Windows PE Headers

This page covers all of our Windows PE Header signatures. Jonathan Gross has done a good deal of work here, as have others. We're trying to mature these signatures, so please give feedback on how they perform on your network.

Some of these signatures are intended to detect just a PE header, which may well be a legitimate executable in transit. Others are intended to detect executables packed with known malicious packers, or in streams where they were purported to be something else (such as an image in an http stream).

Attached are some reference materials on structure and format.

PE HEader Related:

Signatures looking for MZ:

-- MattJonkman - 25 Apr 2007