Glossary
Optional header
The PE header that tells the Windows loader how to map and start the image: PE32 or PE32+, entry point, image base, subsystem, checksum, flags and data directories.
Despite its name, the optional header is required for executables. Its magic value says whether the file is PE32 (0x10b) or PE32+ (0x20b). It holds AddressOfEntryPoint, ImageBase, section and file alignment, SizeOfImage, the CheckSum, the Subsystem (GUI, console, native driver, EFI) and DllCharacteristics — the flags that request ASLR (DYNAMIC_BASE), DEP (NX_COMPAT) and Control Flow Guard (GUARD_CF).
It ends with 16 data directories (address and size of the import, export, resource, certificate, debug, TLS, load-config, .NET and other tables). In forensic triage, missing mitigations and a stale checksum are common "worth a look" signs; see the PE format guide.