PeStudio

[fluid]

PeStudio 7.92

Added Detection of discrepency between Image Name and Manifest and (Hint of reuse of other Manifest)
Added Detection of misspelling of the"VarFileInfo" internal tag of the Version Information (Hint to Evasion)

Spoiler: pokaż

Zaloguj lub Zarejestruj się aby zobaczyć!

 

[fluid]

PeStudio 7.93

Added Dumping of Overlay

Spoiler: pokaż

Zaloguj lub Zarejestruj się aby zobaczyć!

 

[fluid]

PeStudio 7.94

Map Version Translation Information to user friendly string
Show Version Translation Information Blacklisted Languages
Extented PeStudioOrdinals.xml to Resolve SNMP functions imported by Ordinals back to their original names

Spoiler: pokaż

Zaloguj lub Zarejestruj się aby zobaczyć!

 

[fluid]

PeStudio 7.95

Added detection (and Indicator) of anonymous Exported Functions
Added detection (and Indicator) of multiple Executable Sections
Added detection (and Indicator) of multiple instance Imported Functions Names
Added PeStudioEvasions.xml to support the detection of attempts Evasions (Antidebugging)
Added (part of) exported MFC42 ordinals to PeStudioOrdinals.xml

Spoiler: pokaż

Zaloguj lub Zarejestruj się aby zobaczyć!

 

[fluid]

PeStudio 7.96

New classification of Strings
Extended detection (and Indicator) of File Version Information suspicious fields
Extended PeStudioOrdinals.xml
Corrected Ordinals mapping for 64 bit images
Better visualization of Relocations entries
Added Detection of Blacklisted Function of Delayed-loaded Libraries
Added Support for Strings Tables
Added Detection of Self-Registering DLLs

PeStudio 7.97

Extended PeStudioThresholds.xml to detect the Min/Max size of Manifest

PeStudio 7.98

Extended PeStudioBlackListFunctions.xml
Extended PeStudioBlackListLibraries.xml
Correct an issue when showing the Resources friendly names at the GUI

Spoiler: pokaż

Zaloguj lub Zarejestruj się aby zobaczyć!

 

[fluid]

PeStudio 8.01

Extented PeStudioOrdinals.xml for LDAP by ordinals
Added a Threshold for size of Custom Resources
Extended PeStudioThresholds.xml

Spoiler: pokaż

Zaloguj lub Zarejestruj się aby zobaczyć!

 

[fluid]

PeStudio 8.02

Added PeStudioFeatures.xml
Added "Features" as part of the "Indicators". Features translates the APIs, and other data into "Features" of the executable
being analysed (e.g. The API "FindFirstUrlCacheEntry()" is translated as "The image accesses the IE Protected Storage" Feature)

Spoiler: pokaż

Zaloguj lub Zarejestruj się aby zobaczyć!

 

[fluid]

PeStudio 8.03

Added "Anomalies" Indicators.
Added detection of fake Microsoft executables
Extended "Features"

PeStudio 8.04

Added Feature detection of Regular Expressions (Regex)
Added Feature detection of Service Control Manager (SCM)

Spoiler: pokaż

Zaloguj lub Zarejestruj się aby zobaczyć!

 

[fluid]

PeStudio 8.05

Extended Features detection
Extended Blacklisting
Extended detection of embedded IP Adresses

Spoiler: pokaż

Zaloguj lub Zarejestruj się aby zobaczyć!

 

[fluid]

PeStudio 8.06

Extended Features detection
Extended Blacklisting
Show default Icon of the Image being analysed (which often helps as first suspicious indicator)

Spoiler: pokaż

Zaloguj lub Zarejestruj się aby zobaczyć!

 

[fluid]

PeStudio 8.07

Allow RAW-dumping using the context menu of any resource
Extended Features detection
Added Detection of Resources reuse

Spoiler: pokaż

Zaloguj lub Zarejestruj się aby zobaczyć!

 

[fluid]

PeStudio 8.10

Blacklist DNS and IP APIs

Spoiler: pokaż

Zaloguj lub Zarejestruj się aby zobaczyć!

 

[fluid]

PeStudio 8.11

Fixed a bug when Dumping a resource
Images in Windows directories are considered as trusted
Extended Features detection
Extended Blacklisting

Spoiler: pokaż

Zaloguj lub Zarejestruj się aby zobaczyć!

 

[fluid]

PeStudio 8.12

Show Overlay Signature
Blacklist Well-Known SID

Spoiler: pokaż

Zaloguj lub Zarejestruj się aby zobaczyć!

 

[fluid]

PeStudio 8.13

Extended detection of Overlay
Added PeStudioWhiteListLibraries.xml

Spoiler: pokaż

Zaloguj lub Zarejestruj się aby zobaczyć!