The PE header contains useful information for the malware analyst

Imports Functions from other libraries that are used by the malware
Exports Functions in the malware that are meant to be called by other programs
or libraries
Time Date Stamp Time when the program was compiled
Sections Names of sections in the file and their sizes on disk and in memory
Subsystem Indicates whether the program is a command-line or GUI application
Resources Strings, icons, menus, and other information included in the file

свернуть