PEStudio helps you to define the trustworthiness of the application being analysed. Among the indicators, PEStudio shows when an image is compressed using UPX or MPRESS. By editing the XML file, one can customize the Indicators shown and their severity. The classifications are based on XML files provided with PEStudio. Indicators show the potential and the anomalies of the application being analysed. Indicators are grouped into categories according to their severity. PEStudio shows Indicators as a human-friendly result of the analysed image. Since the executable file being analyzed is never started, you can inspect any unknown or malicious executable with no risk. The goal of PEStudio is to detect these anomalies, provide Indicators and score the Trust for the executable being analyzed. In doing so, it generally presents anomalies and suspicious patterns. Malicious executable often attempts to hide its malicious behavior and to evade detection. Use pestudio in batch mode with pestudiox.PEStudio is a unique tool that performs the static investigation of 32-bit and 64-bit executable.

PeStudio helps you to determine how suspicious the file being analyzed is. This feature can be switched ON or OFF using an XML file included with PeStudio. This feature only sends the MD5 of the file being analyzed. PeStudio can query Antivirus engines hosted by Virustotal for the file being analyzed. Evidently, it cannot replace a reliable antivirus solution but it does allow you to get a detailed report about the way an executable file was built. The goal of PeStudio is to provide a quick way to inspect executable files without having to run them. The program is aimed squarely at developers and Windows experts, but don’t let that put you off – there are features here which everyone can use and understand. PeStudio uses static analysis (and other techniques) to help you discover more about suspicious applications.

Pestudio