Alternatives to pestudio
A Windows tool for quick static assessment of executable files that highlights suspicious indicators. The listings below can replace it for an important use case. Each note says what changes if you switch.
The original
pestudio
A Windows tool for quick static assessment of executable files that highlights suspicious indicators.
Replacements
Listings that take over the same core job as pestudio.
PE-bear
A multiplatform viewer and editor for reversing Windows Portable Executable (PE) files.
PE-bear is a free open-source PE viewer and editor for Windows, Linux and macOS with Capstone disassembly, without pestudio's suspicious-indicator flagging.
Detect It Easy
A program that identifies file types, packers, compilers and protectors used in executables.
Detect It Easy is free and open source on Windows, Linux and macOS, identifying packers, compilers and protectors through signature databases and YARA rules.
capa
Identify likely capabilities inside executable files.
capa is an Apache-2.0 command-line tool that applies rules to identify likely capabilities in executables across platforms, with results that need interpretation.
Similar software
Related functionality, not a direct replacement.
YARA
Pattern-matching engine for identifying and classifying malware samples.
Ghidra
The NSA's reverse engineering framework, with a decompiler that turns machine code back into readable C.
x64dbg
An open-source Windows debugger for reverse engineering, with an IDA-like interface, a built-in assembler and a decompiler.
VirusTotal
Online service that checks a URL or file against many antivirus engines and URL scanners.
Hybrid Analysis
Free online sandbox that runs submitted files and URLs and reports on their behaviour.
FLARE-VM
Installation scripts that turn a Windows virtual machine into a malware analysis and reverse-engineering workstation.
