Dissecting the PE file format
In Microsoft Windows, binary files utilize a structured format – the Portable Executable (PE) file format. This format is utilized by the following types of files; though the way the OS interprets and utilizes them is different, they share the same general structure:
- Control Panel Items (CPL)
- Dynamic Link Library (DLL)
- Driver (DRV) files
- Windows Executable (EXE) applications
- Multilingual User Interfaces (MUI)
- Windows Screensaver (SCR) files
- System (SYS) files
- Shortcut (LNK) files
While this list is not exhaustive of all files that utilize the PE file format, for the purposes of this conversation, they are the most common. That is to say that these file formats are the ones most consistently utilized by malicious threat actors.
Analysis tip
Adversaries utilize various different forms of the PE file format, as the end result is usually the same – malicious code execution. However, their choice...
