Some of those features include a file identification, address conversion, dependency scanning, and the ability to add imported functions to a PE.ĬFF Explorer identifying any necessary files required for the Ransomware Dll to run. CFF Explorer has a lot of the same functionality that you’ll find in the other tools we’ve mentioned here, however, there are some noticeable advantages to the tool.įor starters, the interface is likely easier to navigate than tools like FileAlyzer, and CFF Explorer also brings some new features we haven’t seen in the tools we’ve already mentioned. Regardless of how you might feel about the interface, FileAlyzer is a great tool that offers a lot of information to analysts, which is why it makes number four on our list of PE analysis tools worth looking at.ĬFF Explorer is a PE Editor by Daniel Pistelli and is also part of the NTCore Explorer Suite. Perhaps the developers should have went with more of a tree-like interface, allowing the user to “drill-down” and find the information they’re looking for, something we will see in our number three pick. Although there might be some out there that like it more than myself, re-sizing the program’s window causes the tabs to move, which can be frustrating when you’re trying to find the right one. One downside I find about this tool is the interface. Some of the features you’ll find in FileAlyzer include: file and property hashes, header information, a disassembler, and more. However, there are some tools to help you quickly identify the file as possibly malicious, such as the VirusTotal and Classification Sources tabs, the latter using various web sources to help you in your search. Like PEview, FileAlyzer assumes you know what you’re doing. Notice the tabs at the top, each bringing different features with it.

According to their website, the name FileAlyzer was “initially just a typo of FileAnalyzer”, but they decided to stick with it.įileAlyzer brings more to offer than PEview as far as features, being able to provide basic PE information as well as offer some new functionality, such as automated unpacking for files packed with UPX and PECompact.įileAlyzer observing the PE header of a Ransomware Dll.

The Next PE analysis tool on our list is FileAlyzer by Safer Networking Ltd., the same group that brought us Spybot – Search and Destroy. Nonetheless, despite these inconveniences, PEview remains one of the best tools for simple PE analysis, and that makes it number five on our list of PE analysis tools worth looking at. In addition, those who haven’t studied the PE file format may find the tool a bit difficult to use, as PEview doesn’t provide any tips or hints to find the information you may be looking for. On the other hand, for those looking for a feature-rich PE analysis tool, PEview may disappoint, as it only provides basic information about the PE. PEview observing the export names in a Ransomware Dll

Alternatives to pe explorer