Why Care About the PE Format?

PE = Portable Executable: the native binary format for Windows.

• Every Windows .exe, .dll, .sys, and .ocx is a PE file.
• The Windows loader reads PE headers to map the file into memory and start it.
• Most malware you will analyze targets Windows and ships as a PE.

For a malware analyst, the PE headers are a free intelligence report:

• What APIs does it import? (capability hints)
• Is it packed or obfuscated? (odd sections, high entropy)
• When was it built, for which architecture, with what subsystem?
• Is it signed? By whom?