Learning Malware Analysis

6.3  Examining PE Section Table And Sections

The actual content of the PE file is divided into sections. The sections are immediately followed by the PE header. These sections represent either code or data and they have in-memory attributes such as read/write. The section representing code contains instructions that will be executed by the processor, whereas the section containing data can represent different types of data, such as read/write program data (global variables), import/export tables, resources, and so on. Each section has a distinct name that conveys the purpose of the section. For example, a section with name .text indicates code and has an attribute of read-execute; a section with name .data indicates global data and has an ...