Posts tagged: #pe-format

Step-by-step static triage of Windows executables with the free PE Parser: load files or a ZIP, read indicators, compare builds and export results.

Where a Windows executable stores its times, which ones can be trusted, how reproducible builds and timestomping show up, and how to use them.

How Authenticode signs a PE file, which checks can be done from the file alone, and why a valid signature is not the same as a trusted one.

What matters in a Windows PE file when you triage a suspicious EXE, DLL or driver: headers, sections, imports, resources, signature and overlay.