Windows PE Headers

This page covers all of our Windows PE Header signatures. Jonathan Gross has done a good deal of work here, as have others. We're trying to mature these signatures, so please give feedback on how they perform on your network.

Some of these signatures are intended to detect just a PE header, which may well be a legitimate executable in transit. Others are intended to detect executables packed with known malicious packers, or in streams where they were purported to be something else (such as an image in an http stream).

Attached are some reference materials on structure and format.

PE HEader Related:

2010282 TWikiGuest 2017-08-08 - 01:03
2003615 TWikiGuest 2017-08-08 - 00:56
2003614 TWikiGuest 2017-08-08 - 00:56
WinPEHeaders MattJonkman 2008-07-11 - 15:05

Signatures looking for MZ:

2009028 TWikiGuest 2017-11-13 - 21:23
2009897 TWikiGuest 2017-11-09 - 21:18
2024971 TWikiGuest 2017-11-08 - 21:30
2000427 TWikiGuest 2017-11-02 - 14:51
2010869 TWikiGuest 2017-11-02 - 14:51
2011457 TWikiGuest 2017-11-01 - 20:17
2023464 TWikiGuest 2017-10-13 - 20:25
2014471 TWikiGuest 2017-10-13 - 20:25
2024628 TWikiGuest 2017-08-30 - 20:33
2024592 TWikiGuest 2017-08-17 - 22:54
2024345 TWikiGuest 2017-08-08 - 01:19
2024198 TWikiGuest 2017-08-08 - 01:19
2024190 TWikiGuest 2017-08-08 - 01:19
2024040 TWikiGuest 2017-08-08 - 01:19
2023971 TWikiGuest 2017-08-08 - 01:19
2023947 TWikiGuest 2017-08-08 - 01:19
2023928 TWikiGuest 2017-08-08 - 01:19
2023750 TWikiGuest 2017-08-08 - 01:18
2023711 TWikiGuest 2017-08-08 - 01:18
2023679 TWikiGuest 2017-08-08 - 01:18
2023671 TWikiGuest 2017-08-08 - 01:18
2023672 TWikiGuest 2017-08-08 - 01:18
2023636 TWikiGuest 2017-08-08 - 01:18
2023567 TWikiGuest 2017-08-08 - 01:18
2023502 TWikiGuest 2017-08-08 - 01:18
2023316 TWikiGuest 2017-08-08 - 01:18
2023291 TWikiGuest 2017-08-08 - 01:18
2023113 TWikiGuest 2017-08-08 - 01:18
2023001 TWikiGuest 2017-08-08 - 01:18
2022947 TWikiGuest 2017-08-08 - 01:17
2022958 TWikiGuest 2017-08-08 - 01:17
2022874 TWikiGuest 2017-08-08 - 01:17
2022653 TWikiGuest 2017-08-08 - 01:17
2022340 TWikiGuest 2017-08-08 - 01:17
2022050 TWikiGuest 2017-08-08 - 01:16
2022053 TWikiGuest 2017-08-08 - 01:16
2022051 TWikiGuest 2017-08-08 - 01:16
2022052 TWikiGuest 2017-08-08 - 01:16
2021954 TWikiGuest 2017-08-08 - 01:16
2021562 TWikiGuest 2017-08-08 - 01:16
2021559 TWikiGuest 2017-08-08 - 01:16
2021553 TWikiGuest 2017-08-08 - 01:16
2021445 TWikiGuest 2017-08-08 - 01:16
2021436 TWikiGuest 2017-08-08 - 01:16
2021312 TWikiGuest 2017-08-08 - 01:16
2021216 TWikiGuest 2017-08-08 - 01:15
2021076 TWikiGuest 2017-08-08 - 01:15
2020973 TWikiGuest 2017-08-08 - 01:15
2020908 TWikiGuest 2017-08-08 - 01:15
2020876 TWikiGuest 2017-08-08 - 01:15
2020838 TWikiGuest 2017-08-08 - 01:15
2020834 TWikiGuest 2017-08-08 - 01:15
2020757 TWikiGuest 2017-08-08 - 01:15
2020569 TWikiGuest 2017-08-08 - 01:15
2020500 TWikiGuest 2017-08-08 - 01:15
2020421 TWikiGuest 2017-08-08 - 01:14
2019823 TWikiGuest 2017-08-08 - 01:14
2019822 TWikiGuest 2017-08-08 - 01:14
2019420 TWikiGuest 2017-08-08 - 01:13
2019327 TWikiGuest 2017-08-08 - 01:13
2019165 TWikiGuest 2017-08-08 - 01:13
2019103 TWikiGuest 2017-08-08 - 01:13
2018982 TWikiGuest 2017-08-08 - 01:13
2018743 TWikiGuest 2017-08-08 - 01:12
2018744 TWikiGuest 2017-08-08 - 01:12
2018572 TWikiGuest 2017-08-08 - 01:12
2018479 TWikiGuest 2017-08-08 - 01:12
2018464 TWikiGuest 2017-08-08 - 01:12
2018241 TWikiGuest 2017-08-08 - 01:12
2018036 TWikiGuest 2017-08-08 - 01:12
2017504 TWikiGuest 2017-08-08 - 01:11
2016854 TWikiGuest 2017-08-08 - 01:10
2016855 TWikiGuest 2017-08-08 - 01:10
2016784 TWikiGuest 2017-08-08 - 01:10
2016775 TWikiGuest 2017-08-08 - 01:10
2016774 TWikiGuest 2017-08-08 - 01:10
2016538 TWikiGuest 2017-08-08 - 01:10
2016480 TWikiGuest 2017-08-08 - 01:10
2016275 TWikiGuest 2017-08-08 - 01:09
2016188 TWikiGuest 2017-08-08 - 01:09
2016021 TWikiGuest 2017-08-08 - 01:09
2015852 TWikiGuest 2017-08-08 - 01:09
2015589 TWikiGuest 2017-08-08 - 01:09
2015588 TWikiGuest 2017-08-08 - 01:09
2015380 TWikiGuest 2017-08-08 - 01:08
2015320 TWikiGuest 2017-08-08 - 01:08
2015180 TWikiGuest 2017-08-08 - 01:08
2015120 TWikiGuest 2017-08-08 - 01:08
2014968 TWikiGuest 2017-08-08 - 01:08
2014819 TWikiGuest 2017-08-08 - 01:08
2014567 TWikiGuest 2017-08-08 - 01:07
2014520 TWikiGuest 2017-08-08 - 01:07
2014519 TWikiGuest 2017-08-08 - 01:07
2014465 TWikiGuest 2017-08-08 - 01:07
2014464 TWikiGuest 2017-08-08 - 01:07
2014353 TWikiGuest 2017-08-08 - 01:07
2014313 TWikiGuest 2017-08-08 - 01:07
2014314 TWikiGuest 2017-08-08 - 01:07
2014230 TWikiGuest 2017-08-08 - 01:07
2014019 TWikiGuest 2017-08-08 - 01:07
2013962 TWikiGuest 2017-08-08 - 01:07
2013442 TWikiGuest 2017-08-08 - 01:06
2013441 TWikiGuest 2017-08-08 - 01:06
2013437 TWikiGuest 2017-08-08 - 01:06
2013414 TWikiGuest 2017-08-08 - 01:06
2013037 TWikiGuest 2017-08-08 - 01:06
2013036 TWikiGuest 2017-08-08 - 01:06
2012816 TWikiGuest 2017-08-08 - 01:06
2012780 TWikiGuest 2017-08-08 - 01:05
2012777 TWikiGuest 2017-08-08 - 01:05
2012765 TWikiGuest 2017-08-08 - 01:05
2012766 TWikiGuest 2017-08-08 - 01:05
2012763 TWikiGuest 2017-08-08 - 01:05
2012767 TWikiGuest 2017-08-08 - 01:05
2012764 TWikiGuest 2017-08-08 - 01:05
2012768 TWikiGuest 2017-08-08 - 01:05
2012684 TWikiGuest 2017-08-08 - 01:05
2012634 TWikiGuest 2017-08-08 - 01:05
2012633 TWikiGuest 2017-08-08 - 01:05
2012591 TWikiGuest 2017-08-08 - 01:05
2012524 TWikiGuest 2017-08-08 - 01:05
2012523 TWikiGuest 2017-08-08 - 01:05
2012292 TWikiGuest 2017-08-08 - 01:05
2012291 TWikiGuest 2017-08-08 - 01:05
2012195 TWikiGuest 2017-08-08 - 01:05
2011803 TWikiGuest 2017-08-08 - 01:04
2010463 TWikiGuest 2017-08-08 - 01:03
2009988 TWikiGuest 2017-08-08 - 01:03
2009909 TWikiGuest 2017-08-08 - 01:03
2009581 TWikiGuest 2017-08-08 - 01:02
2009033 TWikiGuest 2017-08-08 - 01:02
2009034 TWikiGuest 2017-08-08 - 01:02
2009035 TWikiGuest 2017-08-08 - 01:02
2008575 TWikiGuest 2017-08-08 - 01:01
2008367 TWikiGuest 2017-08-08 - 01:01
2007671 TWikiGuest 2017-08-08 - 01:00
2003184 TWikiGuest 2017-08-08 - 00:56
2003185 TWikiGuest 2017-08-08 - 00:56
2003186 TWikiGuest 2017-08-08 - 00:56
2001685 TWikiGuest 2017-08-08 - 00:55
2001684 TWikiGuest 2017-08-08 - 00:55
2001683 TWikiGuest 2017-08-08 - 00:55
2001047 TWikiGuest 2017-08-08 - 00:55
2000424 TWikiGuest 2017-08-08 - 00:55
2000425 TWikiGuest 2017-08-08 - 00:55
2000426 TWikiGuest 2017-08-08 - 00:55
2000423 TWikiGuest 2017-08-08 - 00:55
2011341 DarienH 2017-04-10 - 17:16
2000419 SergeyKrech 2017-03-20 - 07:14
2019714 DarienH 2017-02-03 - 17:32
2018959 DarienH 2017-02-01 - 16:40
2010875 MaksymParpaley 2017-01-27 - 10:55
2013224 TravisGreen 2016-12-29 - 15:54
2013352 FrancisTrudeau 2016-04-15 - 19:24
2008438 DarienH 2014-04-14 - 14:37
2017584 JayBee 2014-02-25 - 00:04
2001046 NlKiw 2011-01-10 - 01:08
2011459 TWikiGuest 2010-09-11 - 03:36
2010504 FrankEargle 2010-01-04 - 12:52
2009523 DarrenSpruell 2009-10-30 - 22:05
2007594 MattJonkman 2009-03-31 - 04:17
2009006 TWikiGuest 2009-02-07 - 02:39
Scalability VictorJulien 2008-12-09 - 08:19
2008576 MikeWazowski 2008-09-21 - 11:36
WinPEHeaders MattJonkman 2008-07-11 - 15:05
DropperWin32VBcn MattJonkman 2008-07-11 - 15:03
2001694 TWikiGuest 2008-01-08 - 22:35
2001693 TWikiGuest 2008-01-08 - 22:35
2006385 MattJonkman 2007-07-09 - 04:14
SnortSamREADMEnetscreen MattJonkman 2007-03-09 - 14:32
SnortSamFAQ MattJonkman 2007-03-09 - 14:12

-- MattJonkman - 25 Apr 2007

Topic revision: r2 - 2008-07-11 - MattJonkman
 
This site is powered by the TWiki collaboration platform Powered by Perl This site is powered by the TWiki collaboration platformCopyright © Emerging Threats