Utilities Windows
PeStudio for Windows
Inspect Windows executable files for malware indicators with PeStudio basic, a portable static-analysis tool restricted to private, occasional use.
- Operating system
- Windows; publisher does not specify a minimum version on the basic download page
- Architecture
- Not specified by the publisher for this ZIP package
- Download package
- Portable ZIP archive
Extract before use; no installation required. The historical screenshot does not establish current architecture or Windows-version support.
Link checked · Download guidance
What is PeStudio?
PeStudio helps you examine Windows executable files during an initial malware assessment. It brings file signatures, imported functions, embedded strings and other indicators into an inspection interface. Its basic edition can calculate entropy and imphash, reveal hardcoded URLs and IP addresses, and display .NET metadata. These findings support investigation; they are not a guarantee that a file is harmless.
The publisher distributes PeStudio 9.61 basic as a portable ZIP package. Extract the archive to use the application without an installer. The basic license permits occasional malware static analysis in a private context only; it excludes professional and corporate use. XML report export and the pestudiox.exe command-line tool belong to the separate professional edition.
PeStudio can show a VirusTotal score. According to the publisher, that lookup sends the analyzed file hash rather than the file itself and can be disabled. The screenshot supplied here is a historical PeStudio 3.18 interface from the source gallery, not a screenshot of version 9.61.
What it offers
- Inspect executable-file signatures, imports and embedded strings for indicators relevant to malware assessment.
- Calculate entropy and imphash; detect hardcoded URLs, IP addresses and TLS callback functions.
- View .NET metadata, functions, streams, tables and namespaces, and inspect or dump resources.
- Display VirusTotal scores through a file-hash lookup that the publisher says can be disabled.
- Use the basic Windows application from an extracted portable ZIP package without installation.
Good to know
- Basic is restricted to private, occasional malware static analysis; professional and corporate use is not permitted.
- The basic edition does not include XML report export or the pestudiox.exe command-line version; these are professional-edition features.
- VirusTotal imphash searching requires a valid VirusTotal Intelligence account.
Product images
Sources
References used for this listing. Retrieval dates do not indicate hands-on testing.
More in utilities
View category ↗
1.1.1.1 with WARP 2026.8.2115.0
Encrypt traffic from your Mac to Cloudflare’s network with WARP, or use DNS-only mode for encrypted DNS queries to the 1.1.1.1 resolver.
1.1.1.1 with WARP 2026.8.2115.0
Encrypt traffic between your Windows PC and Cloudflare, or use encrypted DNS only, with the free 1.1.1.1 with WARP app.
3uTools 9.12.005
Manage iPhone and iPad photos, music, apps and backups from Windows with 3uTools, a free utility that also includes device checks and firmware flashing tools.