PE header analysis tools

After we have understood the PE format, we need to be able to parse different PE files (for example, .exe files) and read their header values. Luckily, we don't have to do this ourselves; there are lots of different tools that can help us read PE header information easily. The most well-known free tools to analyze a PE file header are as follows:

• PEiD:

Figure 5: PEiD UI

This is probably the most well-known tool for analyzing PE headers. It's a basic tool but it has the ability to detect the compiler (Visual Studio for example) or detect the packer that is used to pack this malware using static signatures stored within the application (this will be covered in more details in Chapter 3, Unpacking, Decryption, and Deobfuscation).

• CFF Explorer:

Figure 6: CFF Explorer UI

Most screenshots in this book depict the UI or output and are thus for reference purposes only; the text within them need not be referred to.

This is relatively a new and more advanced...