Found an unknown EXE and want to know what built or packed it before you run it? Exeinfo PE, a free tool popular with malware analysts and reverse engineers, identifies the compiler, packer, protector or .NET obfuscator behind a Windows executable.
Detection results for PE files
Exeinfo PE examines Windows PE executables for signatures associated with packers, protectors, and compilers. It can also recognize .NET obfuscators and flag potentially unwanted applications. These identifiers offer a first look at how an executable may have been built or altered; they are clues about the file, not proof that it is safe or harmful.
Packed files can conceal or compress executable content. Exeinfo PE also checks binary data for formats including RAR, ZIP, ISO, 7z, ZX, SQZ, LZ4, and IMG. That broader detection can reveal packed data even when the item being inspected is not a typical executable.
How do you use it to inspect an unknown file?
Drag a file onto the window to see its entry point, entry section, file offset, linker version, subsystem and any overlay data appended to the end. A hint line suggests how a detected packer might be unpacked. If a result identifies a packer or protector, that gives a starting point for further investigation; it does not replace antivirus scanning or establish that the file is trustworthy.
- Check executables for packer, compiler, protector, and obfuscator detections.
- Use the packed-data checks for supported archive and binary formats.
- Look up the hint line for unpacking advice on a detected packer.
Interpreting signature matches
Exeinfo PE identifies known signatures; it does not disassemble or debug code. A match tells you which tools to reach for next, such as an unpacker or a debugger. Signature updates are published on the project's GitHub page.
Pros
- Detects packers, protectors, compilers, and .NET obfuscators
- Checks for packed data such as ZIP, RAR, ISO, and 7z
- Includes detection for potentially unwanted applications
Cons
- Technical output aimed at analysts
- Unknown packers may go undetected
- Some antivirus tools flag analysis utilities like this
System requirements: Windows 7, Windows 8, Windows 8.1, Windows 10, Windows 11 · Minimum 486, 666 MHz · Minimum 1 GB RAM · Minimum 50 MB hard drive space · SVGA graphics card, 256 colors
What kinds of executable details does Exeinfo PE detect?
Packers, protectors, compilers, .NET obfuscators and potentially unwanted applications, plus entry point and section details.
Can Exeinfo PE inspect archives and disk images?
Yes. It recognizes packed data such as RAR, ZIP, 7z, ISO, LZ4 and IMG, even inside other files.
Does a detection result tell me whether a file is safe?
No. It shows how the file was built or packed; scan it with antivirus software to judge whether it is safe.
Is Exeinfo PE free?
Yes. It is free and needs no installation.