PeStudio - подробная информация о приложениях

[Risovod]

PeStudio
Скриншот

PeStudio - компактная программа, дающая подробную информацию о приложениях без необходимости их запуска. PeStudio дает информацию о любом приложении (*.exe,*.dll,*.cpl,*.ocx,*.sys,...), не запуская его. Для начала проверки - просто перетащите мышкой проверяемый файл в окно программы PeStudio.

Возможности программы:

- является ли приложение 32 или 64 битным;
- использует ли приложение потенциально опасные для Вашего компьютера функции;
- используется ли структурная обработка исключений (SEH);
- показывает все библиотеки, используемые приложением;
- информация об импорте/экспорте функций приложением;
- другую существенную информацию о приложении.

Разработчик: Winitor
Лицензия: FreeWare
Язык интерфейса: English
Размер: ≈ 400 KB
ОС: Windows XP/2003/Vista/7/8 (32-bit & 64-bit)

[Risovod]

PeStudio 7.31

Размер: 401 KB
Скачать

[Risovod]

PeStudio 7.44

Размер: 445 KB
Скачать

[scaM]

PeStudio 8.00

Changelog

January 16th, 2014

Fixed a crash when disabling VirusTotal query
Show the Signature of the files Embedded in the Custom Resources

Скачать ~583 KB

[YSF]

PeStudio 8.01

Изменения:

January 19th, 2014

• Extented PeStudioOrdinals.xml for LDAP by ordinals
• Added a Threshold for size of Custom Resources
• Extended PeStudioThresholds.xml

Скачать (584 kb)

[SerVer_UA]

PeStudio 8.37

Изменения:

Version 8.37
. Fixed a bug when handling the <PreferedVirustotalEngine>

Version 8.36
. Fixed a bug when handling the virustotal Engines
. Added Thresholds for DOS Stub and Header size
. Added Thresholds for Blacklisted Imported Libs and Blacklisted functions number
. Added Thresholds for Blacklisted Strings count
. Added Thresholds for Blacklisted Exported Functions count

Version 8.35
. Added XML Threshold of number of Antivirus detecting the image as infected

Version 8.34
. Extended Imported Symbols View
. Extended Indicators
. Added XML Thresholds for several values
. Added XML "prefered" Antivirus Engine Name

Version 8.33
. Added XML Threshold on Libraries count

Version 8.32
. Added support for White listing of Libraries per name in PeStudioWhiteListLibraries.xml
. Fixed a bug in the collection of libraries

Version 8.31
. Extended Sections View
. Extended Blacklists
. Extended detection
. Extended the XML report resulting of the analysis
. Fixed update of Virustotal Lookup
. Fixed Ordinal to Name mapping for 64bit images

Version 8.30
. Images analysed are now parsed in separated Thread
. Extended detection of Overlay
. Added Thresholds for Image Size
. Added Thresholds for Certificate Size
. Added Default Threshold for Resources
. Fixed a crash when analysing some 64bit files
. Extended Blacklisted Libraries and Functions
. Extended detection of embedded Registry items
. Added Threshold (PeStudioThresholds.xml) for DateTimeStamp
. Added Threshold (PeStudioThresholds.xml) for Debug Age
. Detect access to Group Policy
. Consolidated Libraries and Functions Blacklisting
. Extended the detection of privileged APIs
. Begin detection of Functions requiring Access Rights (privileges) to be set
. Extended Thresholds detection
. Fixed a bug when handling 64bit Images
. Added detection of bound Libraries
. Detect Clipboard Chain hooking
. Extended Blacklist of API
. Extended detection of Undocumented API

Version 8.20
. Extended blacklist of API
. Extended the detection of Smartcard usage
. Detect Mouse and Keyboard Events programmatic synthesis
. Extended detection of files embedded in Resources and Overlay
. Added support for detection of Undocumented API (PeStudioFunctionsUndocumented.xml)
. Fixed a bug when invoking PeStudio.exe from the prompt with a file
. Extended Features detection
. Extended Blacklisted functions detection
. Extended detection of Overlay for InnoSetup
. Show shrinked DOS-Header
. Extended detection of Overlay
. Added PeStudioWhiteListLibraries.xml
. Show Overlay Signature
. Blacklist Well-Known SID
. Fixed a bug when Dumping a resource
. Images in Windows directories are considered as trusted
. Extended Features detection
. Extended Blacklisting

Version 8.10
. Blacklist DNS and IP APIs
. Added detection of Microsoft Detour
. Added detection of Hooking
. Added detection of AutoIt
. Allow RAW-dumping using the context menu of any resource
. Extended Features detection
. Added Detection of Resources reuse
. Extended Features detection
. Extended Blacklisting
. Show default Icon of the Image being analysed (which often helps as first suspicious indicator)
. Extended Features detection
. Extended Blacklisting
. Extended detection of embedded IP Addresses
. Added Feature detection of Regular Expressions (Regex)
. Added Feature detection of Service Control Manager (SCM)
. Added "Anomalies" Indicators.
. Added detection of fake Microsoft executables
. Extended "Features"
. Added PeStudioFeatures.xml
. Added a Threshold for size of Custom Resources
. Extended PeStudioThresholds.xml

Скачать (672 kb)

[SerVer_UA]

PeStudio 8.38

Изменения:

Version 8.38
. Added more Indicators and Thresholds
. Added Functions Groups classification
. Resources with unknown Signature and containing only text are now tagged as Text
. Fixed a bug when handling the Characteristics of the FileHeader
. Added MD5, SHA1 and Virustotal Score for Overlay

Скачать (694 kb)

[SerVer_UA]

PeStudio 8.39

Изменения:

Version 8.39
. Small cosmetic issues
. Added Indicators and Thresholds
. Fixed a bug when handling the imports of some images

Скачать (695 kb)

[SerVer_UA]

PeStudio 8.40

Изменения:

Version 8.40
. Added Blacklist of MD5 dedicated to the Overlay
. Extended detection of files embedded in Resources
. Added detection of Regular Expressions and Threshold
. Cache Virustotal scores when Internet connection drops

Скачать (699 kb)

[SerVer_UA]

PeStudio 8.41

Изменения:

Version 8.41
. Extended validation of Sections
. Resolve OpenSSL ordinals API to User friendly names

Скачать (701 kb)

[SerVer_UA]

PeStudio 8.42

Изменения:

Version 8.42
. Added detection of references to Firefox API
. Added MD5 Blacklist for a file and its Resources
. Extended detection of Overlay

Скачать (705 kb)

[SerVer_UA]

PeStudio 8.43

Изменения:

Version 8.43
. Added XML-based detection of PeID Signatures
. Added XML-based detection of OIDs
. Added XML-based detection of useragent
. Extented blacklists

Скачать (860 kb)

[SerVer_UA]

PeStudio 8.44

Изменения:

Version 8.44
. Added PeID Signature detection of Executable embedded in Resources
. Added PeID Signature detection of Executable embedded in Overlay

Скачать (862 kb)

[SerVer_UA]

PeStudio 8.45

Изменения:

Version 8.45
. Added Virustotal aging and submission date
. Extended Languages detection and mapping

Скачать (868 kb)

[SerVer_UA]

PeStudio 8.46

Изменения:

Version 8.46
. Added new thresholds
. Extended detection
. Fixed a crash with malformed files
. Corrected duplicates during collection of functions statistics

Скачать (875 kb)