Exetools - Exeinfo PE

Exetools (https://forum.exetools.com/index.php)

- Community Tools (https://forum.exetools.com/forumdisplay.php?f=47)

- - Exeinfo PE (https://forum.exetools.com/showthread.php?t=20044)

0.0.8.8 (25.01.2025)

1209 + 181 signatures x64
Ext_detector - v7.4.7 ( 747 non exe signatures )
external signatures : userdb.txt : 4462

Whats new:

added .NET GUI auto click on .NET 4 / 6 detector
added .PYD x86 v2.x 3.x / x64 v3.x version detector
fixed cpu version detector added
added [ generic - CPU : 0x01C4 ARMv7 ] for : GO Programming Language Compiler
added x86 only : [ plugin : Photoshop plugin ]
fix 5005. x64 Microsoft Visual C++ v14.20 - 2008 [ RT_CODE ] - DLL
added to .pdb - NOT EXE - .IDB Microsoft Developer intermediate
added .zlib ripper fixed - Zlib - false Alarm - skipped ( now ripp more files ) - fixed for Android backup : fullbackup.ab
added .zlib added ripper for zlib v2 - if Fast scan off option in Config (example : installer LLC SysDev Laboratories )
added detector NOT EXE - .zlib v2 files
added dll detector - XerinVM.Runtime v1.0 2024
small fixed XerinFuscator v1.0 - 3.0 , XFUSCATOR 1.0.0.4
added x64 [ NSTD section packed data/vmp ] - stub : x64 Microsoft Visual C++ v14.28
fixed added h265 - NOT EXE - .mp4/m4v ( MPEG-4 )
Buffor for exe set to : 380 MB
overlay - scan deeper for 7zip , zip , ect...
fixed x64 VMProtect
fixed MS C++ detector for VMProtect SDK used x86/x64
Header GUI - added DBG string text label
added runtime detector for x86/x64 - [ dotNet Protector Runtime PvLog ]
added [ VMProtect SDK used ] Borland Delphi 2009-2010 - borland.com
added .NET GUI BSJB button
and more

Home:

Code:

https://github.com/ExeinfoASL/ASL

Download:

Code:

https://github.com/ExeinfoASL/ASL/releases/download/v0.0.8.8/exeinfope.zip

0.0.9.0 (2025.03.29) - NOT Tested version

1214 + 181 signatures x64
Ext_detector - v7.5.4 ( 754 non exe signatures )

Whats new:

for Windows XP - added x86 7z v22.09 ( ZS/LIZ mode not supported only on Windows 10 )
*fixed resources for XP
Inno unpacker update v.1.77
added "x" on main GUI for unpacking .zip files
Console modefor zip files :
- Zip unpacking ( .zip archives ) exeinfope.exe FileName /un7zip - unpack .zip archive )
- for many files ( mask files ) : exeinfope.exe FileName* /un7zip - unpack .zip files
updated : GEMPlayer v1.0 protected data - ThunderSoft DRM Protection / Gilisoft Free DRM Protection
fixed updated 1136.DotFix NiceProtect v6.9 - 7x demo x86
.NET added to signatures ( Meta nstd struct ) . 080 , 1129 " - [ First Meta Data stream as Confuser/Xfuscator ] "
and more

Home:

Code:

https://github.com/ExeinfoASL/ASL

Download:

Code:

https://github.com/ExeinfoASL/ASL/releases/download/v0.0.9.0/Exeinfo_0090.zip

testing version 0.0.9.1

you have forgotten the download link

v0.0.9.1

https://ydray.com/get/t/u17451881325082WBgh217cd148cb3aes
https://filebin.net/fvch7fgp050f4vd6
https://limewire.com/?referrer=lj66prqm1u
https://limewire.com/?referrer=pq7i8xx7p2
https://sprend.com/download?C=81c616051c1b4f45ae1d99c3c559236a

Best Regards

$15 for lifetime updates? come on... just pay the author. tool is worth it.

Exeinfo Pe hints v.0.0.9.2

updated usage infos and create Arabic Windows compatible version

Exeinfo_0092_alpha

You forgot to upload the link again.

https://file.kiwi/e938e971#IMElDCjApdo2F21Byo6cSg
https://fromsmash.com/LbzN.QpG1g-et
https://fex.net/s/cenetsn
https://filebin.net/guzvx9ehjr2fv22s
https://easyupload.io/mq5f4t
https://www.filemail.com/d/xuhhknktondrxts
https://limewire.com/d/hBgUk#0x4BTFzWck

Best Regards

bad links : ;)

https://app.box.com/s/63uxokbtnhqyprz0960k39er5k9xa56j

You're right, my dear. Here's an updated link.

Exeinfo Pe v. 0.0.9.3 Beta2

https://limewire.com/d/yTNZN#YA2zAADXpT
https://fromsmash.com/Exeinfo-0093-Beta2zip
https://limewire.com/d/CgZNt#HRI0H6Tw0N
https://wormhole.app/08Wqj1#fouJejN8cb3VOtLPuc3igg
https://fex.net/s/2cseaoo
https://toffeeshare.com/c/lFsHfpcCTm

0.0.9.3 (2025.11.04)

1226 + 190 signatures x64 )
Ext_detector - v7.7.4 ( 774 non exe signatures )

Whats new:

Inno Unpacker updated to v2.64
Detect Embarcadero Delphi / C++ VCL exe files and RAD v12 DevExpress as STD files
added on x64 .gz section detector - x64 Microsoft Visual C++ v14.29 - 2019 - (exe 4883EC28-48) [ .GZ archive sec.6 ] ,
Go compiler detector engine - detect tampared GO string
mp4 Ripper fixed via "mp4" string
NOT EXE - .gz archive - added "x" key press , unpack file on Main GUI
fixed crash bug
NOT Win EXE - .dylib - Mac OS X Universal Binary executable
to :
NOT EXE - .class - Java Bytecode object oriented programming language http://java.sun.com
fixed
5175. x64 - MinGW-w64 GCC: (GNU) compiler (exe) v11 [ ~ 14.x ] - http://mingw-w64.sourceforge.net ,
to :
5175. x64 - MinGW-w64 GCC: (GNU) compiler (exe) v11 [ (MinGW-W64 x86_64-ucrt-posix-seh ...]
NOT EXE - .aac detector fixed
changed .pdb function - support unicode string ,
fixed detection : 5004. x64 DLL with : 00 Entry Point - RESOURCES Only : xx,x KB no CODE - CPU : AMD64
MS VC++ linker 14.44 updated to 2025
for Windows XP - added x86 7z v22.09 ( ZS/LIZ mode not supported only on Windows 10 )
*fixed resources for XP
added "x" on main GUI for unpacking .zip files
Console mode for zip files :
Zip unpacking ( .zip archives )
exeinfope.exe FileName /un7zip - unpack .zip archive )
for many files ( mask files ) :
exeinfope.exe FileName* /un7zip - unpack .zip files
updated : GEMPlayer v1.0 protected data - ThunderSoft DRM Protection / Gilisoft Free DRM Protection
fixed updated 1136.DotFix NiceProtect v6.9 - 7x demo x86
.NET added to signatures ( Meta nstd struct ) . 080 , 1129
" - [ First Meta Data stream as Confuser/Xfuscator ] "
update v34 x17 - not detected
908.InstallAware for Windows Installer v34.0.6 X17 2025
detect v2025.01
x86./ x64 - Ahk2Exe for AutoHotkey [ v1.1.37.02 Ans/Uni 2025 ] - Script to EXE Converter - www.autohotkey.com
NOT EXE - .bmp detector - fixed !
changed :
x64 - Embarcadero Technologies Inc. clang version 5.0.2 (f0862325.f3a671d2.38570) (based on LLVM 5.0.2) ( EXE )
to :
x64 - C++ Builder 10.x [ Embarcadero RAD Studio 29.1 - Copyright 2025 Embarcadero Technologies, Inc. ]
Fixed .gz Ripper - now detect gzip with [Unknown System} on -> NOT EXE - .pak Chromium format v5 - Chrome
added on Linux ELF
NOT Win EXE - .o - ELF [ 64bit obj. - CPU : AMD x86-64 - OS/ABI: unspecified ]
-> Compiler : Embarcadero Technologies Inc. clang version 5.0.2 (f0862325.f3a671d2.38570) (based on LLVM 5.0.2)
update
655.[ 7-zip SFX stub ] [ v25.01 GUI - GENUINE ] - stub : Microsoft Visual C++ v.6-9 - Name : 7z SFX.
x64 - 7z Sfx GUI 25.01 ZS v1.5.7 - 2025 Tino Reichardt- CPU : AMD x64 , if overlay added 7z
added x64 DLL Generic codec unpacker ( lz4/zl5/7z/7za/brotli/lizard/zstd/flzma2 )
x64 Microsoft Visual C++ v14.29 - 2019
[ GEN plugin unpacker LZ/Lizard/Lzma ] - Not packed
[ 7z* plugin by Igor Pavlov ]
( 7z unpacker update x64 only - no About GUI info , still 22.01 x86 ! )
x64 7za ZS v22.01 unpacker updated to v25.01
fixed get dimensions - movies from www.savevid.com
NOT EXE - .mp4/m4v ( MPEG-4 ) codec : avc1 - H.264 - [ 532x924 cmfciso6dsmsmsixdash ]
fixed ver detection
x64 - MinGW-w64 GCC: (GNU) compiler v.4 exe ( xx C7 ) - [ v4.?.? ] - http://mingw-w64.sourceforge.net ,
to :
x64 - MinGW-w64 GCC: (GNU) compiler v.4 exe ( xx C7 ) - (x86_64-posix-sjlj-rev0, Built by MinGW-W64 project) 4.8.4 - http://mingw-w64.sourceforge.net ,
fixed overlay detector offset for : ( save overlay and click on Overlay view ) only for this 657 sign.
657.Nullsoft SFX v2.46.2-5 Setup Unicode Installer
sign 630.Generic : Installer Nullsoft PiMP Stub [ v.3.02.1 ]
fixed 1123.[ Rust Compiler v1.89.0 - www.rust-lang.org ] - stub : MS Visual C++ v.14.44 - 2025 (E8)
sign
6000. x64 ( GENERIC ) MinGW-w64 GCC: (GNU) Cygwin Fedora compiler no TLS - http://gcc.gnu.org
fixed version info
6000. x64 ( GENERIC ) MinGW-w64 GCC: (GNU) Cygwin Fedora compiler no TLS - http://gcc.gnu.org - [ GNU compiler v.15.1.0 ] ,
fixed detector ( x64 unknown file ):
5144. x64 Microsoft VC++ 14.00 DLL [ CPU : AA64 ARMv8 ] - [Deb: 02] [ PE Header can be Rust/LLVM/GCC Mingw compiler ]
fixed NSTD + mingw detect
1204.Microsoft VC++ 14.00 [ dll - CPU : ARMv7 ] - [ Deb : 02 C++ CodeView ] - [ PE Header be Rust/LLVM/GCC Mingw compiler - 100% mingw ]
fixed ver. if C++ v4
595.GCC MINGW-64w compiler for 32/64 bit ( exe ) - http://mingw-w64.sourceforge.net
to
595.GCC MINGW-64w compiler for 32/64 bit ( exe ) - http://mingw-w64.sourceforge.net - [ GNU C++ 4.7.2 ]

and more

Home:

Code:

https://github.com/ExeinfoASL/ASL

Download:

Code:

https://github.com/ExeinfoASL/ASL/releases/download/v0.0.9.3/exeinfope.zip

ExeinfoPE v0.0.9.4 Beta [ViP]

Program name : Exeinfo Pe
Version : 0.0.9.4 Beta ( 1227 + 190 signatures x64 )
: Ext_detector - v7.7.4 ( 774 non exe signatures )
: external signatures : userdb.txt : 4467

Quote:

- Inno Unpacker updated to : v.2.65.2 ! <- press 'x' key on main form for all exe unpacking
- Fixed dissasemble and Hex view for x64 files
- Header GUI - added click on dir/import/export/resources/iat/... Hex view in DASM GUI blue
- added detect Sfx module IZArc version 4.6 - https://www.izarc.org - only : 7z , zip , rar
- fixed added NSTD struct EP and sections x64 :
5187. x64 - C++ Builder 10 - VCL Modern Compiled - RAD 29.0 *NSTD [ Embarcadero RAD Studio 23.0 ]
- Added x64 - 1211. x64 - [ PyInstaller v.3.6 - v6.1 - 2005ΓÇô2024
- detect .NET Goldobfuscator x32 only for test

and more

A.S.L ( c ) 2025.11.06

Quote:

Originally Posted by Dr.FarFar (Post 134097)

Program name : Exeinfo Pe
Version : 0.0.9.4 Beta ( 1227 + 190 signatures x64 )
: Ext_detector - v7.7.4 ( 774 non exe signatures )
: external signatures : userdb.txt : 4467

A.S.L ( c ) 2025.11.06

Hi , can you upload please on mega or anything ?

ExeinfoPE_v0.0.9.4 [ViP]

Program name : Exeinfo Pe
Version : 0.0.9.4 ( 1233 + 193 signatures x64 )
Ext_detector - v7.7.5 ( 775 non exe signatures )
external signatures : userdb.txt : 4467

Code:

- added because Exeinfo detect VMProtec struct !

  1231.EXECryptor v.2.1.17 ( TLS prot. obsolete software ) - strongbit.com



- Compilators GUI - fixed on GCC 32/64  ver.detector string



- Section GUI adde Xerinfuscator detector



- Inno unpacker updated to v.2.66.1



- fixed detector !!!  if digi signed

  Inno Setup Module 5 SFX - [ v.6.3.0 ] - [ Protected with Inno Protect v1.0 by A.S.L ] 



- added : Dell sfx / HP sfx



and more sign updated

A.S.L ( c ) 2025.12.12

ExeinfoPE v0.0.9.5 Beta [ViP] - 6-Jan-2026

Program name : Exeinfo Pe Beta
Version: 0.0.9.5 Beta Nag ( 1238 + 198 signatures x64 )
Ext_detector - v7.7.9 ( 779 non exe signatures )
external signatures : userdb.txt : 4467

Quote:

- many changes and old signatures updated
- warnings added
- sections detector updated
- internal Inno unpacker v2.66.1

Last signatures :

x86

1218.Paquet Builder v.25.0 www.installpackbuilder.com
1219.UltraZip Sfx module v1.5 - stub : MS Visual C++ v.9.0 - 2008 (E8) Visual Studio 2008
1220.Obfuscar v2.2.x by 2007-2018, Ryan Williams - www.obfuscar.com - stub : MS Visual C# / Basic.NET
1221.(x64) EFSoftware Setup 2024 ( EF 8F ) ovl data not lzma - www..efsoftware.com - stub : MS Visual C++ v.9.0
1222.Babel v9.9.5 / 10.5 / 11.0.0 ( 2021-24 ) .NET Obfuscator - www.babelfor.net - stub : MS Visual C# / Basic.NET
1223.InstallAware for Windows Installer [ v34.6 X17 ] www.installaware.com - stub : MS Visual C++ v.14.16
1224.Developer Express Inc. SFX module - www.devExpress.com - stub : Delphi v11.0 Alexandria
1225.Celesty Binder ( malware installer ) Coded by DarkCoderSc - Unremote.org / malwaregallery.com : stub C++ 10 (UPX not detected)
1226.Veridium Vigilia Installer - http://veridium.net ( ovl .zlib ) - stub : MS Visual C++ ( v2023/x86/x64 )
1227.Installer Nullsoft [ MSVC++ Recompiled - v.29-Apr-2020.cvs ] - http://nsis.sourceforge.net
1228..NET Goldfuscator [ v1.4 ] 2019.09.18 - http://github.com/AnErrupTion/Goldfuscator
1229.XerinFuscator G3 v.3.0.0.85 by Inx Company [ DNG mode : no pack? ] - discord.gg/sU6Cv4MGev - stub : std .NET / NSTD .NET struct
1230.XerinFuscator G3 v.3.0.0.85 by Inx Company [ mode : minimal Anticrk/Obf only ] - discord.gg/sU6Cv4MGev - stub : MS Visual C#
1231.EXECryptor v.2.1.17 ( TLS prot. obsolete software ) - strongbit.com/SoftComplete Devel.
1232.[ Malware installer - set Autorun->SynaptiCS.exe ] - not a real Synaptics installer - stub : Borland Delphi
1233.HP Inc. Soft paq wrapper v.0.2.x Installer ( 7z/Cab ) - www.hp.com ( x86 / x64 stub )
1234..NET Reactor [ v.7.5.0.0 ] Native Method exe - .NET / MS C++ stub 9.0
1235.Self-extracting Installer v1.0.x - www.KurtZimmermann.com ( .zip )
1236.LLVM compiler v14-21 , GCC (GNU) [ v.4.8.3 ] ( 83EC ) - linker 14.00 exe - Debug 02
1237.Embarcadero Delphi compiler : XE - Delphi v12 Yukon / RAD Athens ( NSTD - exe via Bool.) - www.embarcadero.com
1238.Self-Extract Package v25.x ( icarus_sfx - ON/OFF-line installer ) - stub : MSVC+ v14.42 - 2024 ( NSTD stub )

x64

5176. x64 Awast Ransomware Decryptor v1.0.x 2022-2024 - www.awast.com
5177. x64 PureBasic v6.1x - ( 2024 ) Fantaisie Software - www.purebasic.com - stub : x64 Microsoft Visual C++ v14.00
5178.[ x64 Rust Compiler GNU v1.xx - www.rust-lang.org ] - stub : x64 - MinGW-w64 GCC: (GNU) compiler (exe)
5179.[ Nuitka python compiler - http://nuitka.net ] x64 - MinGW-w64 and MS C++14 compiller
5180. x64 Py2exe ( .py script to exe ) - stub : x64 Microsoft Visual C++ v14.29
5181. x64 VMProtect v.3.x - 3.5.1 [ not/packed mode ] - www.vmpsoft.com , stub : x64 .NET exe with : 00 Entry Point
5182. x64 Obsidium v1.8.6.x [ option xx MZ Head ] - 2025.04 - www.obsidium.de
5183. x64 - MS C++ Compiler ( icu/vcp/crt14_app ) DLL with Zero EP
5184. x64 [ Created with : WINDEV Express/Framework v22.0 - 30.x - www.windev.com ] - stub : MS C++
5185. x64 Babel v9.9.5 / 10.0 / 11.0.0 ( 2020-24 ) .NET Obfuscator - www.babelfor.net
5186. x64 Delphi v10.4 Sydney [ Embarcadero Delphi for Win64 compiler version 34.0 (27.0.x) ] - embarcadero.com
5187. x64 - C++ Builder 10 - VCL Modern Compiled - RAD 29.0 [ Embarcadero RAD Studio 23.0 ]
5188. x64 [ SFX64 v55.1 ( 2025-07-29 ) zpaqfranz v62.5 ] - stub : x64 ( Generic ) MinGW-w64 GCC
5189. [ x64 Rust Compiler www.rust-lang.org / www.llvm.org LLVM compiler ] - stub : MSVC C++ v14.00 ( detector via not EP bytes !)
5190. x64 .NET Goldfuscator [ v1.4 ] 2019.09.18 - http://github.com/AnErrupTion/Goldfuscator
5191. x64 Qt Installer v4.4.0 - 4.9.0 [ Gzip sec.5 ] - www.qt.io - stub : x64 - Microsoft Visual C++ v14.29
5192. x64 XerinFuscator G3 v.3.0.0.85 by Inx Company - [ mode : pack / minimal Anticrk/Obf only ] - discord.gg/sU6Cv4MGev - stub : x64 .NET DLL
5193. x64 .NET Reactor [ v.7.5.0.0 ] Native Method x64 exe - .NET / MS C++ stub v14 - www.eziriz.com
5194. x64 Paquet Builder v.25.x www.installpackbuilder.com - stub : *unknown - MS Visual C++ v.14.0 ( LLVM v14/Rust Head )
5195. x64 LLVM compiler v.14-21.1.0 ( sub rsp,28 ) - MSVC++ linker 14.x
5196. x64 LLVM compiler v.14-21.1.0 ( DLL Debug 02 *ACM ) - MSVC++ linker 14.x
5197. x64 Embarcadero Delphi compiler : XE - Delphi v12 Yukon / RAD Athens ( NSTD - exe - no Boolean VLC ) - www.embarcadero.com

!!! NOT Tested version !!!
A.S.L ( c ) 2026.01.06