PPEE (puppy)

PPEE is robust against malformed and crafted PE files which makes it handy for reversers, malware researchers and those who want to inspect PE files in more details. All directories in a PE file including Export, Import, Resource, Exception, Certificate(Relies on Windows API), Base Relocation, Debug, TLS, Load Config, Bound Import, IAT, Delay Import and CLR (.Net) are supported.

• Very fast malware static analysis tool
• Both PE32 and PE64 support
• Clustering/similarity engine — similar binaries detected via locally stored hashes and grouped by color
• Multi-file support with flexible tabs
• Parse and edit .Net (CLR) assemblies
• ARM64 exception directory support
• Extended debug directory parsing/editing (FPO, POGO, PDB checksum, embedded portable PDB, and more)
• TLS callback list
• Filter/search boxes for listviews
• Application manifest support in treeview
• Examine Yara rules against opened file
• Virustotal and OPSWAT's Metadefender query report
• Statically analyze windows native and .Net executables
• Robust Parsing of exe, dll, sys, scr, drv, cpl, ocx and more
• Parse Rich Header
• Parse Safe SEH, Control Flow Guard Functions, Enclave Configuration and Volatile information in load config directory
• Edit almost every data structure
• Easily dump sections, resources and .Net assembly directories
• Entropy and MD5 calculation of the sections and resource items
• Entropy, SSDEEP, TLSH, CRC32, ImpHash, MD5, SHA1, SHA256 and Authentihash calculation of the files
• View strings including URL, Registry, Suspicious, ... embedded in files
• Resolve ordinal to name in imported APIs
• Demangle (undecorate) mangled import/export APIs
• Detect common resource types
• Extract artifacts remained in PE file
• Anomaly detection
• Right-click for Copy, Search in web, Whois and dump
• Easily access recent opened files
• Built in hex editor
• Explorer context menu integration
• Descriptive information for data structures
• Refresh, Save and Save as menu commands
• Open file by drag and drop
• Sortable list-view columns
• Open file from command line
• Checksum validation
• Plugin enabled

Similar binaries grouped by color

Debug Directory - Reproducible build hash

.Net Assembly User String Heap

Descriptive information

PE32 Optional Header

Grayed out Entries

High Entropy Malformed Section

Export Directory

PE32+ Import Directory

Easily dump resource items

High Entropy Locale Resource

Invalid digital signature

Artifacts remained in Debug directory

Thread Local Storage Data

SEH-CFG Handlers

Bound Imports Directory

Delay Loaded Imports

Crafted .Net Assembly Metadata Header

.Net VTable Fixups

Malicious strings used in binary

Virustotal and OPSWAT query

Unmanaged functions used in assembly

Application manifest

Test YARA rules against file

Registry strings in file

Filter strings specified as suspicious

Strings recognized as URL