pestudio

pestudio parses Windows executables and collects imports, exports, strings, resources, and overlay data. It flags suspicious imports and section names, marks self-modifying sections, and detects hard-coded URLs and IP addresses, which helps an analyst judge a file without running it. The free edition is licensed for private use, and professional use needs a paid license.

Fast static triage of Windows samples on an analyst workstation.

• +Flags suspicious imports, section names, and resource signatures.
• +No execution of the sample required.
• +XML report export in the professional edition.

• +Batch mode (pestudiox.exe) requires the paid professional license.
• +Free tier excludes professional use.

Static triage of endpoint-dropped files to decide whether escalation to dynamic analysis is warranted.