PEStudio is a free Windows tool that performs static triage of a PE (Portable Executable) file — EXE, DLL, SYS — without executing it. In a few seconds it surfaces dozens of indicators an analyst would otherwise have to query manually: suspicious imports, blacklisted strings, anomalous section names, signed/unsigned status, resources, manifest, version info, and VirusTotal hits.

It is the first stop for many malware analysts before deciding whether to detonate a sample in a sandbox or load it into Ghidra/IDA.

• Fast first-look at a suspicious attachment
• Confirming whether a binary is signed and by whom
• Spotting packers, anti-VM strings, suspicious APIs