Summary
- PE is the Windows executable format; its headers are a rich static intelligence source.
- Layout: DOS header (MZ) → NT Headers (PE sig + File + Optional) → Section Table → Sections.
e_lfanewfinds the NT Headers; the Optional Header gives bitness, entry point, image base, and the DataDirectory.- RVA vs file offset: convert via the section table (
VirtualAddress/PointerToRawData). - Imports reveal capability (imphash for clustering); exports describe DLLs; TLS callbacks, resources, and signatures matter too.
- Odd sections + high entropy + empty imports ⇒ packing ⇒ dynamic analysis next.
Key Takeaway
Read the PE before you run the malware — it tells you what to expect.