# pestudio

> Winitor's Windows tool for initial malware assessment, which statically inspects Windows executable files and reports key indicators such as hard-coded URLs and IP addresses, flagged imports, resources and overlay data. The free basic edition also detects file signatures, debug information and TLS callbacks, computes entropy and imphash, shows the rich header and .NET metadata and looks up VirusTotal scores by hash; pestudio-pro adds MITRE ATT&CK mapping, XML reports and the pestudiox.exe command-line version.

- Type: Tool
- Targets: Binary
- Category: Native analysis tools
- Relationship: Foundation tool
- Sources reviewed: 2026-11-05
- Added to the catalog: 2026-11-06
- Original resource: <https://www.winitor.com/>
- Catalog page: <https://awesomerea.org/resources/pestudio/>
- Record JSON: <https://awesomerea.org/resources/pestudio/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/pestudio/index.md)

## Requirements & limits

- **Prerequisites:** Version 9.61, whose feature and licensing sheets are dated March 2025, ships as a ZIP that needs no installation; the download page says it is fully portable, does not alter the system it runs on and runs on any Windows system.
- **License:** The free basic edition may be used only in a private context for occasional malware static analysis, not in a professional or corporate environment. pestudio-pro is sold as a one-year license per user that includes free updates, is not renewed automatically and is delivered as a password-protected ZIP.
- **Limits:** VirusTotal lookups send only the file's MD5 hash, never the sample, and an XML switch disables them; searching VirusTotal by imphash needs a VirusTotal Intelligence account. The software is provided as-is without warranty, and its bundled XML files may not be used outside pestudio without the author's permission.

## Primary sources

1. <https://www.winitor.com/>
2. <https://www.winitor.com/download>
3. <https://www.winitor.com/download2>
4. <https://www.winitor.com/pro>
5. <https://www.winitor.com/tools/pestudio/current/pestudio-features.pdf>
6. <https://www.winitor.com/tools/pestudio/current/pestudio-licensing.pdf>
7. <https://www.winitor.com/tools/pestudio/changes.log>

## More in Native binaries

- [OllyDbg](https://awesomerea.org/resources/ollydbg/index.md) · Tool
- [Tenet](https://awesomerea.org/resources/tenet/index.md) · Tool
- [findcrypt-yara](https://awesomerea.org/resources/findcrypt-yara/index.md) · Tool
- [deREferencing](https://awesomerea.org/resources/dereferencing/index.md) · Tool
- [HexRays Toolbox](https://awesomerea.org/resources/hexrays-toolbox/index.md) · Tool
- [Virtuailor](https://awesomerea.org/resources/virtuailor/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.