The most important values from this header are as follows:
Figure 2: File header explained
- Machine: This field represents the processor type, for example, the value 0x14c represents Intel 386 or later processors.
- NumberOfSections: This value represents the number of sections that follow the headers, such as the code section, data section or resources section (for files or images).
- TimeDateStamp: This is the exact date and time that this program was compiled. It's very useful for threat intelligence and creating the timeline of the attack.
- Characteristics: This value represents the type of the executable file, is it a program, a dynamic link library (we will cover it later in the chapter), or maybe a driver?
