normal tools are ugly(sorry) and hard to read for beginners. they just throw hex numbers at you and expect you, a beginner, to figure it out. it helps growth, but beginners can't grow from something they don't understand.

this is for the cuties who just wanna know if a file is sus without reading a 400 page manual c:

no!! PE-pal is NOT a virus scanner. it will not tell you if a file is safe or not. it will only show you the internal structure of the file and highlight suspicious elements.

• a PE analyzer is designed to dissect and examine the internal structure of executable files.
• a virus scanner is designed to detect and remove malicious software.

if you want to check if a file is safe, try uploading it to virustotal.

seeing an indicator in a PE analyzer does not automatically mean a file is malicious! software developers often use those exact same things for legitimate reasons. finding a sus trait in an analyzer means you should take a closer look, not that it is dangerous.

the simple version: you give PE-pal a Windows executable file. it reads the file and extracts information about its structure and what functions it uses. then it displays that info in a cute format so you don't have to stare at random hex numbers :D

"what's inside a PE file?"

• the DOS header: the file saying "haiii, i'm an executable!" (it always starts with 4D 5A = "MZ" in text)
• sections: containers that hold code (.text), data (.data), or other stuff. each section is encrypted or not depending on how sophisticated the malware is.
• the import table (IAT): a list of functions the .exe is calling from Windows. like if it's calling CreateRemoteThread, that's sus because it lets you inject code into other processes.
• strings: readable text hidden in the binary like URLs, file paths, IPs, or registry keys. malware sometimes leaves these as clues c;
• the rich header: metadata that shows which compiler version built the file (usually hidden by malware to cover its tracks)

"what does PE-pal do with this?"

• entropy analysis: measures how "random" each section is. normal code has patterns, encrypted/packed malware doesn't. it's a jumbled mess. (entropy > 7.0 = sus)
• function classification: groups imported functions by behavior (networking, file system, process injection, etc.) so you can see what the malware is trying to do, in simple terms.
• string flagging: highlights URLs, IPs, and file paths as suspicious since badly-written malware sometimes hardcodes these
• compiler tracking: shows the compiler timeline so you can see if the file is a frankenstein of different builds

"how does the code work?"

• you drag a file and the browser loads it into memory as bytes
• web worker processes it and a separate JavaScript thread (worker.js) parses the PE structure without freezing the UI. it reads binary data using DataView API to extract all the things mentioned above.
• calculations happen. entropy is calculated for each section using information theory (frequency analysis). then, functions are categorized. strings are extracted by scanning for readable ASCII text in the hex.
• data flows back. the worker sends results to the main thread, which renders cutie charts so you can actually understand what's going on :3
• no files leave your computer! everything happens in your browser's memory. the moment you close the tab, it'll all be gone.

tl;dr: PE-pal is a binary file translator. it reads the instructions inside your PE file and tells you what it's trying to do in a language that doesn't require a compsci degree to understand! (´ ▽` )b

paranoid? good! welcome to infosec o_o

this runs 100% in your browser. the file never leaves your pc. you won't be uploading anything to my servers. all this happens locally through javascript (ᵔ▭ᵔ)