PE-bear is a multiplatform reversing tool for PE files. Its objective is to deliver fast and flexible “first view” for malware analysts, stable and capable to handle malformed PE files.
Publisher’s description
What is PE-bear?
PE-bear by hasherezade is open-source Windows software. It is written in C++.
Installation and requirements
The publisher provides Portable installers for 64-bit and 32-bit Windows. It runs without installation (portable).
Updates and version history
The current version is 0.7.2, released on June 5, 2026. The version history goes back to September 14, 2024: 3 releases, all linked to the official files. That is about 1.7 releases a year.
Popularity and file types
The Chocolatey package has been downloaded 140,356 times. The source code on GitHub (hasherezade/pe-bear) has 3,862 stars.
Project description on GitHub: “Portable Executable reversing tool with a friendly GUI ”
Pros / Cons
Pros
- Open source: the code can be inspected and built by anyone
- Portable: runs without installation
Cons
- No native ARM64 build
In short: PE-bear is an open-source Windows tool for 64-bit and 32-bit PCs.
Is PE-bear safe to download?
- The file is served by github.com, the publisher’s own domain
- The download link uses HTTPS
- A SHA256 hash is published, so you can verify the file:
A9420CD7F417813E32C762DE83806AF631A48C1E70725FB2DF9A664B3F34977D· Open the VirusTotal report for this hash - The link has not been checked yet
- The source code is public
- ExeAtlas does not host, wrap or modify installers
Related guide: How to check a file’s SHA256 hash on Windows
Recent versions
All 3 versions ›3 versions over 2 years · about 1.7 a year
| Version | Date | Size | Files |
|---|---|---|---|
| 0.7.2Latest | June 5, 2026 | — | 32-bit ZIP64-bit ZIP |
| 0.7.1 | April 25, 2025 | — | 64-bit ZIP32-bit ZIP |
| 0.7.0 | September 14, 2024 | — | 64-bit ZIP |
Install from the command line
Silent install ›winget install --id hasherezade.PE-bear -echoco install pebear -yRelated guide: How to use winget: install and update apps
Information
- Publisher
- hasherezade
- Licence
- GPL-2.0
- Price
- Free
- Source code
- github.com/hasherezade/pe-bear
- Written in
- C++
- Requires
- Windows 11 / 10
- Architecture
- 64-bit, 32-bit
- Installer
- Portable
- Version
- 0.7.2
- Released
- June 5, 2026
- Added to the catalogue
- January 28, 2025
- Versions listed
- 3
- Updates / year
- 1.7
- Chocolatey downloads
- 140,356
- GitHub stars
- 3,862
- GitHub forks
- 246
- Website
- github.com
- winget ID
- hasherezade.PE-bear
- Chocolatey package
- pebear
Ratings and reviews
No reviews yet. Be the first to rate it.
Frequently asked questions
Is PE-bear free?
Yes. PE-bear is open-source software under the GPL-2.0 licence.
Is PE-bear safe to download?
The download comes from github.com, which belongs to the publisher; ExeAtlas does not host or change the file. Compare its SHA256 hash with the one shown here, or open the VirusTotal report for that hash.
How do I install PE-bear with winget?
Open PowerShell or Windows Terminal and run the winget command shown on this page. winget downloads the official installer and checks its SHA256 hash before running it.
Does PE-bear run on ARM (Windows on Arm)?
There is no ARM64 build; Windows 11 on Arm can run the 64-bit and 32-bit version through emulation.
Where can I download an older version of PE-bear?
The versions page lists all 3 versions with links to their official installer files, back to September 14, 2024.
Can I use PE-bear without administrator rights?
Yes, it is portable: unpack and run it.