After we have understood the PE format, we need to be able to parse different PE files (for example, .exe files) and read their header values. Luckily, we don't have to do this ourselves; there are lots of different tools that can help us read PE header information easily. The most well-known free tools to analyze a PE file header are as follows:
- PEiD:
This is probably the most well-known tool for analyzing PE headers. It's a basic tool but it has the ability to detect the compiler (Visual Studio for example) or detect the packer that is used to pack this malware using static signatures stored within the application (this will be covered in more details in Chapter 3, Unpacking, Decryption, and Deobfuscation).
- CFF Explorer:
This is relatively a new and more advanced...