Here we are presented with information such as hashes of the sample, if you are dealing with a malware-related incident in your organization you could use this information to start blocking and looking for devices that have these hashes on the filesystem. Upon opening a malware sample in PeStudio the user is presented with the ‘Main’ tab. The user is then presented with a number of tabs that provide varying information that PeStudio has pulled out of the sample Main Tab Double-clicking the desktop icon opens the tool, to start investigating a piece of malware simply drag the malware sample into the tool. What I love about PeStudio is how easy it is to use and the clear, simple layout of the tool. In this article, I will cover what PeStudio is, some of the key features and how you can use it to begin analyzing malware. This is great for the initial triage of a malware sample. It provides so much information about the sample and gives me a wealth of information for me to start building out my report.

Whenever I begin analysing a piece of malware, I will always load it into PeStudio first. * Whether Structured Exception Handling - SEH Windows security mechanism is used.PeStudio is a tool used for statically analyzing malware and is one of my favourite tools for malware analysis. * Whether the Address Space Layout Randomization (ASLR) Windows security mechanism is used. * Whether the Data Execution Prevention (DEP) Windows security mechanism is used. * Obsolete Functions that are exported and imported by an application. * All functions that are forwarded to other libraries. * All functions (also anonymous) that are exported by an application. * All functions that are imported by an application. * All libraries that are used by an application. sys, etc.) without starting them including: PeStudio shows details about applications (.exe. For this reason, you can analyze suspicious applications with PeStudio with no risk! Executable files analyzed with PeStudio are never started.

PeStudio is a free tool which can be used to perform static analysis of any Windows application and reveals not only Raw-data, but also Indicators of Trust. There is one post on here that mentions it, but nobody seems to have replied ? As it looks useful i thought it deserved it's own thread :) Just seen this posted on Wilders by TyRidian.

Pestudio tool