If an incident occurs, static analysis of the PE header can help you answer multiple questions in your report. Here are the questions and how a PE header can help you answer them:
- Is this malware packed?
PE header can help you to identify if this malware is packed. Packers tend to change sections names from the familiar names (.text, .data, and .rsrc) to other names, such as UPX1 or others.
Also, they hide most of the APIs otherwise expected to be present in the import table. So, you will see the import table contains very few APIs, and that could be another sign as well. We will cover unpacking in detail in Chapter 3, Unpacking, Decryption, and Deobfuscation.
- Is this malware a dropper or a downloader?
It's very common to see droppers having an additional PE file inside their resources. Multiple tools such as Resource Hacker can detect this PE file (or, for example, a ZIP file that contains it), and you will be able to find the dropped...