Coobbi
HomeWeb ToolsAppsTutorialsContact
Portable Executable analysis

EXE Inspector

Inspect Windows EXE headers, architecture, sections, imports and exports without executing or uploading the file.

Analyze a Windows EXE fileStatic analysis only—the file is never executed.
Local processing

Drop an EXE file here

or choose a PE file from your device for local structural analysis.

The selected file stays on your device. This tool does not execute it or send its contents to a server.

PE32 & PE32+x86, x64, ARM and ARM64 structures.
Imports & exportsBounded directory parsing with search.
Static onlyThe selected executable is never run.
Understand the result

How to inspect an EXE file safely

An EXE file is usually a Windows Portable Executable image. This inspector reads selected PE headers and directories directly in your browser so you can understand the file's structure before deciding what to do with it.

Inspect an EXE in three steps

  1. Choose an EXE file or drop it into the area above.
  2. Confirm the detected type, PE format and processor architecture.
  3. Review sections, imported APIs, exported symbols and structural indicators. Search the tables when the file contains many entries.

What this analysis can tell you

  • Whether the PE characteristics describe an EXE or DLL.
  • Whether the image uses PE32 or PE32+ headers and which machine architecture it targets.
  • Which standard DLLs and symbols appear in the import directory.
  • Whether CLR/.NET and Authenticode certificate table directories are present.

EXE header fields explained

Use these fields together. No single value determines what a program does or whether it is trustworthy.

PE32 / PE32+

Format

Identifies the optional-header layout. PE32+ uses the 64-bit image layout; the Architecture field provides the target machine.

Machine

Architecture

Shows the intended processor family, such as x86, x64, ARM or ARM64.

AddressOfEntryPoint

Entry point

The relative virtual address where execution normally begins after the Windows loader prepares the image.

ImageBase

Image base

The preferred virtual address for loading the image. Relocations may allow Windows to load it elsewhere.

Subsystem

Subsystem

Indicates the expected environment, such as a Windows graphical application, console program or native image.

Section Table

Sections

Describes code and data regions such as .text, .rdata, .data and .reloc, including sizes and flags.

Import Directory

Imports

Lists DLLs and named or ordinal symbols the image asks the Windows loader to resolve.

Export Directory

Exports

Lists public names or ordinals that other images may import from this file. Many ordinary EXE files export nothing.

Data Directories

.NET and signing

Reports the presence of CLR metadata and an in-file Authenticode certificate table. Presence is not certificate validation.

Example PE32 result

This illustrative result describes a 32-bit console executable with a conventional entry point and an import from KERNEL32.dll. Real files can contain many more sections and imports.

Detected type  EXE
Format         PE32
Architecture   x86
Subsystem      Windows Console
Entry point    0x00001000
Image base     0x00400000
Import         KERNEL32.dll!CreateFileW

EXE Inspector FAQ

Answers to common questions about inspecting Windows executable files.

Does Coobbi upload or execute my EXE file?

No. The selected file is read locally by browser code. The inspector does not upload the file to Coobbi and never launches the executable.

How can I tell whether an EXE is 32-bit or 64-bit?

Check both Format and Architecture. A typical 32-bit x86 executable is PE32 with x86 architecture, while a typical 64-bit Windows executable is PE32+ with x64 or ARM64 architecture.

Can this tool tell me whether an EXE is malicious?

No. Imports, sections and entropy can provide context for further investigation, but they are not a safety verdict. Use a reputable security product or an isolated analysis environment for malware assessment.

Why are the imports or exports empty?

The corresponding directory may be absent, malformed, packed, resolved dynamically at runtime or outside the bounded data this browser tool reads. Many EXE files legitimately have no exports.

Can I run an EXE file on Android?

Android does not natively run ordinary Windows EXE files. Coobbi's Android app is intended to open and inspect PE metadata on a phone; it does not execute Windows programs.

Continue with the tool that matches the next question you need to answer.

Technical terminology follows Microsoft's Portable Executable and COFF specification. Last reviewed August 14, 2026.