PeStudio 9.58

https://www.upload.ee/...oRooM.rar.html
Mirror / Зеркало
https://wdho.ru/a986f63
Mirror / Зеркало
https://mega.nz/file/V...D39NBhhGoomdcU

password softoroom

_http://www.winitor.co...eStudio620.zip

_http://www.winitor.co...eStudio640.zip

. Added detection of 7zSFX files embedded in Resources
. Added Mapping of Language Code of StringFileInfo to Human friendly name into the XML Report
. Added Mapping of Code Page of StringFileInfo to Human friendly name into the XML Report
. Icon at the UI is now directly loaded from the Resource using our own interface

_http://www.winitor.co...eStudio650.zip

. Added a context menu to Libraries Tab to test the MD5 of the pointed Library on www.virustotal.com using the default Browser (only the MD5 is HTTP posted, NOT the image!)
. Added a context menu to Indicators Tab to test the MD5 of the analyzed image on www.virustotal.com using the default Browser (only the MD5 is HTTP posted, NOT the image!)
. Added a context menu to Libraries Tab to analyse dependent libraries with a new instance of PeStudio
. Added a context menu to Strings Tab to dump and copy to clipboard
. Added Indicator "The image has no Translation information"
. Added detection of MOFDATA (Managed Object Format - MOF) Resources
. Added detection of WEVT_TEMPLATE (Windows XML Event Log - EVTX) Resources

_http://www.winitor.co...eStudio665.zip

. Added a new "Lookup at VirusTotal" link
. Removed a bug that disabled all check boxes

_http://www.winitor.co...eStudio670.zip

. Added support for dumping resources using the right-click in the Tree view
. Check for Directories outside of the Image (and thus avoid crash of Pestudio with some malformed images)
. Added Indicators for Directories outside of Image

_http://www.winitor.co...eStudio675.zip

. The Lookup at VirusTotal has been totally integrated into PeStudio, no browser is started anymore
. The result of VirusTotal is now shown at the UI
. The result of VirusTotal is now available in the XML report file
. ALL corkami images have been tested against PeStudio

_http://www.winitor.co...eStudio680.zip

. Added *ALL* details of the VirusTotal scan report in the XML report file
. Consolidated the UI of the Debug, .NET, Manifest items in the Miscelllaneous Tab
. Added DosHeader output to UI
. Consolidated DosHeader list, File Header list, Optional Header list and SectionHeader list in one view
. Added the Version details to the Miscelllaneous Tab
. Added .NET basic information
. Addes support for CTRL-A selection for ALL lists
. Added Copy & Paste with the context Menu in All lists
. Corrected a bug by showing the libraries image base Addresses
. Consolidated headers (DOS, File, Section, Directory) in XML Report file

_http://www.winitor.co...eStudio685.zip

. Put Directories Tab into Headers Tab
. Add new Indicators and validation tests
. Add more coloring for showing fields validation for many samples of corkami
. Handle another type of malformation of image (and thus avoid crash of PeStudio)

_http://www.winitor.co...eStudio686.zip

. Handle unsual MS-DOS Header size and show at the UI and XML report accordingly
. Added Indicator "The size of the MS-DOS Header (%i Bytes) completes to the PE specification"
. Added Indicator "The size of the MS-DOS Header (%i Bytes) has been Increased"
. Added Indicator "The size of the MS-DOS Header (%i Bytes) is Smaller than the standard"
. Added Indicator "The count (%i) of Section Headers has reached the Windows Limits"
. Added Indicator "The count (%i) of Section Headers is very unusual"

_http://www.winitor.co...eStudio687.zip

. Added Detection of Qt Embedded Resources
. Added Translation of OptionalHeader.Subsystem into human friendly name
. Added support for Directories located outside of Section (aka. TinyPe.exe)
. Corrected computation of MS-DOS Header
. Added Indicator "The size (%i Bytes) of the MS-DOS Stub is very uncommon"

_http://www.winitor.co...eStudio688.zip

. Enhanced detection of fake UPX
. Extented Blacklist of Functions
. Fixed a bug when handling exported functions
. Show Section:Offset Addresses where exports, imports and strings are located in

_http://www.winitor.co...eStudio709.zip

Version 7.10
. Show Section:Offset for Resources
. Extended Types and location of embedded Executables
. More validity checks on Exports
. More detection of Masquerated UPX

_http://www.winitor.co...eStudio710.zip

Version 7.11
. Removed many strings from Parser and put these in a new PeStudioTranslations.XML file
. Corrected NB10 debug detection

_http://www.winitor.co...eStudio711.zip

Version 7.12
. Extended detection of Custom Embedded files in standard Resources

_http://www.winitor.co...eStudio712.zip

Version 7.13
. Added Detection of Device Drivers and handle Indicators accordingly

_http://www.winitor.co...eStudio713.zip

Version 7.17
. Added MD5 computation for Sections
. Extented Severity levels with "positive" (green) indicators
Version 7.16
. Handle shrinked (hand-crafted) File Header
. Added collection of Unicode Strings
Version 7.15
. Detect (direct) usage of Native API
Version 7.14
. Detection of Embedded Executable in malformed Images
. Detect Images statically linked to the C-Runtime and show this as Indicator

_http://www.winitor.co...eStudio717.zip

Version 7.26
. Added Validity checks (and Indicators) on Section Headers (e.g. file missalignment)
. fixed SHA1 issue

_http://www.winitor.co...eStudio726.zip

Version 7.27
. Support usage of PeStudio from the Command Prompt
. Started a "PeStudio Handbook.pdf"

_http://www.winitor.co...eStudio727.zip

Version 7.28
. fixed a bug when opening PeStudio with a right-mouse click on in Explorer
. "PeStudio Handbook.pdf" is now directly available at www.winitor.com

_http://www.winitor.co...eStudio728.zip

Version 7.29
. Handle malformed or empty App Paths entries
. Show/Hide Virustotal TAB from the UI and Show/Hide the Virustotal XML Section according to the switch in PeStudioVirusTotal.xml

_http://www.winitor.co...eStudio729.zip

_http://www.winitor.co...eStudio730.zip

Version 7.31
. Handled an issue when loading the same image multiple times
Version 7.30
. Correct Load Configuration Directory validation
. Added detection of in-process COM Server (e.g. IE Plugin)
. Handle malformed or empty App Paths entries
. Show/Hide Virustotal TAB from the UI and Show/Hide the Virustotal XML Section according to the switch in PeStudioVirusTotal.xml
. fixed a bug when opening PeStudio with a right-mouse click on in Explorer
. "PeStudio Handbook.pdf" is now directly available at www.winitor.com
. Support usage of PeStudio from the Command Prompt
. Started a "PeStudio Handbook.pdf"
. Added Validity checks (and Indicators) on Section (e.g. file misalignment)
. fixed SHA1 issue

_http://www.winitor.co...eStudio731.zip

Version 7.32
. fixed a crash with files depending on a specific library.

_http://www.winitor.co...eStudio732.zip

Version 7.33
. Better validation of certificat

_http://www.winitor.co...eStudio733.zip

Version 7.34
. Handled misalignement of Version buffer

_http://www.winitor.co...eStudio734.zip

Version 7.36
. Added Support of images packed with FSG
Version 7.35
. Better imports detection
. Handled misalignement of Version buffer
. Better validation of certificat
. fixed a crash with files depending on a specific library.
. Handled an issue when loading the same image multiple times

_http://www.winitor.co...eStudio736.zip

Version 7.37
. Added detection of empty fields in the Version Information block
. Added Indicator "The Version field '%s' is Empty" (e.g The Version field 'CompanyName' is Empty)

_http://www.winitor.co...eStudio737.zip

. Redesign of the User Interface
. Support loading of multiple images
. Demangled the Parser programmatic interface
. Issue: when loading too many images simultaneously, the VT results are not retrieved for some images. This
is "normal" since the current key PeStudio is using is restricted as far as the amount of request pro seconds
is concerned. This issue will be handled with VT until in the next version.

_http://www.winitor.co...eStudio738.zip

Version 7.39
. Added context-menu for all lists
. Added Accelerators
. Added Close All Images button

_http://www.winitor.co...eStudio739.zip

Version 7.40
. Fixed the dependencies of the new UI of PeStudio

_http://www.winitor.co...eStudio740.zip

Version 7.47
. Raw discovery of fundamental characteristics of the Certificate(s) embedded in the Image
. Extended Indicators for Certificates
Version 7.46
. Corrected execution of PeStudio from the command prompt
. Images that cannot be opened (e.g. invalid format,...) are shown in Gray
. Extended Tree Context Menu for VirusTotal
Version 7.45
. Extended Tree Context Menu
. Added Relocation Tables discovery
. Added Indicator about Relocation Items in PeStudioIndicators.xml
. Added discovery of registered Exception handlers of 64bit Images
. Added Indicators for registered Exception handlers
. Added discovery of static usage of Thread Local Space (TLS)
. Added Indicator for usage of Thread Local Space (TLS)
. Extended Filtering
. Added a Filtering mechanism in the Parser
. Added a UI to filter according to the presence of Certificate
. Corrected FileVersion shown when pointing the image
. Extended context menu for imported libraries
. Extended context menu for resources
. Implemented the "default_view" (see PeStudioSettings.xml)
. Added general Information when pointing an Image root
. Added Tree colouring (e.g. VirusTotal score)
. Added Tree context menu

_http://www.winitor.co...eStudio747.zip

Version 8.20
. Extended blacklist of API
. Extended the detection of Smartcard usage

Version 8.19
. Extended blacklist of API
. Detect Mouse and Keyboard Events programmatic synthesis

Version 8.18
. Extended detection of files embedded in Resources and Overlay

Version 8.17
. Added support for detection of Undocumented API (PeStudioFunctionsUndocumented.xml)

Version 8.16
. Fixed a bug when invoking PeStudio.exe from the prompt with a file

Version 8.15
. Extended Features detection
. Extended Blacklisted functions detection
. Extended detection of Overlay for InnoSetup
. Show shrinked DOS-Header
. Extended detection of Overlay
. Added PeStudioWhiteListLibraries.xml
. Show Overlay Signature
. Blacklist Well-Known SID
. Fixed a bug when Dumping a resource
. Images in Windows directories are considered as trusted
. Extended Features detection
. Extended Blacklisting

Version 8.10
. Blacklist DNS and IP APIs
. Added detection of Microsoft Detour
. Added detection of Hooking
. Added detection of AutoIt
. Allow RAW-dumping using the context menu of any resource
. Extended Features detection
. Added Detection of Resources reuse
. Extended Features detection
. Extended Blacklisting
. Show default Icon of the Image being analysed (which often helps as first suspicious indicator)

Version 8.05
. Extended Features detection
. Extended Blacklisting
. Extended detection of embedded IP Addresses
. Added Feature detection of Regular Expressions (Regex)
. Added Feature detection of Service Control Manager (SCM)
. Added "Anomalies" Indicators.
. Added detection of fake Microsoft executables
. Extended "Features"
. Added PeStudioFeatures.xml
. Added "Features" as part of the "Indicators". Features translates the APIs, and other data into "Features" of the executable
being analysed (e.g. The API "FindFirstUrlCacheEntry()" is translated as "The image accesses the IE Protected Storage" Feature).
. Extended PeStudioOrdinals.xml for LDAP by ordinals
. Added a Threshold for size of Custom Resources
. Extended PeStudioThresholds.xml

Version 8.00
. Fixed a crash when disabling VirusTotal query
. Show the Signature of the files Embedded in the Custom Resources
. Added Min/Max Threshold checks on HTML Resource size and Extended PeStudioThresholds.xml
. Extended PeStudioIndicators.xml
. Extended PeStudioOrdinals.xml
. Extended PeStudioBlackListFunctions.xml
. Extended PeStudioBlackListLibraries.xml
. Correct an issue when showing the Resources friendly names at the GUI
. Extended PeStudioThresholds.xml to detect the Min/Max size of Manifest
. New classification of Strings
. Extended detection (and Indicator) of File Version Information suspicious fields
. Extended PeStudioOrdinals.xml
. Corrected Ordinals mapping for 64 bit images
. Better visualization of Relocations entries
. Added Detection of Blacklisted Function of Delayed-loaded Libraries
. Added Support for Strings Tables
. Added Detection of Self-Registering DLLs
. Added PeStudioEvasions.xml to support the detection of attempts Evasions (Antidebugging)
. Added (part of) exported MFC42 ordinals to PeStudioOrdinals.xml
. Map Version Translation Information to user friendly string
. Show Version Translation Information Blacklisted Languages
. Extended PeStudioOrdinals.xml to Resolve SNMP functions imported by Ordinals back to their original names
. Added Dumping of Overlay
. Extended malicious usage of Resource Icons
. Added new Indicator for suspicious Resource Icons
. Added Support for Sections -> Context Menu -> Dump
. Added Support for Dumping ICO as RAW and ICO.file format
. Extended detection of suspicious debugger fields (invalid content - e.g.: flame)
. Added PeStudioFunctionsMapping.XML to map Function Names (e.g. SystemFunction036 to RtlGenRandom )
. Added detection of GINA
. Extended Directories Validation
. Added Valid, Missing, Empty fields for Directories
. Extended PeStudioBlackListLibraries.xml
. Extended PeStudioIndicators.xml
. Extended validation of Debug fields
. Extended PeStudioIndicators.xml
. Added Context Menu at the image level
. Added Certificates validity handling
. Added Indicator Id in the output XML report
. Created PeStudioBlackListLibraries.xml for the Detection of blacklisted Libraries
. Added a new Indicator in PeStudioIndicators.xml
. Fixed a bug when handling empty Relocation Table
. Created PeStudioPrompt.exe, a stand-alone version of PeStudio running exclusively at the prompt
. Fixed a problem when disabling the Lookup to VT
. Added detection of Debug File without PDB extension
. Added detection of Debug File name different than the image name
. Changed Sections UI
. Changed VirusTotal UI
. Added Query MSDN context menu for Exported Functions
. Show Gaps in Exported Functions Table
. Extended PeStudioTranslations.xml
. Extended PeStudioIndicators.xml
. Show more details of VirusTotal
. Added detection of PeCompact compressor
. Fixed a bug with Ctrl+T
. Extended PeStudioThresholds.xml (which enables your to define your own thresholds)
. Extended PeStudioTranslations.xml (which enables you to change the text at the UI)
. Extended PeStudioSettings.XML (which enables you to change the behaviour of PeStudio)
. Added R/W support UI <--> PeStudioSettings.XML
. Extended PeStudioBlackListFunctions.xml
. Fixed an Issue when closing all files
. Added detection of missing Trust Information inside Manifest
. Extended PeStudioIndicators.xml
. Extended PeStudioTranslations.xml
. Added a switch (see PeStudioBlackListStrings.xml) for case-sensitiveness when scanning the black strings
. Added a switch (see PeStudioBlackListStrings.xml) for substrings when scanning the black strings
. Added Support for Windows File Redirection
. Added DOS Stub at the UI
. Added new Indicator related to the (suspicious) size of the DOS Stub
. Added PeStudioThresholds.xml that contains the Min, Max values used as thresholds
. Fixed enabling/disabling Virustotal lookup switch
. Enable to open ANY image (to show the results with VirusTotal)

Version 7.50
. Added Dump of Indicators
. Added Dump of Manifest
. Added Context menu for Certificates
. Added Dump of Certificates
. Raw discovery of fundamental characteristics of the Certificate(s) embedded in the Image
. Handle non-printable characters in XML report
. Added more Indicators specific to the location of the Entry Point
. Added more details (offset and size) for each file Cave detected
. Show the name of the section BaseOfCode is located in
. Fixed reporting of the Libraries in the XML report
. Simplified Indicators XML file
. Added Indicators specific for First and Last Sections
. Take virtual Section into account when pointing the overlay
. Fixed detection of MPRESS under 64bit
. Added detection and Indicator of suspicious Certificate size
. Added detection and Indicator of suspicious Certificate content (e.g. padding)
. Added MD5 computation for Resources
. Added MD5 computation for Sections
. Extended Severity levels with "positive" (green) indicators
. Added collection of Unicode Strings
. Detect (direct) usage of Native API
. Detection of Embedded Executable in malformed Images
. Detect Images statically linked to the C-Runtime and show this as Indicator
. Added Detection of Device Drivers and handle Indicators accordingly
. Extended detection of Custom Embedded files in standard Resources
. Removed many strings from Parser and put these in a new PeStudioTranslations.XML file
. Corrected NB10 debug detection
. Show Section:Offset for Resources
. Extended Types and location of embedded Executable
. More validity checks on Exports
. More detection of Masqueraded UPX

_http://www.winitor.co...eStudio820.zip

Version 8.22
. Added detection of bound Libraries
. Setup detection of Common folder variables
. Setup detection of KNOWNFOLDERID constants represent GUIDs

Version 8.21
. Detect Clipboard Chain hooking
. Extended Blacklist of API
. Extended detection of Undocumented API

_http://www.winitor.co...eStudio822.zip

Version 8.23
. Extended blacklist and Features detection
. Fixed a bug when handling 64bit Images

_http://www.winitor.co...eStudio823.zip

* Extended Sections View
* Extended Blacklists
* Extended detection
* Extended the XML report resulting of the analysis
* Fixed update of Virustotal Lookup
* Fixed Ordinal to Name mapping for 64bit images

_http://www.winitor.co...eStudio831.zip

Version 8.34
. Extended Imported Symbols View
. Extended Indicators
. Added XML Thresholds for several values
. Added XML "prefered" Antivirus Engine Name
Version 8.33
. Added XML Threshold on Libraries count
Version 8.32
. Added support for White listing of Libraries per name in PeStudioWhiteListLibraries.xml
. Fixed a bug in the collection of libraries

_http://www.winitor.co...eStudio834.zip

Version 8.35
. Added XML Threshold of number of Antivirus detecting the image as infected

_http://www.winitor.co...eStudio835.zip

Version 8.36
. Fixed a bug when handling the virustotal Engines
. Added Thresholds for DOS Stub and Header size
. Added Thresholds for Blacklisted Imported Libs and Blacklisted functions number
. Added Thresholds for Blacklisted Strings count
. Added Thresholds for Blacklisted Exported Functions count

_http://www.winitor.co...eStudio836.zip

Version 8.37
. Fixed a bug when handling the

»» Нажмите, для закрытия спойлера | Press to close the spoiler ««

_http://www.winitor.co...eStudio837.zip

Version 8.38
. Added more Indicators and Thresholds
. Added Functions Groups classification
. Resources with unknown Signature and containing only text are now tagged as Text
. Fixed a bug when handling the Characteristics of the FileHeader
. Added MD5, SHA1 and Virustotal Score for Overlay

_http://www.winitor.co...eStudio838.zip

Version 8.46
. Added new thresholds
. Extended detection
. Fixed a crash with malformed files
. Corrected duplicates during collection of functions statistics

_http://www.winitor.co...eStudio846.zip

Version 8.48
. Extended Thresholds
. Extended Indicators
. Show virustotal score for Overlay (when available)
. Fixed an issue in the Debug detection
. Fixed an issue in imported symbols by ordinal for 64bit files
Version 8.47
. Added computation of Imports Hash (imphash)
. Added detection of strings embedded in non-PE files
. Extended detection of processor types
. Fixed a hangup
. Updated AV list

_http://www.winitor.co...eStudio848.zip

Version 8.49
. Added detection of Windows builtin services
. Fixed a bug when handling strings
. Leveraged Indicators for embedded files

_https://www.winitor.co...estudio849.zip

Version 8.50
. Fixed a bug when handling exported functions of 54bit executables

_https://www.winitor.co...estudio850.zip

Version 8.51
. renamed pestudioprompt.exe into pestudiox.exe
. Added virustotal scoring of hardcoded URL
. Added detection of pipes
. Added Network Watchdog to update Virustotal score automatically
. Added XML switches to define the colors of the front-end
. Fixed ordinal functions mapping for 64bit images
. Fixed a crash when handling overlay
. Fixed a bug when retrieving the Description of the delay-loaded libraries

_https://www.winitor.co...estudio851.zip

Version 8.52
. Differentiate between standard and professional (pro) versions of pestudio
. Added deletion of overlay
. Added computation of entropy
. Added detection of TLS Callback functions
. Show more details about sections
. Fixed bugs and crash

_https://www.winitor.co...estudio852.zip

Version 8.59
. Show first bytes (hex) of resources
. Show first bytes (hex and text) of file
. Handle empty entry-point
. Extend Indicators

Version 8.58
. Fix a crash with some 64bit executables
. Add detection of missing libraries
. Extend status-bar

Version 8.57
. Extend translations
. Extend Exports handling
. Extend Imports handling
. Extend signatures
. Clean and Extend indicators
. Show first bytes of entrypoint
. Show first bytes of overlay
. Show dos-stub message

Version 8.56
. Compute file-ratio for resources, sections, overlay and dos-stub
. Extend file summary
. Extend file signature detection
. Fix bugs

https://www.upload.ee/...oRooM.rar.html
Mirror / Зеркало
https://wdho.ru/a986f63
Mirror / Зеркало
https://mega.nz/file/V...D39NBhhGoomdcU

password softoroom