{
  "added_at": "2026-11-06",
  "additional_evidence_urls": [
    "https://www.winitor.com/download",
    "https://www.winitor.com/download2",
    "https://www.winitor.com/pro",
    "https://www.winitor.com/tools/pestudio/current/pestudio-features.pdf",
    "https://www.winitor.com/tools/pestudio/current/pestudio-licensing.pdf",
    "https://www.winitor.com/tools/pestudio/changes.log"
  ],
  "category": "native-analysis",
  "description_en": "Winitor's Windows tool for initial malware assessment, which statically inspects Windows executable files and reports key indicators such as hard-coded URLs and IP addresses, flagged imports, resources and overlay data. The free basic edition also detects file signatures, debug information and TLS callbacks, computes entropy and imphash, shows the rich header and .NET metadata and looks up VirusTotal scores by hash; pestudio-pro adds MITRE ATT&CK mapping, XML reports and the pestudiox.exe command-line version.",
  "description_zh": "Winitor 推出的 Windows 恶意软件初步评估工具，以静态方式检查 Windows 可执行文件，报告硬编码的 URL 和 IP 地址、被标记的导入函数、资源及附加数据（overlay）等关键指标。免费的基础版还能识别文件签名、调试信息和 TLS 回调，计算熵值与 imphash，显示 rich header 和 .NET 元数据，并凭哈希查询 VirusTotal 评分；pestudio-pro 另提供 MITRE ATT&CK 映射、XML 报告和命令行版本 pestudiox.exe。",
  "entry_url": "https://awesomerea.org/resources/pestudio/",
  "entry_url_zh": "https://awesomerea.org/zh/resources/pestudio/",
  "evidence_url": "https://www.winitor.com/",
  "group": "tools",
  "id": "pestudio",
  "json_url": "https://awesomerea.org/resources/pestudio/record.json",
  "kind": "tool",
  "markdown_url": "https://awesomerea.org/resources/pestudio/index.md",
  "markdown_url_zh": "https://awesomerea.org/zh/resources/pestudio/index.md",
  "name": "pestudio",
  "name_zh": "pestudio 恶意软件初步评估工具",
  "record_type": "resource",
  "relationship": "foundation",
  "requirement_facets": [
    "prerequisites",
    "license",
    "limits"
  ],
  "requirements": [
    "Version 9.61, whose feature and licensing sheets are dated March 2025, ships as a ZIP that needs no installation; the download page says it is fully portable, does not alter the system it runs on and runs on any Windows system.",
    "The free basic edition may be used only in a private context for occasional malware static analysis, not in a professional or corporate environment. pestudio-pro is sold as a one-year license per user that includes free updates, is not renewed automatically and is delivered as a password-protected ZIP.",
    "VirusTotal lookups send only the file's MD5 hash, never the sample, and an XML switch disables them; searching VirusTotal by imphash needs a VirusTotal Intelligence account. The software is provided as-is without warranty, and its bundled XML files may not be used outside pestudio without the author's permission."
  ],
  "requirements_zh": [
    "9.61 版的功能表和许可说明均注明 2025 年 3 月，以 ZIP 包形式提供，无需安装；下载页称它完全便携、不会改动所运行的系统，可在任何 Windows 系统上运行。",
    "免费的基础版只能在私人场合用于偶尔的恶意软件静态分析，不得用于专业或企业环境。pestudio-pro 按用户出售一年期许可，许可期内免费更新，到期不会自动续订，以带密码的 ZIP 包交付。",
    "查询 VirusTotal 时只提交文件的 MD5 哈希，绝不上传样本本身，并可通过 XML 开关完全关闭；按 imphash 搜索 VirusTotal 需要 VirusTotal Intelligence 账户。软件按“原样”提供、不作任何担保，随附的 XML 文件未经作者许可不得在 pestudio 之外使用。"
  ],
  "targets": [
    "binary"
  ],
  "url": "https://www.winitor.com/",
  "verification": "source-reviewed",
  "verified_at": "2026-11-05"
}