Item :

Download link

Date

Exeinfo Pe v. 0.0.9.8

1252 / 212 signatures

( Ext_detector  ver.0.7.8.4   )

userdb.txt : 4468

Download link

only on this version :

- Inno unpacker updated to : v.2.67.7

- old signatures updated
- ELF Ripper limit added to 50 MB if set
- non exe detector updated wav or other files
- mp4 movies ripper fixed
- added .a3x ripper Autoit compiled script
- added [ Debug : 21.R2RM - Ready2Run .NET ]
- added on Main GUI - press x key - unpack .CAB Microsoft
- update NON EXE -.dcp new 2025 version detect
- added to non exe & overlay detector & sections GUI
NOT EXE - .exe-ovl - overlay data ( Debug data GCC: MinGW compiler )
- update ver.detector : x64 - [ Python core v.3.14.2 ] x64 Microsoft VC++ v14
- ASM Guard Detector FIXED for dll files
- on : NOT Win EXE - .o - ELF
added Delphi compiler detector :
"Embarcadero Delphi for Android"
"Embarcadero Delphi for Android" "Embarcad. Delphi for Android ARM64"
"Embarcadero RAD Studio"
"Embarcadero RAD Studio" "Embarcadero Techn. Inc. bcc64 version 5.0.2"

and more bugs fixed
 

25.04.2026

Please do not distribute on Forums

Exeinfo Pe v. 0.0.9.7

1247 / 206 signatures

( Ext_detector  ver.0.7.8.3   )

userdb.txt : 4467

Please do not distribute on Forums

Download link

only on this version :

- Inno unpacker updated to : v.2.67.4 - Buggable version if pass
- old signatures strong updated
- new added ex. Autoit v3.3.18.0


and more bugs fixed
 

17.03.2026

Please do not distribute on Forums

Exeinfo Pe v. 0.0.9.6 Test

1241 / 203 signatures

( Ext_detector  ver.0.7.8.3   )

userdb.txt : 4467

Audio Nag

Download link

only on this version :

- Inno unpacker updated to : v.2.67.2 - 18.01.2026
- many old signatures updated
added x86 x64
InstallShield [ 2025 Pro Unic. v31.0.100 ] , Flexera Software www.installshield.com www.flexerasoftware.com
added - Inno Setup [ v.6.7.0 ] UnInstaller - Delphi/Embarc. - www.innosetup.com
fixed - x64 GCC - version fix for '14-pos' to 'GCC 14-posix'
added debug counter :
sign 796 , 080.MS Visual C# / Basic.NET / MS VB [Deb. 16] -  [ WARNING : Debug x 4 ]
Compiler Detector - Lazarus runtime detector Added
fixed Bug version string : '.0.0' to '3.0.0'
x86 Free Pascal Compiler v.3.0.4 [2018/12/02] for i386 - www.freepascal.org
x64 Free Pascal Compiler v.3.0.4 for i386 - www.freepascal.org
updated BoxedAppSDK64
5147.x64 [ BoxedAppSDK64 - 2024-12-06 ] DLL library - www.boxedapp.com - stub : C++ 8 NSTD EP ,
1145.32 bit DLL [ BoxedApp SDK32 - v.2024.5.0.0 ] library - www.boxedapp.com - stub : C++ 8 NSTD EP
fixed for obsolete version [ unknown ver. ]
Generic - Free Pascal compiler (MinGW/FPC) familly - unknown ver. - Linker 2.26
to :
Generic - Free Pascal compiler (MinGW/FPC) familly - [ (GNU Binutils) 2.26.20160125 ] - Linker 2.26

added - MS Visual C# / Basic.NET - DLL [ VMProtect SDK32 .NET - 2026 ]

Autoit x64 now detect LLVM stub :
5045. x64 - AutoIt [ v3.3.16 2022.09 ] - www.autoitscript.com - Stub : x64 - MSVC / LLVM 14.16

x64 VMProtect v3.10 Now detect !

Themida updated

and more bugs fixed
 

20.02.2026

PDF , doc

  and

picture hints

added :

ArmDot NET_how to uncrypt included files from .NET RESources

EXE Ripper base64 usage Example.pdf ,  universal ripper example , zlib unpacker example ,

how to ...

update hints

ExeinfoPe_documents.zip

02.04.2026

updated !

9.5 MB

Exeinfo Pe v. 0.0.9.5

1238 / 199 signatures

( Ext_detector  ver.0.7.8.2   )

userdb.txt : 4467

Download link

only on this version :

- Inno unpacker updated to : v.2.67.2 - 18.01.2026

- old signatures update

- version for Windows XP included


and more bugs fixed
 

29.01.2026

Exeinfo Pe v. 0.0.9.5 Beta NAG

1238 / 198 signatures

( Ext_detector  ver.0.7.7.9   )

userdb.txt : 4467

Test version

Download link

only on this version :


- Compilators GUI - fixed on GCC 32/64 ver.detector string

many old signs updated to new version

many warnings added when ripping files

- Inno unpacker updated to v.2.66.1


About changed - sound added
 

07.01.2026

Exeinfo Pe v. 0.0.9.4

1233 / 193 signatures

( Ext_detector  ver.0.7.7.5   )

userdb.txt : 4467

Download link

only on this version :

1231.EXECryptor v.2.1.17 ( TLS prot. obsolete software ) -
- added because Exeinfo detect VMProtec struct ! strongbit.com

- Compilators GUI - fixed on GCC 32/64 ver.detector string

- Section GUI adde Xerinfuscator detector

- Inno unpacker updated to v.2.66.1

- fixed detector !!! if digi signed
Inno Setup Module 5 SFX - [ v.6.3.0 ] - [ Protected with Inno Protect v1.0 by A.S.L ]

- added : Dell sfx / HP sfx


Windows XP version included

12.12.2025

Exeinfo Pe v. 0.0.9.4 Beta 2 NAG

1229 / 192 signatures

( Ext_detector  ver.0.7.7.4   )

- fixed updated
976.NVidia 7z Sfx - NVIDIA Package Launcher v1.0.x - 1.10.x - www.nvidia.com
- added : [ Vulkan-Loader Runtime ] to DLL file
700.Microsoft Visual C++ v.10 DLL - 14.29 ( jmp x/int3 /jmp x/int3 .. [ Vulkan-Loader Runtime ] ,
- detect Armv8 installer
5191. x64 Qt Installer v4.4.0 - 4.10.0 [ Gzip sec.5 ] - www.qt.io - stub : x64 Microsoft VC++ 14.00 exe [ CPU : AA64 ARMv8 ]
- added detector for XerinFuscator-V3.0.0.85 Runtime dlls
- TEST - DETECT only 35% EXE / DLL X86 and 0% x64 files !!!
1229.XerinFuscator G3 v.3.0.0.85 by Inx Company [ mode : no pack ] DNG - discord.gg/sU6Cv4MGev - stub : MS Visual C#
- Bug fixed :
structure : VMProtect v.2.07 - 2.13 - 2003-2013 PolyTech - www.vmpsoft.com
to :
EXECryptor v.2.2.x-2.4.x (IAT) - strongbit.com *ACM - via Import size 110h

- EXECryptor v.2.1.7g not detect on this version - soon


and more sign updated


 

no Windows XP version included

13.11.2025

Exeinfo Pe v. 0.0.9.4 Beta

1227 / 190 signatures

( Ext_detector  ver.0.7.7.4   )

- Inno Unpacker updated to : v.2.65.2 ! <- press 'x' key on main form for all exe unpacking

- Fixed dissasemble and Hex view for x64 files

- Header GUI - added click on dir/import/export/resources/iat/...

Hex view in DASM GUI blue

- added detect Sfx module IZArc version 4.6 - https://www.izarc.org - only : 7z , zip , rar

- fixed added NSTD struct EP and sections x64 :
5187. x64 - C++ Builder 10 - VCL Modern Compiled - RAD 29.0 *NSTD [ Embarcadero RAD Studio 23.0 ]

 
- Added x64 - 1211. x64 - [ PyInstaller v.3.6 - v6.1 - 2005–2024

- detect .NET Goldobfuscator x32 only for test

 

no Windows XP version included

06.11.2025

Exeinfo Pe v. 0.0.9.3 Final

1226 / 190 signatures

( Ext_detector  ver.0.7.7.4   )

userdb.txt : 4467

Compiler detector Strong Update !

update
655.[ 7-zip SFX stub ] [ v25.01 GUI - GENUINE ] - stub : Microsoft Visual C++ v.6-9 - Name : 7z SFX.

068. x64 - 7z Sfx GUI 25.01 ZS v1.5.7 - 2025 Tino Reichardt- CPU : AMD x64 , if overlay added 7z


added x64 DLL Generic codec unpacker ( lz4/zl5/7z/7za/brotli/lizard/zstd/flzma2 )

x64 Microsoft Visual C++ v14.29 - 2019
[ GEN plugin unpacker LZ/Lizard/Lzma ] - Not packed
[ 7z* plugin by Igor Pavlov ]

( 7z unpacker update x64 only - no About GUI info , still 22.01 x86 ! )
x64 7za ZS v22.01 unpacker updated to v25.01

fixed get dimensions - movies from www.savevid.com
NOT EXE - .mp4/m4v ( MPEG-4 ) codec : avc1 - H.264 - [ 532x924 cmfciso6dsmsmsixdash ]

5063. fixed ver detection
x64 - MinGW-w64 GCC: (GNU) compiler v.4 exe ( xx C7 ) - [ v4.?.? ] - http://mingw-w64.sourceforge.net ,
to :
x64 - MinGW-w64 GCC: (GNU) compiler v.4 exe ( xx C7 ) - (x86_64-posix-sjlj-rev0, Built by MinGW-W64 project) 4.8.4 - http://mingw-w64.sourceforge.net ,

fixed overlay detector offset for : ( save overlay and click on Overlay view ) only for this 657 sign.
657.Nullsoft SFX v2.46.2-5 Setup Unicode Installer
sign 630.Generic : Installer Nullsoft PiMP Stub [ v.3.02.1 ]

fixed 1123.[ Rust Compiler v1.89.0 - www.rust-lang.org ] - stub : MS Visual C++ v.14.44 - 2025 (E8)

sign
6000. x64 ( GENERIC ) MinGW-w64 GCC: (GNU) Cygwin Fedora compiler no TLS - http://gcc.gnu.org
fixed version info
6000. x64 ( GENERIC ) MinGW-w64 GCC: (GNU) Cygwin Fedora compiler no TLS - http://gcc.gnu.org - [ GNU compiler v.15.1.0 ] ,

fixed detector ( x64 unknown file ):
5144. x64 Microsoft VC++ 14.00 DLL [ CPU : AA64 ARMv8 ] - [Deb: 02] [ PE Header can be Rust/LLVM/GCC Mingw compiler ]

fixed NSTD + mingw detect
1204.Microsoft VC++ 14.00 [ dll - CPU : ARMv7 ] - [ Deb : 02 C++ CodeView ] - [ PE Header be Rust/LLVM/GCC Mingw compiler - 100% mingw ]

fixed ver. if C++ v4
595.GCC MINGW-64w compiler for 32/64 bit ( exe ) - http://mingw-w64.sourceforge.net
to
595.GCC MINGW-64w compiler for 32/64 bit ( exe ) - http://mingw-w64.sourceforge.net - [ GNU C++ 4.7.2 ]


and more

 

27.09.2025

Please do not distribute on Forums

Exeinfo Pe v. 0.0.9.3 Beta2 Nag

1224 / 188 signatures

( Ext_detector  ver.0.7.7.2   )

Please do not distribute on Forums

Strong Update !

buffer for exe 666 MB ,

- Inno Unpacker updated to v2.64

- Detect Embarcadero Delphi / C++ VCL exe files and RAD v12 DevExpress as STD files
- added on x64 .gz section detector - x64 Microsoft Visual C++ v14.29 - 2019 - (exe 4883EC28-48) [ .GZ archive sec.6 ] ,
- Go compiler detector engine - detect tampared GO string
- mp4 Ripper fixed via "mp4" string
- NOT EXE - .gz archive - added "x" key press , unpack file on Main GUI
- fixed crash bug
NOT Win EXE - .dylib - Mac OS X Universal Binary executable
to :
NOT EXE - .class - Java Bytecode object oriented programming language http://java.sun.com
- fixed
5175. x64 - MinGW-w64 GCC: (GNU) compiler (exe) v11 [ ~ 14.x ] - http://mingw-w64.sourceforge.net ,
to :
5175. x64 - MinGW-w64 GCC: (GNU) compiler (exe) v11 [ (MinGW-W64 x86_64-ucrt-posix-seh ...]

- NOT EXE - .aac detector fixed
- changed .pdb function - support unicode string ,
- fixed detection : 5004. x64 DLL with : 00 Entry Point - RESOURCES Only : xx,x KB no CODE - CPU : AMD64
- MS VC++ linker 14.44 updated to 2025

- for Windows XP - added x86 7z v22.09 ( ZS/LIZ mode not supported only on Windows 10 )
*fixed resources for XP

- added "x" on main GUI for unpacking .zip files

- Console mode for zip files :
Zip unpacking ( .zip archives )
exeinfope.exe FileName /un7zip - unpack .zip archive )
for many files ( mask files ) :
exeinfope.exe FileName* /un7zip - unpack .zip files

- updated : GEMPlayer v1.0 protected data - ThunderSoft DRM Protection / Gilisoft Free DRM Protection

- fixed updated 1136.DotFix NiceProtect v6.9 - 7x demo x86

- .NET added to signatures ( Meta nstd struct ) . 080 , 1129
" - [ First Meta Data stream as Confuser/Xfuscator ] "

- update v34 x17 - not detected
908.InstallAware for Windows Installer v34.0.6 X17 2025
detect v2025.01
x86./ x64 - Ahk2Exe for AutoHotkey [ v1.1.37.02 Ans/Uni 2025 ] - Script to EXE Converter - www.autohotkey.com

- NOT EXE - .bmp detector - fixed !
- changed :
5036. x64 - Embarcadero Technologies Inc. clang version 5.0.2 (f0862325.f3a671d2.38570) (based on LLVM 5.0.2) ( EXE )
to :
5036. x64 - C++ Builder 10.x [ Embarcadero RAD Studio 29.1 - Copyright 2025 Embarcadero Technologies, Inc. ]

- Fixed .gz Ripper - now detect gzip with [Unknown System} on -> NOT EXE - .pak Chromium format v5 - Chrome

- added on Linux ELF
NOT Win EXE - .o - ELF [ 64bit obj. - CPU : AMD x86-64 - OS/ABI: unspecified ]
-> Compiler : Embarcadero Technologies Inc. clang version 5.0.2 (f0862325.f3a671d2.38570) (based on LLVM 5.0.2)
 

26.08.2025

Please do not distribute on Forums

Exeinfo Pe v. 0.0.9.3 Alpha III Nag

1221 / 185 signatures

( Ext_detector  ver.0.7.6.4   )

Please do not distribute on Forums

buffer for exe 666 MB ,

.lzma packer undetectable - changed , packed file not unpackable can't be scanned via Avir scanners ! , you can send via email

new Babel detector for test !!!

many changes , visible:  Config GUI

30.06.2025

Please do not distribute on Forums

Exeinfo Pe v. 0.0.9.3 Alpha Nag

1220 / 185 signatures

( Ext_detector  ver.0.7.6.4   )

userdb.txt : 4464

Please do not distribute on Forums

Added on this version only :

buffer for exe 666 MB ,

scan deeper signatures,

x64 MSVC++ added - .gz section detector

Not tested version- Error engine changed

pseudo digital signed

Avir scanners detect only 1 malware on Exeinfo PE

14.06.2025

Please do not distribute on Forums

Exeinfo Pe v. 0.0.9.2 Nag screen

1218 / 184 signatures

( Ext_detector  ver.0.7.6.1   )

userdb.txt : 4464

Please do not distribute on Forums

Download link

Added on this version only :

( Internal unpackers : Innounp v1.77 / .zip /  .zlib / 7z ZS v22.01 / .Rar  )

namy updates  and fixes , F1 key update

 detect : Obsidium new version 2025.04

-  added extra exe for Windows XP 

Avir scanners detect only 1 malware on Exeinfo PE

**************

Version for Arabic Windows !!!

not 100% option fully functional

work With English Windows patched to CHN !

Download link

25.04.2025

Please do not distribute on Forums

Exeinfo Pe v. 0.0.9.1

1216 / 182 signatures

( Ext_detector  ver.0.7.5.4   )

userdb.txt : 4464

Please do not distribute on Forums

Added on this version only :

Not tested version

( Internal unpackers : Innounp v1.77 / 7z ZS v22.01 / x64 Rar v7.11 )


For Windows XP - added x86 7z v22.09 ( ZS/LIZ mode not supported only on Windows 10 )

Inno unpacker : added key "x" on main GUI for unpacking .exe files
.7z unpacker : added key "x" on main GUI for unpacking .7z files ( x86 / x64 Systems )
rar unpacker : added key "x" on main GUI for unpacking .rar files ( only x64 Systems )

Console mode for unpacking : zip.7zip/rar

Added Pure Basic x32 runtime compiler to : Compiler detector

better detect VMProtect .NET files


-  added extra exe for Windows XP 

*Avir detect only 3 malware on Exeinfo PE

09.04.2025

Please do not distribute on Forums

Exeinfo Pe v. 0.0.9.0 ntest

( with NAG Screen )

1214 / 181 signatures

( Ext_detector  ver.0.7.5.4   )

userdb.txt : 4462

Please do not distribute on Forums

Added on this version only :

Not tested version

for Windows XP - added x86 7z v22.09 ( ZS/LIZ mode not supported only on Windows 10 )
*fixed resources for XP


Inno unpacker update v.1.77

added "x" on main GUI for unpacking .zip files

Console modefor zip files :
Zip unpacking ( .zip archives )
exeinfope.exe FileName /un7zip - unpack .zip archive )
for many files ( mask files ) :
exeinfope.exe FileName* /un7zip - unpack .zip files

updated : GEMPlayer v1.0 protected data - ThunderSoft DRM Protection / Gilisoft Free DRM Protection

fixed updated 1136.DotFix NiceProtect v6.9 - 7x demo x86

.NET added to signatures ( Meta nstd struct ) . 080 , 1129
" - [ First Meta Data stream as Confuser/Xfuscator ] "


-  added extra exe for Windows XP 

29.03.2025

Please do not distribute on Forums

Exeinfo Pe v. 0.0.9.0 Alpha2

( with NAG Screen )

1211 / 181 signatures

( Ext_detector  ver.0.7.5.4   )

userdb.txt : 4462

Added on this version only :


for Windows XP - added x86 7z v22.09 ( ZS/LIZ mode not supported only on Windows 10 )

1211.PYinstaller GCC stub x86/x64


NOT EXE - .png - added DPI info for printing
and much more !


-  added extra exe for Windows XP 

06.02.2025

Exeinfo Pe v. 0.0.8.9 Test

1209 / 181 signatures

( Ext_detector  ver.0.7.5.4   )

userdb.txt : 4462

many changes and critical ! updates , more version detect

added Config GUI - programm paths

added .7z unpacker if "x" key pressed

.mp4 don't crash if video codek search

and much more !


-  added extra exe for Windows XP 

29.01.2025

Exeinfo Pe v. 0.0.8.8 Alpha

1206 / 181 signatures

( Ext_detector  ver.0.7.4.7   )

userdb.txt : 0

many changes and updates


added .NET GUI auto click on .NET 4 / 6 detector
added .PYD x86 v2.x 3.x / x64 v3.x version detector
fixed cpu version detector added
[ generic - CPU : 0x01C4 ARMv7 (or higher) Thumb mode only ] GO Programming Language Compiler
added x86 only : [ plugin : Photoshop plugin ]
fix 5005. x64 Microsoft Visual C++ v14.20 - 2008 [ RT_CODE ] - DLL
added to .pdb - NOT EXE - .IDB Microsoft Developer intermediate
.zlib ripper fixed - Zlib - false Alarm - skipped ( now ripp more files ) - fixed for Android backup : fullbackup.ab
.zlib added ripper for zlib v2 - if Fast scan off option in Config (example : installer LLC SysDev Laboratories )
detect NOT EXE - .zlib v2 files
added dll detector - XerinVM.Runtime v1.0 2024
small fixed XerinFuscator v1.0 - 3.0 , XFUSCATOR 1.0.0.4

and much more !


-  No exe  added for Windows XP 

14.12.2024

Exeinfo Pe v. 0.0.8.7 Beta II

1203 / 178 signatures

( Ext_detector  ver.0.7.3.9   )

userdb.txt : 4460

many changes and updates

fixed : inno unpacker engine , added "x" key for all

* .exe file unpacking on main form

Mulitiscan GUI : added search string PgDn strings and CPU detector

NET GUI : added NET 6.0 / 6.0 core detector

Go language compiler 32/64 added version DETECTOR

Fixed , updated : Rust Compiler v1.82

Detect .lzma nstd Archives included exe file

added to setup/installer detector : [ Microsoft Office Click-to-Run Setup ]

and much more !


-  extra exe added for Windows XP 

09.11.2024

Exeinfo Pe v. 0.0.8.6

1201 / 177 signatures

( Ext_detector  ver.0.7.3.5   )

userdb.txt : 4460

many changes , signatures updated , and few hidden options

NET_GUI changed items visible
added support for 5,6 NET Streams - view streams enabled

.NET Bug fixed

user skin bug fixed


-  extra exe added for Windows XP 

- more
 

02.09.2024

Exeinfo Pe v. 0.0.8.6 Beta - Nag  !!!

1200 / 175 signatures

( Ext_detector  ver.0.7.3.5   )

userdb.txt : 4460

many changes , signatures updated , and few hidden options

fixed : 1199.XerinFuscator v.1.0.0

NET_GUI changed visible
added support for 5,6 NET Streams - view streams enabled

added detector zip sfx : Beijing JJJsafe Technology - unpack problem Xpack mode

added better password detector for .7z files AES and AES*

added to .7z archives ZS compressions detector - not supported with std 7zip Archiver
( Zstd , Liz, LZ5, Brotoli )
 

console mode .7z ZS mode unpacker

-  Windows XP  not supported

15.08.2024

Exeinfo Pe v. 0.0.8.5 

1192 / 173 signatures

( Ext_detector  ver.0.7.2.8   )

userdb.txt : 4457

- many updates and fixes , more inteli warnings on .NET files
- added detector for : Virbox Protector v.3.3.x -3.x.x appsecurity.virbox.com ( Windows & Linux only )

- included version for Windows XP :

exeinfope_Win_XP.exe

- much more and not tested !

06.06.2024

Exeinfo Pe v. 0.0.8.4 

1191 / 173 signatures

( Ext_detector  ver.0.7.2.8   )

userdb.txt : 4457

strong update - .NET inteli infos added

Warning : This version work with Windows XP only after patch !

added to Version info : ISInternalVersion = 27.0.58
update and detect : v9.0 InstallAware Virtualization
951. .NET compiler - unknown structure - strange [ Native EntryPoint - NSTD Struct is OK ]
fix ver.detector up to 90% (for files over 2 MB ) .NET + dotfuscator - PreEmpire Solutions v1.2 - 7.1
fix for 2019 ver.1083.Eazfuscator.NET v2019.x
update to v.2015 8011.*Unknown DLL , A1 00 30 x [ BoxedApp SDK32 - 2021 ]
added 988.SSE Setup 10.7 - xx.x ( 7-Zip sfx
added NOT EXE - .txt UTF-16 (LE) + Hidden .exe PE file at offset 0040
added generic : on 8011.,8010. x64 LLVM compiler : clang version 18.1.2
Sections GUI scan added detector : LLVM compiler Clang ver.18.1.1 (MSC++14)
Disable Warning - if exe Pe Magic=0107 ROM DATA
detect dll files 5144. x64 Microsoft VC++ 14.29 DLL [ CPU : AA64 ARMv8 ]
fixed updated : 472.Autoit v3.3.x.x
fixed : Hamrick Software - VueScan
update 1123.[ Rust Compiler v1.60.x - 1.77.0 ]
update and fixed detector 1031.Advanced BAT to EXE Converter [ v.4.61 ] 2017-2024
fixed 798.Advanced Installer Web/Next [ v.21.5.x ] 2003-2024 - www.caphyon.com
update MS linker to 14.39 x86 x64
Compiler Detector fixed : x86 and x64 MingWin32 Free Pascal / MinGW-w64
fixed NOT EXE - .ZIP archive - [ Mode Unknown : 5Fh ] to : NOT EXE - .ZIP archive - [ XZ Compression ]
added .NET x86 if sign 080; x64 with zero EP Warning : NET Streams: 6 ...
fixed version : 1038.MINGW32 Cygwin family [exe] msys-2.0 GCC: (GNU) [v0.2.0]
added Visual C# / Basic.NET - DLL [ VMProtect SDK32 .NET - 2023 ]


- much more and not tested !

18.04.2024

Exeinfo Pe v. 0.0.8.4 

1188 / 171 signatures

( Ext_detector  ver.0.7.2.8   )

userdb.txt : 4457

Warning : This version work with Windows XP only after patch !

Last news - only in this version :

fixed : Obsidium v1.5 - 1.8 - [ v.1.8.2.1-2 - option : Def. MZ Head ]
added : detector for DLL 32/64 bit : [ plugin for : AutoPlay Media Studio ]
added detector for DLL 64bit : [ .PYD Python C Extensions library ]
fixed : Embarcadero Delphi version show x64
update to v1.77 : 1123.Rust Compiler v1.60.x - www.rust-lang.org
added : console mode : unpack all exe files and Inno script from InnoSetup installer : exeinfope.exe file_name /unp-inno-exe
fixed : if Themida protector , result : Themida - Winlicense , if Winlicense result : Winlicense - Themida
added : Skater v24.2.0.51 2024
Added : Delphi version resolver : XE7,Sydney,Rio,Alexandria,Yukon,Tokyo,Berlin
added : DLL [ VMProtect SDK32 .NET - 2023 ]
fixed : version :1038.MINGW32 Cygwin family [exe] msys-2.0 GCC: (GNU) [v10.2.0]
added : .NET 32 if sign. 080 Warning : NET Streams: 6 ...
added : detector 7z Bandizip sfx
fixed : .zip added 5F ( Bandizip ) NOT EXE - .ZIP archive - [ Mode Unknown : 5Fh ] to : NOT EXE - .ZIP archive - [ XZ Compression ]
fixed : Compiler Detector x86 and x64 MingWin32 Free Pascal / MinGW-w64
update : MSC++ linker to 14.39
fix for 599.Advanced Installer [ v21.5.x ] - 2003-2024
update and fixed detector 1031.Advanced BAT to EXE Converter [ v.4.61 ] 2017-2024
fixed/updated : 472.Autoit v3.3.0.0 x64 - Autoit v3.3.6.1
fixed : 599.Advanced Installer [ v.15.5.x ] - 2003-2024
fixed : and debug info added 5144. x64 Microsoft VC++ 14.39 exe [ CPU : AA64 ARMv8 ]
added : 068.x64 Sfx 7z GUI 22.01 ZS v1.5.5 R3 GUI - 2023 Tino Reichardt
Disable Warning - if exe Pe Magic=0107 ROM DATA
Sections GUI scan added detector : LLVM compiler Clang ver.18.1.1 (MSC++14)
added : partial detector generic on 8011.,8010.sign x64 LLVM compiler : clang version 18.1.2
added : ( exe od offset 0040 , Busy21.exe v21.0 https://busy.in ) NOT EXE - .txt UTF-16 (LE) + Hidden .exe PE file at offset 0040
added : 724. NOT EXE - (.) Win PE 32/64 File ( .exe Crypted with : ADD 05 )
- .NET files scan changed , many .NET false detection fixed
- added .NET ConfuserEx structure [ mutation / mod -> Packed Generic Unknown ]

- much more and not tested !!!

- Buffer for exe file : 336 MB

 

01.04.2024

Exeinfo Pe v. 0.0.8.4 Alpha

1187 / 169 signatures

( Ext_detector  ver.0.7.2.3   )

userdb.txt : 4455

- .NET files scan changed , many .NET false detection fixed
- Delphi version resolver Added :
Delphi v12 Yukon,
Delphi v11.0 Alexandria,
Delphi v10.4 Rio,
Delphi v10.4 Sydney,
Delphi XE7 - v10.4,
Delphi v10.1 Berlin
- update Skater added v24.2.0.51 2024 - Skater_NET_Obfuscator
- added console mode :
unpack all *.exe files and script file from : InnoSetup installer
( work only if you don't have installed Inno Extractor - Exeinfo Pe internal unpacker )
parameter example : exeinfope.exe file_name /unp-inno-exe
- Rust Compiler v1.76 update
- added detector for DLL 64bit : [ .PYD Python C Extensions library ]
- added detector for DLL 32bit : [ plugin for : AutoPlay Media Studio ] v8.5 http://www.indigorose.com
- fixed Obsidium v1.5 - 1.8 - [ v.1.8.2.1-2 - option : Def. MZ Head ]
- fixed Themida - Winlicense
- added .NET ConfuserEx structure [ mutation / mod -> Packed Generic Unknown ]

- much more and not tested !!!

- Buffer for exe file : 336 MB

 

- more
 

22.02.2024

Exeinfo Pe v. 0.0.8.3

1183 / 169 signatures

( Ext_detector  ver.0.7.2.3   )

userdb.txt : 4455

- fixed VMProtect 3.6
- Ripper .7z xor FF - fixed , detect crypted 7z v.0.4 in Advanced Installer
- fixed NOT EXE - .7z Archive v0.3/4 ( Crypted with : xor FF )
- fixed 1157.InstallForge Setup v.1.4.2
- fixed NOT EXE - .jpg picture (.MPO bug if first section Exif )
- added console mode ( pack / unpack with lzma )
Lzma packer :
exeinfope.exe FileName /plzma - pack file with lzma packer ( 7z compatible )
Lzma unpacker :
exeinfope.exe FileName /ulzma - unpack file with lzma packer
- Visual Studio 2022 update linker 14.38
- Buffer for exe file : 336 MB
- more
 

11.02.2024

 Test version  Alpha II

Exeinfo Pe v. 0.0.8.3 Alpha II

1180 / 168 signatures

( Ext_detector  ver.0.7.1.8   )

userdb.txt : 4455

please check news directory !

- Ripped data save to Directories : ex. : !Rip_zip_file_name\
- www address menu - changed items from Result
- 7z more detections
- lzma packer unpacker : file names fix
- fix for VMprotect v3.5+
- fix ScriptCryptor (js/vbs/+exe)
- Inno script fix for big files
- more
 

20.01.2024

Exeinfo Pe v. 0.0.8.3 Alpha I

1178 / 166 signatures

( Ext_detector  ver.0.7.1.8   )

userdb.txt : 4455

please check news directory !

Inno script unpacker - internal +

7z - added compression info + Better detect passworded 7z

Added pack .lzma , .lzma Undetectable , .lzma unpacker

config : added [Internet Browset ] change to user path

Viewer : added [ Save to File - window log ]
 

12.01.2024

 Test version  Alpha- Beta

Exeinfo Pe v. 0.0.8.2 (I)

1175 / 165 signatures

( Ext_detector  ver.0.7.1.8   )

userdb.txt : 4455

- Wow64 Disable File directory redirect ( Exeinfo Pe is 32 bit app. )

[new option in Config GUI ]

- inno setup script view  ( tmp. - if you have installed Inno Extractor in default path )
- and others


Buffer for exe file : 303 MB

many Bugs - do not distribute !!!!

08.11.2023

 Test version

Exeinfo Pe v. 0.0.8.1 II

1173 / 165 signatures

( Ext_detector  ver.0.7.1.4   )

userdb.txt : 4455

NOT EXE - .jpg comment fixed bug
added : NOT EXE - .MPO - 3D Stereoscopic Picture
fixed 685. x64 - Squeez Sqx Archive Selfextractor / added cpu : x64 Microsoft VC++ 14.24 exe [ CPU : AA64 ARMv8 ]
fixed 918.Launch4j-3.x
fixed NOT EXE - .Zip Arch. - .msix/appv [ Generic detector MSIX Windows app package ]
added NOT EXE - .Zip Arch. - .msixbundle [ Generic detector Win10 MSIXBundle Windows app package ]
changed : DOS exe 8 bit / 16 bit info

Buffer for exe file : 303 MB

Small update !

 

06.10.2023

Ext_detector.dll

for : Exeinfo Pe   &   Xor Data Uncrypter

version 0.7.1.8

LAST SIGNATURES :

711. NOT EXE - .m4s MPEG-DASH Video Segment Moving Picture Experts Group
712. NOT EXE - .heic image picture - H.265/HEVC codec ( need : Microsoft's HEIF Image Extensions )
713. NOT EXE - .dz Dzip ( zlib packed files : xx ) Speed Demos Archive - http://speeddemosarchive.com/dzip
714. NOT EXE - .hli UniLink v1.13 ( #hash# linker file ) - http://unilinker.com
715. NOT EXE - .ejpg Encrypted JPEG bitmap
716. NOT EXE - .empo Encrypted Multi-Picture Object jpg bitmap
717. NOT EXE - .pl Photolist file format multi jpg picture by Filefrend 2016
718. NOT EXE - .epl Encrypted Photolist file format multi picture [ files : xxx ]
 

Old .sqx signature - added compression info / crypted info
 

30.09.2023

 Test version

Exeinfo Pe v. 0.0.8.1

1173 / 164 signatures

( Ext_detector  ver.0.7.1.4 !  )

userdb.txt : 4455

update to ver.45.5 :   1156.PUP/PUA - Softonic Downloader
fixed :
589.Generic - Free Pascal compiler (MinGW/FPC) familly
NOT EXE - .vcproj Visual Studio C++ Project v8.0-9.0
NOT EXE - .PDF format ( ver.1.6 ) - [ *ENCRYPTED ]
5138. x64 NET IntelliLock v.1.5 - 3.0 ( .NET Reactor 6.x ) - for DLL 00 EP
5088. x64 Java installer v.11-20.0 offline/online
673.Sun Java Installer v8.0.x
added NOT EXE - .cbproj Radstudio ( C++ Builder )
NOT EXE - .Zip Arch. - .msixbundle
NOT EXE - .Zip Arch. - .msix/appv
Detector for Dos , win 32 , win 64 - UniLink creator
added : over 100 mb info in zip and rar files



and other
 

28.07.2023

 Test version

Exeinfo Pe v. 0.0.8.0

1172 / 162 signatures

( Ext_detector  ver.0.7.1.2 !!!  )

userdb.txt : 4455

- NON exe file format many fixes , mp4 , jpg , pdf, img/EXT2/3/4 Linux extended file system image
- add size on mp4/avif - file ( MPEG 4 container H.265 ) - [ 2048 x 1536 ]
- jpg file added GPS - data detector !
- added NSIS Installer Nullsoft NSTD detector for GCC compiler
- fixed result for NSIS exe if file size over 1 GB
- update C++ MS linker to 14.36 x86/x64
- Zip ripper fixed
- added detector on Linux ELF files for hidden : .SQUASHFS image files
- x64 - MinGW-w64 GCC: (GNU) version detector fix
- added New to Compiler detector menu for : GCC GNU v11/MinGW-W64 v4/MSYS v12 - 32/64 compiler

and other detection fixes

small visible on GUI

and other
 

28.07.2023

 Test version II

Exeinfo Pe v. 0.0.7.8

1169 / 161 signatures

( Ext_detector  ver.0.7.0.7 !!!  )

userdb.txt : 4455

console mode fixed - window no flash

- many fixes VMP 3.6 - 3.7 and other
- added more inteli hints
- fixed : Inno Setup Un/Installer
- update 1000.[ MS BoxStub Installer v17.x ]
- update : 1083.Eazfuscator.NET v2020.x - 2023.2

- fixed apng detected as png ( if .png file 20 mb )
- fixed .APNG file format - more frames : 323

- fix : 5036. x64 - Embarcadero Technologies Inc. clang version 5.0.2 (36917.e4aabb3.b018c58) (based on LLVM 5.0.2)
- fix detection for 15 sections Dll :
5040. x64 Lazarus v1-2.2 / FPC v2-3 [ v3.2.2 ] for x86_64 - [ Dll ] 

- added x64 / x86 [ python core ] x64 Microsoft Visual C++ v14.34
- update detector : 1091.PUP/PUA Asystent pobierania - komputerswiat/dobreprogramy

and other
 

23.05.2023

 Test version

Exeinfo Pe v. 0.0.7.8

1167 / 161 signatures

( Ext_detector  ver.0.6.9.6  )

userdb.txt : 4453

many fixed for test

console mode fixed - window no flash

Now detect All exe xor-ed -combination on binary files*

fix and update 32/64 : VMware/BitRock InstallBuilder ver: 22.x

fixed console mode option '/se' scan with external signatures userdb.txt

added detection :
925.Make SFX v5.x http://74.cz

NOT EXE - .ZIP archive - .appxbundle Windows 8.1 App Bundle

851.VirtualBox Installer [v.7.00.6 ] 2023

[ Sfx Easy 7-Zip 0.1.6 James Hoo

added 32/64 & update :
[ Update Tool ] - x64 Microsoft Visual C++ v14.34

update EP
VMProtect v.3.6.0 - 3.7.3 2022 [ Exe , Option : packed ]

now detect v.23
1054.Yandex browser installer v19 - 23.x full

update detector
970.Google UPDATE (MS Edge/Chrome) Update Setup Installer

added only x86 stub : [ Opera 2023 Installer ]

fixed : x64 for Alexandria ver35
5012.x64 Embarcadero Delphi compiler

added signatures :

5150. x64 .NET - DNGuard HVM v4.20 by ZiYuXuan Studio - 2022.11 - www.dnguard.net - stub : EP=0000
5151. x64 DLL from : Microsoft AppStore ( Export : RHBinder__ShimExeMain ) - stub : NSTD MSV C++ built by: PROJECTNREL
5152. x64 EXE from : Microsoft AppStore ( exe run dll -> RHBinder__ShimExeMain ) - stub : NSTD MSV C++ built by: PROJECTNREL
5153. x64 Baymax Patch Tools v3.1.0 - 3.x 2023.01 by Nisy/PYG www.chinapyg.com - stub : Microsoft Visual C++ v.9.00 & UPX Stub
5154. x64 Microsoft Visual C++ v14.16 - 2017 - DLL ( push rbx , DisableThreadLib.Cs. )
5155. x64 Yano v1.0.15.0 ntoolbox.bom/yano 2012 obsolete! - stub : x64 .NET exe file : 00 Entry Point
5156. x64 ArmDot 2023 v3.0.0 - www.armdot.com ( protector/license creator ) - stub : x64 .NET DLL with : 00 Entry Point - CPU : AMD64
5157. x64 GO Programming Language - Compiler v1.19.7
5158. x64 - DLL to EXE converter v1.1 - for 32 & 64 bit DLLs - 2018-10-10
5159. x64 .NET - DLL to EXE converter v1.1 - for 32 & 64 bit DLLs - 2018-10-10
5160. x64 .NET IntelliLock 2.9 - 3.0 ( unreg.js script ) .NET Reactor

and x86 signatures :

1155.ArmDot 2023 v3.0.0 - www.armdot.com ( protector/license creator ) - stub : MS Visual C# / Basic.NET
1156.[ PUP/PUA - Softonic Downloader v6.4x 2022 ] - Inno Setup Module 5 SFX - [ v.6.1.0 ]
1157.InstallForge Setup v.1.4.2 ( free ) 2007-2020 - http://installforge.net - stub : PureBasic v4.20 - v6.0
1158.[ A.S.L - NSIS Setup Protector ver.0.01 ] - Nullsoft Install System v2.xx - 3.0 / v.2.12
1159..NET exe bytepress v1.0.0.2 by Adam Roach - http://github.com/roachadam/bytepress ( Mode : lzma/gzip/quickLz )
1160..NET Bat2Exe v2.1 ( 17.11.2021 ) - http://github.com/dehoisted
1161.[ Overlay crypted PUP/PUA - Unknown Pack ] - Generic : Installer Nullsoft PiMP Stub / v.20-Sep-2022.cvs
1162.Generic new : AVAST/AVG Software Sfx installer v23.x 2023 - www.avast.com - stub : NSTD MS VC++ 14.x
1163.x86/x64 Chromium Installer v.113.x - 2023 - stub : Microsoft Visual C++ v.14 - 2015 ( NSTD ) microsoft.com
1164.x86/x64 Generic/Modded : Chromium Installer v.xx - 2023 - stub : Microsoft Visual C++ v.14 - 2015 ( NSTD ) microsoft.com ( ex.Maxton )
1165.x86 - DLL to EXE converter v1.1 - for 32 & 64 bit DLLs - 2018-10-10
1166.Adobe Installer downloader v2.11.0.30 - upx stub 3.91
1167..NET IntelliLock 2.9 - 3.0 ( unreg.js script ) .NET Reactor
 

25.03.2023

 Test version 5

Exeinfo Pe v. 0.0.7.7 V

115x / 15x signatures

userdb.txt : 4453

.NET - Babel v9.x updated , IntelliLock 3.0

console mode fixed - window no flash

overlay xor - changed ! , you can use on non executable files ( un-xor binary file )

fix : 426.Themida & WinLicense 2.0 - 2.4.6 - struct (Hide from PE scanners II-V)

Config - if set to English , I delete config lng file for external language like : Chinese.lng

added on MSV C++ for PUA App. : [ WARNING : File use VirtualProtect ]

update [ 7-zip SFX stub ] [ v22.01 Con - GENUINE Stub ]

1145.[ BoxedApp SDK32 - 2018-2021 ] DLL library - www.boxedapp.com

All signs : imptoved VMProtect 3.5.x - 3.6.x - x86 & x64 - Strong detection POWER !

fix 797.DeployLX Software Protection System - Codeveil 5.x for .NET

added
800.[ NETSecureFake Signature ! ] .NET + dotfuscator - PreEmpire Solutions

fixed Non exe - .h264 movie detector

18.03.2023

Can generate NET results :

Skater : if obfuscation method  is identical

Test version

Exeinfo Pe v. 0.0.7.5

1141 / 146 signatures

userdb.txt : 4451

signatures update

- Strong update .NET obfuscator x86 / x64 !!!
- DLL Characteristics GUI updated
- Added .jp2 jpeg2000 Ripper ( for .pdf files )
- fixed : x64 GO Programming Language
- 5045.x64 - AutoIt [ v3.3.14.5 ]
5045.x64 - AutoIt [ v3.3.16 2022.09 ]
- 5012.x64 Embarcadero Delphi NSTD
- 5035.x64 Paquet Builder v21.0.0
- 016.PEcompact ver.3.02.2
update : 5076.[ x64 Enigma ver.5.x - 7.0 ]
update ver.VMProtect v.3.5.1 - 3.7.3 2022
fixed & upd.723.Ahk2Exe for AutoHotkey [ v1.1.36.02 ]
added v10 : 588.Enigma Virtual Box - v10.00 (2022.12.14)
fix detector :
5135.x64 VMProtect v.3.6.0 - 3.7.3 2022
added new version :
1021.InstallAware Virtualization v6 ( BoxedApp packer v2.x - 14.0 )
1021.BoxedApp Packer 2018 / 2019 14.0
added x64 : [ ESET module MZ-Header ]
added v5 generic :
760.Generic Crypto Obfuscator For .Net v5 - LogicNP Software
added tampared exe :
Windows PE exe for .NET / GNU compiler but no "PE" tampared/compr.
Windows PE exe compressed LZ77
fix : NOT EXE - .dex - Dalvik Executable v5.0 - 9.0



 

25.12.2022

Test version

Exeinfo Pe v. 0.0.7.3

1132 / 138 signatures

userdb.txt : 4447

NOT compatible with - Arabic Windows 10 !

signatures update

added Flip EOF to offset 0000 - binary file tool

added Fake detector for : 800..NET + dotfuscator - PreEmpire Solutions

fix : 5096. x64 Eazfuscator.NET v2022.1

fix For : Inx .NET Protector & Obfuscator ( Strong ConfuserEx Mod )

and others

29.08.2022

Update file ,

main exe only + dll !

Exeinfo Pe v. 0.0.7.1 AR

1124 / 134 signatures

This version is compatible with - Arabic Windows 10

this version try detect x64 dotfuscator

VMProtect v.3.5.1 2021

CPU Bug fixed

Autoit 3 ver. fix

fix : 800. .NET + dotfuscator - PreEmpire Solutions v1.2 - 6.5.x

info : Deleted Address Converter GUI - crash on Arabic Windows
 

27.06.2022

Update file ,

main exe only !

Exeinfo Pe v. 0.0.7.1 Test

1124 / 132 signatures

fixed :
5074. x64 Qt Installer v2.0.0 - x.x.x
fix [ Virtualbox.org Header ] 32 / 64
x64 - Qt [v.601.34] DLL - App.dev.framework
5043.structure : x64 VMProtect v.3.0x
800..NET + dotfuscator - PreEmpire Solutions v1.2 - 6.4.x

added :
5129. x64 VMProtect v3.x Minim. section
935.VMProtect v3.00 - 3.5.0 [ option : not packed - First section Delphi ]
769.InstallShield [ 2021 Pro Unic. v27.0.122 ]
1124..NET + dotfuscator - PreEmpire Solutions v6.5.x [ 6.5.0 ]
5131. x64 InstallShield [ 2014-2021 Pro Unicode v21.00-27.00 ]

update 32/64
Autoit3 [ v3.3.3.16 ]

fix : Run Uniextract v2
Long directory names with space bar

Exeinfo size = -100 kb

and other fixes
 

16.06.2022

Exeinfo Pe - Advanced config tool 

ver. 1.5.0.3

You can enable hidden  Config options

 down link

added : support shell Die v.3.0

updated !

16.09.2020

Exeinfo Pe ver.0.0.6.2 Final

1083 / 97 signatures

( Ext_detector  v.0.5.6.7  )

userdb.txt : 4432 
 

update old detections :

GO Programming Language Compiler v1.14.5

fixed 935.VMProtect v3.00 - 3.5.0 2003-202

960.Radstudio v10.x ESD ( C++ Builder 10.1 - 10.4 - DLL library ) -

added support for bmp files v4

added for Delphi   10.4 Sydney - pas,dfm,dpr

www ripper - fixed for unicode www

Scan files faster ! - visible on big NET files

24.07.2020

Cryptographic plugins for Exeinfo Pe

kanal v2.92

and

Hash & Crypto Detector v1.4

07.03.2019

Exeinfo Pe ver.0.0.5.0

1015 / 67 signatures 

Ext_detector.dll

for : Exeinfo Pe   &   Xor Data Uncrypter

version 0.4.9.0

new signatures added : Detect VMProtect v3.1 ( 32 & 64 bit )

many diagnose changed , added new Ripper for Packed .js files

changed  :Quick Unpack registry from v2.2 -> v3.4 , v2.2 not supported !

External scan - userdb.txt support up to : 4800 sign

.ico Ripper error fix

fix : Not Windows PE -> Signature : LX <- OS/2 ver.2.0 or higher , EIP : 00xxx

added to DOS exe : Not Windows PE -> Sign. : DOS 8 bit - CS:IP : 0000:00xx

961.[ Obsidium ver.1.6.43.0 ] fix TAGG

946. fix : ESET Live Installer

external db signatures : 4524

GUI - Windows Visual Style - fixed

12.04.2018

Exeinfo Pe ver.0.0.4.8 Test

994 / 64 signatures

( Ext_detector  v.0.4.5.2 )

Many fixes : Added detection for  Go language x64

old signatures updated GNU GCC MinGW + ver.detector ,

added : GO language detector , STATIC - Qt v5.x App.devel.

fix for ScreenShot create - Multiscan GUI Win7 , Inno Setup updated

External scan changed : minimum 4 bytes length ( ex. E8 ?? ?? ?? ?? ) !!!

10.09.2017

   Adv_scan.dll plugin  - A.S.L version fixed

-> no trojan on Anti Virus scanners

For Developers / Programmers

           Exeinfo Pe / PeID  plugin

   Source code  : 

PowerBASIC ,

C++ ,

Delphi ,

MASM

           Exeinfo Pe / PeID  plugin

   Example code :  Delphi source code

 How to use Ext_detector.dll from  Exeinfo Pe

    Language : Delphi 2006 - Console only 

              minimum code  - source

Please send suggestions   :   asl@onet.eu