PE (Portable Executable) Header
Definition
The Windows executable file format. Starts with an MZ DOS stub, points to a PE signature, then a COFF file header, an optional header (despite the name, mandatory in practice), and section headers (.text, .data, .rdata, .rsrc). Imports/exports tables and the resource directory are the analyst's primary entry points.
- Platform
- Windows executable file format
- Structure order
- MZ DOS stub, PE signature, COFF file header, optional header, section headers
- Common sections
- .text, .data, .rdata, .rsrc
- Analyst entry points
- Import/export tables and the resource directory
Common questions
Why does the PE format still include an obsolete MZ DOS stub?+
The stub preserves backward compatibility: a program run under DOS or an unsupporting environment prints the stub's message, typically 'This program cannot be run in DOS mode,' instead of crashing, while Windows itself follows the pointer past the stub to the real PE header.
Why do malware analysts start with the import table rather than reading the whole PE file?+
The import table lists the external functions a binary calls, which often reveals its likely capabilities, such as network access, registry manipulation, or process injection, before the analyst commits time to disassembling the code itself, making it an efficient first triage step.
Related terms
- Entropy (Shannon)
- Per-byte information density of a file or section. Plain code sits around 5.5; packed or encrypted sections exceed 7.0. A PE with...
- ImpHash
- Mandiant's hash of the ordered list of imported functions in a PE file's import table. Survives recompilation that does not change imports;...
- IoC (Indicator of Compromise)
- Observable artefact linked to malicious activity. File hashes (MD5, SHA-256, ImpHash, ssdeep, TLSH), IPs, domains, URLs, registry keys, mutex names, named pipes,...
- Volatility 3
- Open-source memory forensics framework, Python 3 rewrite of Volatility 2. Symbol-based (PDB symbols on Windows) instead of profile-based, supports modern Windows 10/11...
- YARA
- Pattern-matching language for malware classification. Rules combine string and byte-pattern conditions with metadata. Used by VirusTotal, every major sandbox, and most threat-intel...