What is PE-bear?

PE-bear is a free, open source portable executable (PE) malware analysis tool for Windows. It performs static analysis on PE files to extract metadata and identify suspicious characteristics that may indicate the file is malicious.

Features of PE-bear include:

• Extracting PE header information like imports, exports, resources, etc.
• Identifying packing/compression
• Listing strings and functions
• Checking hashes against VirusTotal
• Generating similarity scores against known malware
• Highly customizable configuration for checks against suspicious PE properties

As a portable open source tool, PE-bear is useful for malware analysts and researchers to quickly triage Windows executable files. It generates analysis reports in multiple formats like JSON, XML, HTML, etc. for integration with other tools. As it performs static analysis, PE-bear is safe to run on unknown files and provides a first step towards identifying potentially malicious samples for further analysis.

Official Links