PE-bear

PE-bear 0.7.2

PE-bear is a multiplatform reversing tool for PE files. Its objective is to deliver fast and flexible “first view” for malware analysts, stable and capable to handle malformed PE files.

  • By hasherezade
  • Open Source
  • Portable
  • Updated Jun 5, 2026
Download for Windows

About PE-bear

PE-bear is a multiplatform reversing tool for PE files. Its objective is to deliver fast and flexible “first view” for malware analysts, stable and capable to handle malformed PE files.

What's new in 0.7.2

BUGFIX
- Removed hard-coded limit of the displayed resources (only 50 were visible)
- Fixed GUI behavior on Windows 11 (i.e. invisible selection in hex editor and disasm view), fixed editing content in hex editor
- Fixed crashing on fast editing content in hex edit
- Fixed crashing when closing the signature search window before the search finished
- Other small fixes
FEATURE
- Added Japanese language
- In hex editor: any selected number can be now interpreted as an address within the PE and followed on demand via context menu (read more here)
- Added string search (ANSI and Unicode) - as another option along to signature search (read more here)
- In signature search: if it is defined by the string with odd length, assume that the last nibble is a wildcard rather than dropping the byte (i.e. 123 will be interpreted as 12 3?)
- In hex editor: in addition to NOP/clear of the selected ranges, you can fill them with a custom character (read more here)
- In Diff Window: unified a toolbar for both views
WARNING: The Windows build with vs10 suffix is built with Qt4 (legacy) - in contrast to the other builds that are with Qt5, Qt6 (recommended). It is prepared for the purpose of backward compatibility with old versions of Windows (i.e. XP).
─────────────────────────────────────────────┬───────┬─────────────────────────┬─────────────────────────────────────┬─────────────────────────────────────────────
File │Qt │OS │Depends │Info
─────────────────────────────────────────────┼───────┼─────────────────────────┼─────────────────────────────────────┼─────────────────────────────────────────────
PE-bear_0.7.2_qt6_x64_win_vs22.zip │6 │64-bit, Windows, portable│requires: VS2017 Redistributables │for Windows 10 and above
─────────────────────────────────────────────┼───────┼─────────────────────────┼─────────────────────────────────────┼─────────────────────────────────────────────
PE-bear_0.7.2_qt5_x64_win_vs17.zip │5 │64-bit, Windows, portable│requires: VS2017 Redistributables │recommended for Windows < 10
─────────────────────────────────────────────┼───────┼─────────────────────────┼─────────────────────────────────────┼─────────────────────────────────────────────
PE-bear_0.7.2_qt5_x86_win_vs17.zip │5 │32-bit, Windows, portable│requires: VS2017 Redistributables │ …

Full release notes »

Technical details

Publisherhasherezade
Version0.7.2
Release date2026-06-05
LicenseGPL-2.0
Installer typezip
Architecturex64, x86
Package IDhasherezade.PE-bear
DependenciesMicrosoft.VCRedist.2015+.x64

Install PE-bear from the command line

Install with Windows Package Manager
winget install --id=hasherezade.PE-bear -e
Update to the latest version
winget upgrade --id=hasherezade.PE-bear -e
Uninstall
winget uninstall --id=hasherezade.PE-bear -e

bearparsermalware-analysismultiplatformpe-analyzerpe-analyzer-guipe-editorpe-filepe-format

PE-bear version history

0.7.1 Apr 25, 2025

BUGFIX
- Important stability fixes. Fixed crashing on file resizing. (Issue #66)
- Fixed file resizing via editing values in General Panel
- Fixed resetting to the default system language when en_US was selected (Issue #67)
- Improved Chinese translation to follow changes in the interface (Issue #68)
- Internal refactoring
WARNING: The Windows build with vs10 suffix is built with Qt4 (legacy) - in contrast to the other builds that are with Qt5 (recommended). It is prepared for the purpose of backward compatibility with old versions of Windows (i.e. XP).
─────────────────────────────────────────────┬───────┬─────────────────────────┬─────────────────────────────────────┬─────────────────────────────────────────────
File │Qt │OS │Depends │Info
─────────────────────────────────────────────┼───────┼─────────────────────────┼─────────────────────────────────────┼─────────────────────────────────────────────
PE-bear_0.7.1_qt6.8_x64_win_vs22.zip │6 │64-bit, Windows, portable│requires: VS2019 Redistributables │for Windows 10 and above
─────────────────────────────────────────────┼───────┼─────────────────────────┼─────────────────────────────────────┼─────────────────────────────────────────────
PE-bear_0.7.1_qt5_x64_win_vs19.zip │5 │64-bit, Windows, portable│requires: VS2019 Redistributables │recommended for most versions of Windows …

0.7.0 Sep 14, 2024

Frequently asked questions

Is PE-bear free?

Yes. PE-bear is free and open-source software released under the GPL-2.0 license.

What is the latest version of PE-bear?

The latest version is 0.7.2, released on Jun 5, 2026.

Is it safe to download PE-bear?

The download button links to the official installer published on github.com, the same file Windows Package Manager installs. You can verify the downloaded file by comparing its SHA-256 checksum with a9420cd7f417813e32c762de83806af631a48c1e70725fb2df9a664b3f34977d.

Which Windows versions does PE-bear support?

PE-bear runs on Windows and is available for 64-bit (x64), 32-bit (x86) systems.

How do I uninstall PE-bear?

Open Settings › Apps › Installed apps, find PE-bear and select Uninstall. From the command line, run winget uninstall --id=hasherezade.PE-bear -e.

Is there a portable version of PE-bear?

Yes. PE-bear is available as a portable ZIP archive (PE-bear_0.7.2_qt5_x64_win_vs17.zip, 64-bit (x64)) that runs without installation. Copy it to any folder or USB drive and run it from there.

Alternatives to PE-bear

Other Anti-Malware programs for Windows from different developers.

YARA 4.5.5

The pattern matching swiss knife for malware researchers (and everyone else)

Anti-Malware · Open Source · Oct 30, 2025

Download