Loading...
PE-bear hasherezade
Use this command to install PE-bear:
winget install --id=hasherezade.PE-bear -e PE-bear is a multiplatform reversing tool for PE files. Its objective is to deliver fast and flexible “first view” for malware analysts, stable and capable to handle malformed PE files.
PE-bear is a multiplatform reversing tool designed for analyzing Portable Executable (PE) files. It provides malware analysts with a fast, flexible, and stable solution to examine PE files, including those that are malformed or corrupted.
Key Features:
- Multiplatform Support: Runs on Windows, Linux, and macOS, ensuring broad accessibility.
- User-Friendly GUI: Offers an intuitive interface for efficient navigation and analysis of PE file structures.
- Signature Database Integration: Incorporates signatures from PEid's UserDB, enhancing identification capabilities.
- Handling Malformed Files: Robust enough to analyze corrupted or incomplete PE files.
- Bearparser Engine: Leverages advanced parsing techniques to deliver detailed insights into PE file internals.
- Regular Updates: Keeps up-to-date with the latest developments in malware analysis and PE file formats.
Audience & Benefit: Ideal for malware analysts, security researchers, and incident responders who require a reliable tool to quickly assess PE files. PE-bear streamlines initial analysis by providing essential information about file structure, headers, sections, imports, and exports, enabling faster identification of malicious behavior or anomalies.
PE-bear can be installed via winget, ensuring easy setup across supported platforms.
README
PE-bear
PE-bear is a multiplatform reversing tool for PE files. Its objective is to deliver fast and flexible “first view” for malware analysts, stable and capable to handle malformed PE files.
Signatures for PE-bear:
- SIG.txt (updated: Oct 17, 2022) - contains signatures from PEid's UserDB - converted by a script provided by crashish
Builds
📦 ⚙️ Download the latest release.
Windows Packaging
Available also via:
Chocolatey
Scoop
- WinGet (
winget install pe-bear)
Test Builds
🧪 Fresh test builds (ahead of the official release) can be downloaded from the AppVeyor build server. They are created on each commit to the branch. You can download them by clicking on the build version, then choosing the tab . WARNING: those builds may be unstable.