbolTable[*]Validate IMAGE_FILE_HEADER.NumberOfSymbols[*]Show Resources Languages[*]Show Type of Debug informma~~tio~~n ~~(NB09, NB10, NB11, RSDS )[*]Show importe~~d ~~Functions of missing libra~~ Pr~~ies[*]Show t~~omptal nsu~~mber of Bytes available in Caves[*]Show Gaps in E~~pport[*]Added "The image expoor~~ted S~~ts XY Symb~~ols collection[*]Show Section Name the Base of Data be~~ol~~ong~~s" ~~to[*]Add~~as new Ind ~~valid~~icat~~ion~~ o~~f IMAGE_DOS_HEADER, IMAGE_NT_HEADERS~~r[*]Addded more obsolete functions in the WindowsFunctionsDeprecated.xml file (delivered ~~...~~with this project)[/list]

2012-09-18 22:00:41
Updated by Checker

Version: V34.6900
System Requirement:
Synopsis: PeStudio shows details about applications (.exe, .dll, .cpl, ocx, .ax, .sys, etc.) without starting them including:[list][*]All libraries that are used by an application.[*]All functions that are ~~All libraries that are used by an application. All functions that are imported by an application. All funct~~i~~ons (also anony~~m~~ous) that are ex~~ported by a an appplication. [*]All ffunctions (also anonymous) that are exported by an application.[*]All functitions thatat are forwarded to other librarie ~~forwarded to other libraries~~s. [*]Obsoletete Functitions t tha~~t are~~t are ex~~por~~ported and imported byy an application.[*]Whether the Data~~n application. Wh~~ Execution Preventheion (DEP) Windows secur ithey ~~Data Exe~~mec~~utio~~hanism ~~Prevent~~i~~on (DEP) Windows security mechanism is~~s used. [*]W~~hether~~ hether the Adddres~~s S~~s Spaace Layoout Randomization (ASLR~~) Windows secu~~) Windows security mechanism~~echanism is~~ is used. [*]Whe~~ther~~ther Sttruuctutured Exception Handling - SEHH Windows Wsecuri~~ndows~~ty smec~~urity mechan~~hanism i~~s us~~s used. [*]Whheth~~er some se~~er some sections arere compresessed.[/list]
How to extract: Download the ZIP package and extract to a folder of your choice. Launch [i]PeeStudio.exe[/i].
Size (in bytes): 758~~550~~34364
Icon: Updated
Screenshot: Updated
What's new: ~~Added detection o~~[list][*]Now fully support 64bit Images on 32bit Platform[*]Validate IMAGE_OPTIONAL_HEADER.SectionAlignment[*]Validate IMAGE_OPTIONAL_HEADER.FileAlignment[*]Validate IMAGE_OPTIONAL_HEADER.SizeOfUninitializedData[*]Validate IMAGE_OPTIONAL_HEADER.SizeOfInitializedData[*]Validate IMAGE_OPTIONAL_HEADER.SizeOfCode[*]Validate IMAGE_OPTIONAL_HEADER.NumberOfRvaAndSizes[*]Validate IMAGE_OPTIONAL_HEADER.SizeOfImage[*]Validate IMAGE_FILE_HEADER.SizeOfOptionalHeader[*]Validate IMAGE_FILE_HEADER.NumberOfSections[*]Validate IMAGE_FILE_HEADER.TimeStamp[*]Validate IMAGE_FILE_HEADER.PointertoSymbolTable[*]Validate IMAGE_FILE_HEADER.NumberOfSymbols[*]Show Resources Languages[*]Show Type of Debug information (NB09, NB10, NB11, "R~~esou~~SDS )[*]Show imported Functions of missing libraries[*]Show total number of Bytes available in Caves O[*]Show Gaps in~~ly"~~ Exported Symbols collection[*]Show Section Name the Base of Datag belongs to[*]Adde~~d detect~~d vali~~on of Borl~~da~~nd comp~~ti~~ler Show prese~~once of IMAGE_D~~elphi~~OS_HEADER, IMAGE_NT~~urbo Pascal Filers (TPF) in~~ _HEADERS[*]Adde~~sources~~d ...

2012-05-09 07:04:01
Updated by Checker

Version: V3.689
Size (in bytes): 7435368550
Screenshot: Updated
What's new: Added ~~MD4 footprint Corrected sections handling for encrypted/compressed files Correct~~de~~d fil~~terctiong of ~~dep~~ "Resoureces Only" ima~~ted~~ges Added dete~~xpor~~cteion of Borland compiler Symhow presence of Delphi Turbo Pascal Filers (TPF) in Resources

2012-05-05 10:05:44
Updated by Checker

Version: V3.678
Size (in bytes): 7~~726~~43536
What's new: ~~Fixed a bug when handling resources of encryp~~Added MD4 foot~~ed/compressed files Show presence of Embedded Type Library files in Resources Show~~ pr~~ese~~in~~ce of Embedded~~t ~~Regist~~Corryected ~~file~~s ections handling for Rencrypted/compressed files Courrected filtering of deprecated exported Symbols

2012-04-30 20:18:18
Updated by Checker

Version: V3.667
Size (in bytes): 77264435
Screenshot: Updated
What's new: ~~Show presence of Embedded Compressed HTML files in Resources Show presence of~~Fixed ~~Embedded~~a ~~Exec~~bu~~tabl~~g whe~~s files~~n handling ~~Resou~~resources ~~Show Res~~ o~~urces instanc~~f encrypte~~s an~~d ~~their charact~~/compreristsed ficles Show ~~MD5~~ presence of Embedded Type Library files in Resooturces Show presence of Embedded Registry files int Resources

2012-04-28 19:35:05
Updated by Checker

Version: V3.656
Size (in bytes): 7647012443
Screenshot: Updated
What's new: AShow presence of Embeddedded detection of SafeSEH mitigation technique Added detection of Cookies on the Stack (GS) mitigation technique Added a new Mitigation classification as Indicator If no Error found then show Warnings If no Warning found then show Evidences The image is linked with Debug Symbols, show this as Evidence The Image exports anonymous symbols, show this as Evidence Renamed Evidences as Indicators Created errors, warning and evidences nodes in indicators node in XML Show existence of Manifest as evidence Show Executable AND Writable Section as Warning Show image renamed as Warning Set Error, Warning levels for evidences Show Image target 64bit Processor as Evidence Show Missing Libraries in the imports Tab Show Missing Libraries as Error Show CPU mismatch as Error Don't translate Resources 241 to Manifest anymore Re-enable display of Debug infor Com~~ation Re-enable dis~~p~~lay of Co~~ressed ~~.NE~~HTML fi~~nformation Show new ev~~les i~~dence when at least o~~ne ~~Dir~~Resourctes Show pr~~y is invalid Show new evi~~esence of Embedded~~ence when at least one~~ SExecut~~ion~~ables fisles in~~valid~~ Resources Shoow Resources instances and their characteristics Show ~~...~~MD5 footprint

2012-04-06 21:21:45
Updated by Checker

Version: V3.645
Size (in bytes): 763647013
What's new: * VeAdded detection of SafeSEH mitigation technique Added detection of Cookies on the Stack (GS) mitigation technique Added a new Mitigation classification as Indicator If no Error found then show Warnings If no Warning found then show Evidences The image is linked with Debug Symbols, show this as Evidence The Image exports anonymous symbols, show this as Evidence Renamed Evidences as Indicators Created errors, warning and evidences nodes in indicators node in XML Show existence of Manifest as eviodence Show ~~3.64. Add~~Executabled ~~a new~~AND Writable Section as Warning Show image renamed as Warning Set Error, Warning levels for evidences Show Image target 64bit Processor as Evidence Show Missing Libraries in the imports Tab Show Missing Libraries as Error Show CPU mismatch as Error Don't translate Resources 241 to Manifest anymore Re-enable ditisplay of Debug information Re-enable display of Core .NET information Show new evidence when at least one Directory is invalid Show new evidence when at leasti one Sec~~lassifica~~tion a is Ininvalid~~icator. If no Error found then~~ sSho~~w Warnings. If no Warning fou~~w n~~d th~~e~~n sho~~w ~~Evidences~~...

2012-04-06 00:43:39
Updated by joby_toss

Version: V3.634
Size (in bytes): 760384613
What's new: * The image is linked with Debug Symbols, show this as Evidence The Image exports anonymous symbols, show this as Evidence Renamed Evidences as Indicators Created errors, warning and evidences nodes in indicVersion 3.64. Added a new Mitigat~~ors node in XML Show ex~~i~~ste~~on c~~e of Mani~~lassif~~est as ev~~idecation~~ce Show~~ ~~Execut~~a~~ble AND~~s ~~Writable Section as Warning Sh~~Indicator. If no Erro~~w image~~r refoun~~ame~~d athen s how Warnninngs. If no Warning found then show Evidences

2012-04-03 08:25:28
Updated by Checker

Version: V3.623
Size (in bytes): 7~~5411~~60384
What's new: . ~~Set Error, Warning levels for evidences. Show I~~The image is linked with Debug Symbols, show this as Evidence The Image exports anonymous symbols, show this as Evidence Renamed Evidences as Indicators Created errors, warninge and evidences nodes in indicators node in XML Show existence of Manifest as evidence Show Executable AND Wrgitable Sect ~~64b~~i~~t Pr~~o~~cessor~~n as ~~Evidence. Show Missing Libr~~ War~~ies i~~n ~~the~~ i~~mports Tab.~~ ng Show ~~Missing Libraries as Error. Shwo CPU m~~ ism~~atch as Error. Don't~~age ~~translate Resources 241 to Manifest anymore. Re-enable display of Debug info~~renam~~ation.~~ed ~~Re-en~~a~~ble di~~s~~play of Core .NET~~ iWarn~~format~~iong

2012-03-31 14:01:01
Updated by ashghost

Version: V3.612
What's new: . S~~how new~~ et Error, Warning levels for evidences. Show Image target 64bit Processor as Eviidenence. Show Missing Libraries in the imports Tab. Show Missing Libraries as Error. Shwo CPU mismatchen as Error. Don't translate Resources 241 to leManifest ~~one Di~~anymore~~ctory is~~. Re-enable display of Debug invformalti~~d Show new evidence whe~~on. Re-en at able~~ast~~ ~~one Section i~~dis ~~invalid Show new evidence when Entry~~ p~~oint is NULL Corrected Directories validit~~lay ~~test~~ of Co~~rrected~~re .NET ~~filter~~ing fo~~f W~~r~~itable and execut~~ma~~ble sec~~tion

2012-03-25 18:27:28
Updated by Checker

Version: V3.601
Size (in bytes): 757435114
What's new: Added support of Forwarded functions discovery Corrected Bug when reading the Resources of some images Added Resources to the Report Detect invalid directoires Added filtering of Sections Added support for Delay-loaded Libraries Improved performance by reading dependencies from memory whenever possible Added Core .NET information to the Report Added Manifest to the Report Put more details to Libraries into the Report Put more details to Sections into the Report Added Imported Symbols to the Report Added Exported Symbols to the Report Added File Header to the Report Added Exported Symbols in Report Added Sections in Report Handle Imported Libraries without version information Corrected missing path on some Imported libraries Icon of the image sometimes not shown when PeS~~tudio is started from t~~h~~e command pr~~o~~mpt. Distinguish betwe~~w new eviden ~~.NET and nativ~~ce imwhen agt least ~~when gathering Evid~~one~~nces Add discovery of the D~~ Directorory i~~es for x64 Image~~s Cinvalid Sho~~rrected a bug~~w new evidence wh~~en draggi~~eng a~~n Im~~t lea~~ge on~~st one Section is invalid Show new Pe~~Studio R~~vidence whesn Entry polvint is NULL Corrected Directorie~~d "Vi~~su val idity test C++orrected filtering of RWritable and execuntable secti~~me ...~~on

2012-03-23 18:04:32
Updated by Checker

Version: V3.5460
Size (in bytes): 735743501
What's new: ~~Put more details to Lib~~Added support of Forwarded functions discovery Corrected Bug when reading the Resources of some images Added Resources to the Report Detect invalid directoires Added filtering of Sections Added support for Delay-loaded Libraries Improved performance by reading dependencies from memory whenever possible Added Core .NET information to the Report Added Manifest to the Report Put more details to Libraries into the Report Put more details to Sections into the Report Added Imported Symbols to the Report Added Exported Symbols to the Report Added File Header to the Report Added Exported Symbols in Report Added Sections in Report Handle Impor~~ies~~ thed ~~Repo~~Libraries without version information Corrected missing path on some Imported libraries Icon of the image sometimes not shown when PeStudio is started from t ~~Add~~he command Imp~~orted Symbols to the Re~~romp~~ort Added Exported~~t. Distinguish between .NET and native images when gathering Evidences Add Sdiscovery of the Directories for x64 Im~~bol~~ages t Co rrecthed a bug ~~Report Add~~whe~~d Fil~~n dragging an Image Honto PeadStudio Resolver d "Visual C++ Runt~~o th~~ime ~~Report~~...

2011-12-19 21:15:53
Updated by Checker

Version: V3.534
Size (in bytes): 7~~276~~375501
Screenshot: Updated
What's new: ~~Added Exported Symbols in Report~~Put more details to Libraries the Report Added ~~Sections in Report Handle Imported Libraries without version information Corrected missing path on some~~ Imporrted Symbols to the Report Added Exported Symbol~~ibr~~s to the Report Added File Hearider to the Resport

2011-12-13 09:01:02
Updated by Checker

Version: V3.523
Size (in bytes): 723276237
Screenshot: Updated
What's new: IAdded Exported Symbols in Report Added Secontions in Report Handle Imported Libraries withof uth version inform~~age sometimes~~ ation Corrected ~~shown whe~~missing ~~PeS~~pat~~udio is~~ h on s~~tarted fr~~om the ~~command pro~~Imp~~t. Add disc~~o~~very of the Di~~rte~~ctor~~d li~~es fo~~br ~~x64 Im~~agries

2011-12-07 04:55:25
Updated by Ruby

Download URL: http://www.winitor.com/tools/~~PeStudio351.zip~~

2011-12-06 12:19:02
Updated by Checker

Version: V3.512
Size (in bytes): 718239262
What's new: * ~~Ver~~Icon of the image sometimes not shown when PeStudio i~~on 3.51~~s started from -the ~~01.12.2011. Resolved~~command dpr~~ag an~~ompt. Add d~~rop~~ iscovery of~~ailure~~ ~~on P~~the Directorie~~Studio when sh~~s for~~tcuted~~ ~~on the Desktop. Resolved~~x64 ~~"Visual C++ Runti~~Image ~~Error"~~s

2011-12-02 04:05:53
Updated by I am Baas

Download URL: http://www.winitor.com/tools/PeStudio3501.zip

2011-12-01 11:52:41
Updated by infimum

Version: V3.501
What's new: ~~28.11.2011 -~~* Version 3.51 - 0* Added Report of Libraries* Added Report of Manifest* Corrected a bug when reading 64Bit Imported Libraries* Corrected filtering of Imported Libraries* Resolved a crash when creating the Report. Improved performance by reading dependencies from memory whenever possible. The Obsolete Functions are now available as external (and extensible) "WindowsObsoleteFunctions.XML" file. Show OptionalHeader.MajorImageVersion and OptionalHeader.MinorImageVersion. Show OptionalHeader.MajorSubsystemVersion and OptionalHeader.MinorSubsystemVersion. Show the original file name of the Image when available. Show FileHeader1.12.~~IMAGE_FILE_REMOVABLE_RUN_ FROM_SWAP and FileHeader.IMAGE_FILE_NET_~~2011. R~~UN_FROM_SWAP. Selective~~esol~~y r~~ve~~port of~~d ~~Evidences~~drag an drop ~~Deb~~failure on PeStugdio ~~inf~~when shormaticuted on the Desktop. Resolved "Visual C++ Runtime Error"

2011-11-29 17:52:41
Updated by joby_toss

Version: V3.4750
Size (in bytes): 717876392
Download URL: http://www.winitor.com/tools/PeStudio34750.zip
Screenshot: Updated
What's new: ~~Resolved a~~ 28.11.2011 - Version 3.50* Added Report of Libraries* Added Report of Manifest* Corrected a bug when reading 64Bit Imported Libraries* Corrected filtering of Imported Libraries* Resolved a crash when creating the Report. Improved performance by reading dependencies from memory whenever possible. The Obsolete Functions are now available as external (and extensible) "WindowsObsoleteFunctions.XML" file. Show OptionalHeader.MajorImageVersion and OptionalHeader.MinorImageVersion. Show OptionalHeader.MajorSubsystemVersion and OptionalHeader.MinorSubsystemVersion. Show the original file name of the Image when availasble. Sh ow~~hen~~ FileHeader.IMAGE_FILE_REMOVABLE_RUN_ FROM_SWAP and FileHeader.IMAGE_FILE_NET_RUN_FROM_SWAP. Selectively report of Evidences and Debug information. Resolved "Visua~~ting~~l C++ Runthime ~~Rep~~Errort"

2011-11-20 10:52:05
Updated by Checker

Website URL: http://www.winitor.~~net/en/pestudi~~co~~.ht~~ml
Version: V3.457
Size (in bytes): 72178776
Download URL: http://www.winitor.~~net~~com/tools/PeStudio347.zip
Screenshot: Updated
What's new: Resolved ~~crashed on unexpected Manifest content. Added Dump of Section Added IPeSection interface Added IsLocatedInStandardDirectory function Extended GetImportedLibr~~a~~rie~~ crash ~~function with a parameter to filt~~whe~~r (Wi~~n~~dows) standard directories Extended IPeSectionHeaders interface to access~~ Secreati~~on Head~~ng ther Rep~~er Name~~ or ~~Index~~t

2011-08-23 00:13:32
Updated by Checker

2011-01-05 20:23:52
Updated by Checker

Version: V3.445
Size (in bytes): 72~~2516~~7877
What's new: ~~. Make Resources Types an~~ Resolved ~~Instances av~~cra~~ilable. Adde~~shed ~~IPeRes~~on urnexpecte~~TypeManifest interface. Added IPeResourceTypeVersionInfo interface. Consolidated IPeOptionalHeader interface. Consolidated IP~~d Manifest content. Added D~~irectories interface. Added N~~u~~mber of Sections as Evidences ( 2 < Sections < 96 ). Added FileAlignment and~~ mp of Seec~~tionAlignment fields to IPeOpt~~tion~~alHea~~ Adderd ~~inte~~IPeSection interfaace Added IsLocate~~. A~~ddeInStandardDirectory function Extended PGetImportedLibrarie~~Par~~s function with a parameter. to filibter (Windows) standard directo ~~the Z~~ries Extended IP eSectionHeaders interface to access Sectilon Header per Name or Index

2010-12-22 00:56:18
Updated by Checker

Version: V3.434
Synopsis: PeStudio shows details about applications (.exe, .dll, .cpl, ocx, .ax, .sys, etc.) without starting them including: ~~All libraries that are used by an application. All functions that are~~ All libraries that are used by an application. All functions that are imported by an application. All functions (also anonymous) that are exported by an an application. All ~~functions (also anonymous) that are exported by an application. All f~~functions t thaat are ~~forwarded to~~ fo~~ther librarie~~rwarded to other libraries. Obsolete ~~Functions that are exported and imported~~ Functions that are exported and imported by a an apppl~~ication~~ication. W~~hether th~~hether Dathe Data Executtion Preveention (DEP~~) Windows security mechanism is used. Whether the Address Space Layout Ra~~) Windows security mechanism is used. Whether the Address Space Layout Randomization (ASLR~~) Windows security mechanism is used. Whether Stru~~) Windows security mechanism is used. Whether Structured Excep~~tion~~ tion Hanndling - SEH Wiindow~~s se~~s security me mechanism is s used. Whether some sections are compressed.
Size (in bytes): 70225~~777~~16
What's new: . Make Resources Types and Instances available. Added IPeResourceTypeManifest interface. Added DIPeResourceTypeVersionInfo interface. Consolidated IPeOptionalHeader interface. Consolidated IPe~~tection of~~Directories interface. Added Number of Sections as Evidences ( 2 < Sections < 96 ). Added FileAlignment aunnd SechtionAlig ~~proc~~nment fieslds ~~func~~to IPeOption~~s as Evi~~alHeadeer interface. Adde~~d Detect~~d PeParser.lib to~~n of~~ the ZI~~mage Ob~~P f~~uscation (encryption, compression) as Ev~~i~~denc~~le

2010-12-03 21:53:29
Updated by Checker

Version: V3.423
Size (in bytes): 70~~8608~~5777
What's new: * ~~27.11.2010 - Version 3.42. Make t~~Added Detection of launching process functions as Evidence Added Detection of I~~nterf~~mace ge Obf~~ile PeParser.h p~~u~~blic. Added off~~secation (hiencrypt)ion, ~~of ex~~comportedssion) as ~~funct~~Eviodensce

2010-11-27 13:51:50
Updated by Checker

Size (in bytes): 7086630894

2010-11-27 13:51:07
Updated by Checker

Version: V3.412
What's new: * ~~Added Large Address Space awareness as Evidence Added Structured Storage as functions group Added OLE as functions group Added ImageHelp as functions group Added Setup~~27.11.2010 - Version 3.42. Make the Interface file AP~~I as functions group Addet Thread Local Storage (TLS - dynamic) as functions group Added Resource Section size bigger as Code Section size as Evidence Added Image Digital Signatu~~ePar~~e test a~~s ~~Evidence Add~~edr.h ~~Thread Loca~~publ ~~Storage (TLS - static) usage as Evidence. Added Image Bound detection as Evidence Added Custom Resource Types as Ev~~i~~den~~ce. Ad~~ded Detection of~~ded pro~~gramma~~ffset~~ic loadi~~ (hingt) of ~~libra~~expor~~ies as~~ted Evfunctideonces

2010-11-17 20:34:04
Updated by Checker

Version: V3.401
Size (in bytes): 646389428
What's new: Added ~~number of Sections as Evidence Added empty Checksum as Evidence Added other (Borland) standard sections as known sections Make size of DosStub (very sm~~La~~ll or v~~rgery ~~big) as Evidence Make Windows Network Functions a~~Address ~~Evidence PeStudio.exe %1 and Pe~~ S~~tudio.exe "%1" are now sup~~p~~orted M~~a~~ke fun~~c~~tio~~e awareness as Eviden~~s ad~~ce Added~~resses available Make Dos~~ Structu~~b size available Make Preferred Base Add~~re~~ss available~~d fSto~~r Libr~~rarige as Added support for a single Command Line parameter: e.g PeStudio.exe %1 will open the file to analyse Show whether the Section Names are standard as Evidence Number of imported symbols as Evidence Handle sectionless files Handle invalid Directories Show usage of Debugging functions as Evidence Show usage of NetBios functions as Evidence Show Usage of Service Control Manager (SCM) functions as Evidence Show usage of Hooking ffunc~~tions as Evidence Corrected pr~~tio~~blem with~~ns group~~x compresse~~ Ad ~~files Show~~ ded OLE as functions grousp Added iImageHelp as functions group Added Setup API as functile ons groupac Addet Thread ~~(Caves)~~ Locasl ~~Evidenc~~Storage ~~IAT size estim~~(TLS - dyna~~tio~~mic) as functions group Added Resource fSectiorn size Evbi~~denc~~ggesr a~~dju~~s~~ted~~ ~~Show Obs~~Code Section size as Evidence Added Image Digitale Signature test as Evidence Added Thread Local Storage (TLS - static) usage as Evidence . Added Impage Bound detection as Evidence Added Custom Reso~~rted f~~unrc~~tions~~ e Types as Evidence Added Detection of programmatic loading of libraries as ~~...~~Evidence

2010-11-10 08:58:46
Updated by joby_toss

Version: V3.3940
Size (in bytes): 649428~~6775~~
What's new: Added ~~other~~ number of Sections as Evidence Added empty Checksum as Evidence Added other (Borland) standard sections as known sections Make size of DosStub (Bovery small or very big) as Evidence Make Windows Network Functions as Evidence PeStudio.exe %1 and PeStudio.exe "%1" are now supported Make functions addresses available Make Dos Stub size available Make Preferred Base Address available for Libraries Added support for a single Command Line parameter: e.g PeStudio.exe %1 will open the file to analyse Show whether the Section Names are standard as Evidence Number of imported symbols as Evidence Handle sectionless files Handle invalanid Directories Show usage of Debugging functions as Evid)ence Show usage of NetBios functions as Evidence Show Usage of Service Control Manager (SCM) functions as Evidence Show usage of Hooking functions as Evidence Corrected problem with upx compressed files Show unused image file space ~~stand~~(Caves) as Evidence IAT size estimartion for Evidences adjusted Show Obsolete Imported function~~s as known sections Make size of DosStub (very small or very big)~~s as ~~Evidence~~...

2010-11-09 12:26:13
Updated by joby_toss

Version: V3.389
Size (in bytes): 686775~~084~~
What's new: ~~Make~~Added other (Borland) standard sections as known Wsectindowns NMake size~~twork~~ Fof DosStu~~nction~~b (very small or very big) as Eviden~~ce PeStudio.exe %1 and PeStudio.exe "%1" ar~~ce ~~now supported~~

2010-11-05 17:25:22
Updated by Checker

Version: V3.378
Size (in bytes): 6~~7932~~85084
What's new: Make ~~functions addresses available Make Dos Stub size available Make Preferred Base Address available for Libraries Added support for a single Command Line parameter: e.g~~Windows Network Functions as Evidence PeStud~~io.~~io.exexe %1 ~~will ope~~ and PeSt~~he file t~~udio.exe "%1" are n~~aly~~ow supported

2010-11-04 19:19:02
Updated by Checker

Version: V3.367
Size (in bytes): 67993620
What's new: * 01.11.2010 - Version 3.36 . Show whether the Section Names Make functions addresses available Make Dos Stub size available Make Preferred Base Address available for Libraries Added support for a~~ndard~~ assingle Command Line ~~Evi~~parameter: e.g PeStudio.exe~~nce . Number~~ %1 will o~~f im~~p~~orted symbols as Ev~~en the fi~~dence . Hand~~le ~~sec~~tio~~nless files .~~ Han~~dle inv~~al~~id Directori~~yses

2010-11-01 06:06:50
Updated by Checker

What's new: * 01.11.2010 - Version 3.36 . Shhow w whether th~~er the Section Names are standard as~~e Section Names are standard as Evidence . Nummb~~er of~~er of impor~~ted~~ ted symbols s as Ev~~idence .~~idence . Hand~~le se~~le section~~les~~less files . Handle invalid Directories

2010-11-01 06:06:03
Updated by Checker

Version: V3.356
Size (in bytes): 67993746
What's new: * S01.11.2010 - Version 3.36 . Show whether the Sectiown Names are standard as Evidence . Nu~~sage o~~mber of D imported symb~~ugg~~ols as Evidence . Handle sectiongless fuiles . Handle invalid Directio~~ns as Ev~~ri~~denc~~es

2010-10-29 15:23:43
Updated by Checker

Version: V3.345
Size (in bytes): 6~~6071~~73746
What's new: Show usage of ~~Hookin~~Debugg ~~functions as Ev~~iden~~ce Corrected problem with~~g fupx nctio~~mpres~~nsed fas Evildences

2010-10-27 08:18:26
Updated by Checker

Version: V3.334
Size (in bytes): 6586032717
What's new: Show usage of Hooking functions as Evidence Corrected problem with upx compressed ~~image~~ file s~~pace (Caves) as Evidence~~

2010-10-26 11:02:01
Updated by webfork

Version: V3.323
Size (in bytes): 657480372
What's new: IAT size estimation for Evidences adjusted Show Obsolete Imported functions as Evidence Show Obsolete Exported functions as Evidence Show usage of HTTP functions as Evidence Show usage of RAS functions as Evidence Show usnused image ~~of Win~~file s~~ock~~pace ~~function~~(Caves) as Evidence

2010-10-20 18:35:08
Updated by Checker

Version: V3.312
Size (in bytes): 65746378
What's new: ~~Resol~~IAT size estimation for Evidences adjusted Show Obsolete Imported functions as Evidence Show Obsolete cExporated functions as Evidence Show usage of HTTP functions as Evidence Show usage of RAS functions ash Evidence Shonw usage of W~~indow~~insock 64functions bas Evitdence

2010-10-17 08:55:43
Updated by Checker

Version: V3.301
Size (in bytes): 5646378~~729~~
What's new: TRes~~t COM Server Support Show COM Server supp~~o~~rt in Evidences Put E~~lv~~idences in XML file Corrected duplicated items in Export~~ed ~~fun~~ctirash ons lWindow 64 bist

2010-10-14 15:24:33
Updated by Checker

Version: V3.2930
Size (in bytes): 57~~494~~8729
What's new: ~~Corre~~Test COM Server Support Show COM Server support in Evidences Pute Evidences in XML file ~~a bug with *.DRV fil~~Correscted ~~Nat~~dupli~~ve image fil~~cate~~s w~~d it~~h e~~em~~pty IAT~~s ain Expor~~e valid~~ted ~~as n~~ functio~~rma~~ns list

2010-10-13 14:56:27
Updated by joby_toss

Synopsis: PeStudio shows details about applications (*.exe, *.dll, *.cpl, ocx, *.ax, *.sys, ..etc.) withouout starting them including: All libraries that are usted by a~~rti~~ng ~~them, like:- all libraries that are used by an application.- all functions that are imported by an application.- all funct~~application. All functions that are i~~ons (also anony~~m~~ous) that are ex~~ported by a an appplication.~~- al~~ All functions (also anonymous) that are exported by an application. All functions that are forwarded to other libraries. Obsolete Functions that ar~~e forwarded to other libraries.-~~e ~~Obsolet~~e ~~Functions that are exp~~xportedd and imported by a an appplication.~~- wheth~~ Whether ther Dat~~he Data~~ a Exeecution P~~revention (DEP) Windows security mechanism is used.- whether the Address Space L~~revention (DEP) Windows security mechanism is used. Whether the Address Space Layou~~t Ran~~t Randomization (ASLR~~) Windows security mechanism is used.- whether Stru~~) Windows security mechanism is used. Whether Structureded Excep~~tio~~tion Handlining - SEH Windo~~ws se~~ws security me mechanism is used.- wWhether some sections are compressed.

2010-10-13 07:50:53
Updated by joby_toss

Version: V3.289
Size (in bytes): 57~~5333~~4947
What's new: ~~Directories in XML Report Detection of some validity indi~~Correc~~ators Re~~t~~rieve Siz~~e~~OfCo~~de ~~Bet~~a bug witerh ~~librar~~*.DRV files Native image fiilters wi~~ng at~~ th e Umpty IAT are valided as normal

2010-10-12 19:18:36
Updated by Checker

Version: V3.278
Size (in bytes): 567533381
What's new: ShDirectories in XML Repowrt Directection of some validity indicators Retrieve SizeOfCode Better libraries filteries ng at t the U~~ser interface~~I

2010-10-03 18:43:42
Updated by Checker

Version: V3.267
Size (in bytes): 5546043381
What's new: * ~~03.10.2010 - Version 3.27. Show Directories at the User interface* 01.10.2010 - Version 3.26. Show Footprint (MD5) of the analyzed file in the XL Report. Show Section Po~~Show Di~~nterToRawData information. Show Section Nam~~rectories a~~ssociated with~~t the ~~Ent~~ Usery Pointerface

2010-10-03 07:56:39
Updated by Checker

What's new: * 03.10.2010 - Version 3.27. Show Directories at the User interface* 01.10.2010 - Version 3.26. Show Footprint (MD5) of the analyzed file in the XL Report. Show Section PointerToRawData information. Show Section Name associated with the Entry Point

2010-10-01 18:39:55
Updated by Checker

Version: V3.256
Size (in bytes): 55460~~853~~4
What's new: * ~~Retri~~01.10.2010 - Version 3.26. Show Footprint (MD5) of the analyzed file in the XL Revport. Show Section Point~~he Age of the~~erToRawData ~~debug f~~ile nformation. Show Sectiond Name asshow ci~~n XML~~ated with ~~Repor~~t Showe MaEn~~ifes~~try Poin ~~XL Repor~~t

2010-09-30 10:57:34
Updated by I am Baas

Version: V3.245
Size (in bytes): 5~~4816~~50853
What's new: PuRetrieve the Age of the ~~GUID~~ debug file and show in XML Report Sho~~f PDB~~w Manifest in ~~the~~ XML Report ~~file~~

2010-09-29 16:50:13
Updated by I am Baas

Version: V3.234
Size (in bytes): 54~~5533~~8168
What's new: ~~Retrieve~~ Put GUID of ~~PDB out of~~ PDB in the ~~Analyzed~~XML PEReport Ffile

2010-09-28 17:16:00
Updated by Checker

Version: V3.223
Size (in bytes): 54~~7474~~5533
What's new: ~~Check presence of digitally-signed data Compute MD5 Log file in XML format Check~~ Retrieve GUID~~ebug~~ Inof~~ormation and path to~~ PDDB ~~file Check COM Libraries Detection of (some) compression Algorithms Undec~~ o~~rating f~~uncti onf the Anamlyzed PE Files

2010-09-27 16:52:46
Updated by Checker

Version: V3.212
Size (in bytes): 54~~886~~7474
What's new: Check presence of digitally-signed data Compute MD5 Log file in XML format Check Debug Information and path to PDB file Check COM Libraries Detection of (some) compression Algorithms Undecorating function names

2010-09-21 04:22:55
Updated by Checker

Version: V3.219
Size (in bytes): 54~~220~~8864

2010-09-14 07:04:08
Updated by joby_toss

Version: V3.189
Size (in bytes): 5~~3862~~42208

2010-09-02 18:41:59
Updated by joby_toss

Version: V3.178
Size (in bytes): 5386~~576~~24

2010-09-01 13:46:11
Updated by Ruby

Version: V3.167
Size (in bytes): ~~189~~5936576

2010-08-31 18:28:23
Updated by Checker

Version: V3.156
Size (in bytes): 18779504936

2010-08-30 17:45:05
Updated by joby_toss

Dependencies: None

2010-08-30 17:44:03
Updated by Checker

Version: V3.145
Size (in bytes): 18775~~600~~04
Screenshot: Updated
Dependencies: ~~mfc90u.dll, MSVCR90.DLL, MSVCP90.DLL~~

2010-08-30 16:45:19
Updated by joby_toss

Dependencies: mfc90u.dll, MSVCR~~90.D~~90.DLL, MSVCP90.DL~~L, mfc90u.dll~~L

2010-08-29 20:52:03
Added by joby_toss

Change history for pestudio standard

Recent Searches

Popular Titles

Recent Forum Posts

Recent Comments

Recent Updates