Learning Malware Analysis

6. Inspecting PE Header Information

Windows executables must conform to the PE/COFF (Portable Executable/Common Object File Format). The PE file format is used by the Windows executable files (such as .exe, .dll, .sys, .ocx, and .drv) and such files are generally called Portable Executable (PE) files. The PE file is a series of structures and sub-components that contain the information required by the operating system to load it into memory.

When an executable is compiled, it includes a header (PE header), which describes its structure. When the binary is executed, the operating system loader reads the information from the PE header and then loads the binary content from the file into the memory. The PE header contains information such as ...