The PE format: anatomy of a Windows executable

Portable Executable is the format of .exe/.dll on Windows. Analyzing it tells what a binary does before running it.

The parts that matter

The DOS header ("MZ") points to the PE header. The Optional Header gives entry point and image base. The sections (.text code, .data data, .rdata, .rsrc) have permissions. The Import Address Table lists imported APIs — a first fingerprint of behaviour.

pefile / PE-bear / CFF Explorer to inspect headers and IAT
# suspicious imports: VirtualAlloc, WriteProcessMemory, CreateRemoteThread

Signals for the analyst

High-entropy sections (packing), SizeOfRawData zero but large VirtualSize (code unpacked at runtime), a tiny IAT (imports resolved dynamically to hide), timestamps and certificates.

Defensive use

PE parsing underpins YARA rules, static detection and triage. Knowing the structure lets you tell a legitimate packer from a malicious one and find shellcode in resources.