
File:			ChangeLog.txt
Author: 		Marc Ochsenmeier 
Email			info@winitor.com
Web:			www.winitor.com

Copyright (C) 2009-2015, Marc Ochsenmeier

Version 8.47
. Added computation of Imports Hash (imphash)
. Added detection of strings embedded in non-PE files
. Extended detection of processor types
. Fixed a hangup
. Updated AV list

Version 8.46
. Added new thresholds
. Extended detection
. Fixed a crash with malformed files
. Corrected duplicates during collection of functions statistics

Version 8.00 to 8.45
. Added Virustotal aging and submission date
. Extended Languages detection and mapping
. Added PeID Signature detection of Executable embedded in Resources
. Added PeID Signature detection of Executable embedded in Overlay
. Added XML-based detection of PeID Signatures
. Added XML-based detection of OIDs
. Added XML-based detection of useragent
. Extented blacklists
. Added detection of references to Firefox API
. Added MD5 Blacklist for a file and its Resources 
. Extended detection of Overlay
. Extended validation of Sections
. Resolve OpenSSL ordinals API to User friendly names
. Added Blacklist of MD5 dedicated to the Overlay
. Extended detection of files embedded in Resources
. Added detection of Regular Expressions and Threshold
. Cache Virustotal scores when Internet connection drops
. Small cosmetic issues
. Added Indicators and Thresholds
. Fixed a bug when handling the imports of some images
. Added more Indicators and Thresholds
. Added Functions Groups classification
. Resources with unknown Signature and containing only text are now tagged as Text
. Fixed a bug when handling the Characteristics of the FileHeader
. Added MD5, SHA1 and Virustotal Score for Overlay
. Fixed a bug when handling the <PreferedVirustotalEngine>
. Fixed a bug when handling the virustotal Engines
. Added Thresholds for DOS Stub and Header size
. Added Thresholds for Blacklisted Imported Libs and Blacklisted functions number
. Added Thresholds for Blacklisted Strings count
. Added Thresholds for Blacklisted Exported Functions count

Version 7.50
. Added Dump of Indicators
. Added Dump of Manifest
. Added Context menu for Certificates
. Added Dump of Certificates
. Raw discovery of fundamental characteristics of the Certificate(s) embedded in the Image
. Handle non-printable characters in XML report
. Added more Indicators specific to the location of the Entry Point
. Added more details (offset and size) for each file Cave detected
. Show the name of the section BaseOfCode is located in
. Fixed reporting of the Libraries in the XML report
. Simplified Indicators XML file
. Added Indicators specific for First and Last Sections
. Take virtual Section into account when pointing the overlay
. Fixed detection of MPRESS under 64bit
. Added detection and Indicator of suspicious Certificate size
. Added detection and Indicator of suspicious Certificate content (e.g. padding)
. Added MD5 computation for Resources
. Added MD5 computation for Sections
. Extended Severity levels with "positive" (green) indicators
. Added collection of Unicode Strings
. Detect (direct) usage of Native API
. Detection of Embedded Executable in malformed Images
. Added Detection of Device Drivers and handle Indicators accordingly
. Extended detection of Custom Embedded files in standard Resources
. Removed many strings from Parser and put these in a new PeStudioTranslations.XML file
. Corrected NB10 debug detection
. Show Section:Offset for Resources
. Extended Types and location of embedded Executable
. More validity checks on Exports
. More detection of Masqueraded UPX

Version 7.00
. Added additional Hints about suspicious size of the Version Resource (some malware place custom stream in standard Windows Resources)
. Added additional Hints about Invalid Directories as Indicator and at the UI
. Added PeStudioSettings.xml and handling VirusTotal switch ON/OFF based on this XML file
. Enhanced validation of EAT (ollybug.exe)
. Detect INVALID DATA found in the VERSION_INFO stream (some malware place custom stream in standard Windows Resources)
. Extended support for corkami malformed samples
. Added detection of fake (unprintable characters) imported library names (malformed images attempting to escape analysis)
. Added support for Sorting by Color for Indicators
. Added detection of PKZIP, PKLITE, PKSFX and JAR Embedded in Resources
. Added detection of RTF Embedded in Resources
. Added Query of Imported Functions at MSDN using the Context Menu
. Added Detection of Qt Embedded Resources
. Added Translation of OptionalHeader.Subsystem into human friendly name
. Added DosHeader output to UI
. The Lookup at VirusTotal has been totally integrated into PeStudio, no browser is started anymore
. The result of VirusTotal is now shown at the UI
. The result of VirusTotal is now available in the XML report file
. Added full RAW access to Icons items
. Added detection of 7zSFX files embedded in Resources
. Added Mapping of Language Code of StringFileInfo to Human friendly name into the XML Report
. Added Mapping of Code Page of StringFileInfo to Human friendly name into the XML Report
. Icon at the UI is now directly loaded from the Resource using our own interface
. Dump the content of StringFileInfo in the XML report
. Dump the content of VarFileInto in the XML report
. Corrected a bug in the Console version of PeStudio
. Added UPX information details in XML report file
. Release Image analysed when handling a new one
. PeStudioIndicators.XML is not loaded once

Version 6.00
. Fixed a bug by reading Symbols
. Extended Indicators for Embedded Resources
. Corrected missing Dependencies for some types of images
. Renamed *.XML files to PeStudio*.XML
. Interfaces to PeParser (PeParser.h and PeParser.lib) are now part of the Package.
. Added Indexing of String
. Added Detection of duplicated Section Names
. Allow Strings length choice for filtering at the UI
. Show Strings at the UI
. Added Strings count in output XML
. Detect Section-less images and added in Indicators.XML
. Correct Address Offset of reported Strings

Version 5.00
. The Strings contained in the file analysed can now be exported to the output XML file
. Added validation Check of AddressOfEntryPoint field
. Custom Resources are shown in orange colour
. Corrected handling of Certificate Directory
. Corrected colouring of Indicators
. When handling a resources only images, some validity checks are different
. Enhanced detection of device driver images
. renamed parameters for command prompt (see Prompt support description above)
. Added detection of CAB, PDF, RIFF, GIF, PNG files
. Added detection of "requireAdministrator" Execution Level from the Manifest
. Added Command Prompt support (see Prompt support description above)
. Added "The image exports XY Symbols" as new Indicator
. Added more obsolete functions in the WindowsFunctionsDeprecated.xml file (delivered with this project)

Version 1.0 to 4.0
. Now fully support 64bit Images on 32bit Platform
. Show Resources Languages
. Show Type of Debug information (NB09, NB10, NB11, RSDS )
. Show imported Functions of missing libraries
. Show total number of Bytes available in Caves
. Show Gaps in Exported Symbols collection
. Show Section Name the Base of Data belongs to
. Added OptionalHeader to XML report
. Added detection of duplicated Sections names
. Added detection of Code-less images
. Added detection of Section containing the Entry point
. Corrected filtering of Obsolete Imported Functions
. Corrected Imported Symbols for 64bit images
. Corrected Page-able Section Flag
. Corrected detection of msstyles "Resources Only" Images
. Corrected a crash that takes place when switching between Tree and list View in Resources Tab
. Added Detection of Image Obfuscation (encryption, compression) as Evidence
. Un-decorate function names
. Support Manifest dependentAssembly.
. support Side-by-Side libraries.
. Support Forwarded Functions
. Filtering Obsolete Functions
. Enumeration of Implicit dependencies and other general information