Windows PE Headers

This page covers all of our Windows PE Header signatures. Jonathan Gross has done a good deal of work here, as have others. We're trying to mature these signatures, so please give feedback on how they perform on your network.

Some of these signatures are intended to detect just a PE header, which may well be a legitimate executable in transit. Others are intended to detect executables packed with known malicious packers, or in streams where they were purported to be something else (such as an image in an http stream).

Attached are some reference materials on structure and format.

PE HEader Related:

2003615 TWikiGuest 2012-09-05 - 04:42
2003614 TWikiGuest 2012-09-05 - 04:42
2010282 TWikiGuest 2012-03-16 - 21:37
WinPEHeaders MattJonkman 2008-07-11 - 15:05

Signatures looking for MZ:

2000419 SergeyKrech 2017-03-20 - 07:14
2024040 TWikiGuest 2017-03-09 - 22:00
2011341 FrancisTrudeau 2017-02-28 - 23:16
2023971 TWikiGuest 2017-02-17 - 22:23
2023947 TWikiGuest 2017-02-16 - 22:05
2023928 TWikiGuest 2017-02-16 - 22:05
2019714 DarienH 2017-02-03 - 17:32
2018959 DarienH 2017-02-01 - 16:40
2010875 MaksymParpaley 2017-01-27 - 10:55
2023750 TWikiGuest 2017-01-19 - 23:06
2020757 TWikiGuest 2017-01-19 - 23:06
2023711 TWikiGuest 2017-01-09 - 22:55
2023679 TWikiGuest 2017-01-09 - 22:55
2013224 TravisGreen 2016-12-29 - 15:54
2023672 TWikiGuest 2016-12-23 - 22:56
2023671 TWikiGuest 2016-12-23 - 22:56
2023636 TWikiGuest 2016-12-13 - 22:30
2023567 TWikiGuest 2016-11-30 - 22:19
2023502 TWikiGuest 2016-11-11 - 22:24
2023464 TWikiGuest 2016-10-27 - 22:22
2023316 TWikiGuest 2016-10-18 - 14:39
2023291 TWikiGuest 2016-09-23 - 21:02
2023113 TWikiGuest 2016-08-25 - 20:52
2009897 TWikiGuest 2016-08-09 - 22:48
2009909 TWikiGuest 2016-08-09 - 22:48
2023001 TWikiGuest 2016-08-03 - 01:32
2022958 TWikiGuest 2016-07-13 - 23:53
2022947 TWikiGuest 2016-07-05 - 21:59
2022874 TWikiGuest 2016-06-08 - 21:58
2013352 FrancisTrudeau 2016-04-15 - 19:24
2022653 TWikiGuest 2016-03-25 - 01:17
2019165 TWikiGuest 2016-02-11 - 22:38
2022340 TWikiGuest 2016-01-07 - 02:25
2022050 TWikiGuest 2015-11-26 - 16:07
2022052 TWikiGuest 2015-11-23 - 21:18
2022053 TWikiGuest 2015-11-09 - 23:52
2022051 TWikiGuest 2015-11-09 - 23:52
2021954 TWikiGuest 2015-10-15 - 23:13
2021562 TWikiGuest 2015-08-03 - 22:02
2021445 TWikiGuest 2015-07-21 - 01:08
2019420 TWikiGuest 2015-07-17 - 21:00
2021436 TWikiGuest 2015-07-17 - 21:00
2021312 TWikiGuest 2015-06-19 - 20:26
2021216 TWikiGuest 2015-06-08 - 22:16
2021076 TWikiGuest 2015-05-07 - 23:57
2020973 TWikiGuest 2015-04-23 - 01:24
2020908 TWikiGuest 2015-04-14 - 23:55
2020876 TWikiGuest 2015-04-09 - 01:27
2020838 TWikiGuest 2015-04-03 - 22:58
2020834 TWikiGuest 2015-04-02 - 23:15
2020569 TWikiGuest 2015-02-25 - 20:28
2020500 TWikiGuest 2015-02-23 - 23:33
2020421 TWikiGuest 2015-02-13 - 21:21
2013962 TWikiGuest 2015-01-09 - 01:52
2019823 TWikiGuest 2014-12-01 - 23:30
2019822 TWikiGuest 2014-12-01 - 23:30
2008575 TWikiGuest 2014-10-15 - 19:03
2019327 TWikiGuest 2014-10-01 - 20:51
2019103 TWikiGuest 2014-09-19 - 21:22
2018982 TWikiGuest 2014-09-19 - 21:22
2016480 TWikiGuest 2014-09-19 - 21:22
2016021 TWikiGuest 2014-09-19 - 21:22
2016188 TWikiGuest 2014-09-19 - 21:22
2015852 TWikiGuest 2014-09-10 - 21:09
2010463 TWikiGuest 2014-08-27 - 21:48
2018572 TWikiGuest 2014-06-17 - 00:29
2018464 TWikiGuest 2014-05-28 - 20:58
2018479 TWikiGuest 2014-05-15 - 21:39
2008438 DarienH 2014-04-14 - 14:37
2014353 TWikiGuest 2014-04-03 - 21:50
2018241 TWikiGuest 2014-03-09 - 01:18
2017584 JayBee 2014-02-25 - 00:04
2018036 TWikiGuest 2014-01-31 - 05:53
2016275 TWikiGuest 2014-01-27 - 23:12
2017504 TWikiGuest 2013-09-20 - 22:38
2013441 TWikiGuest 2013-06-12 - 01:40
2016855 TWikiGuest 2013-05-16 - 01:23
2016854 TWikiGuest 2013-05-16 - 01:23
2016784 TWikiGuest 2013-04-26 - 04:16
2016774 TWikiGuest 2013-04-19 - 03:26
2016775 TWikiGuest 2013-04-19 - 03:26
2016538 TWikiGuest 2013-03-07 - 06:16
2012684 TWikiGuest 2013-02-12 - 07:19
2015380 TWikiGuest 2013-01-04 - 06:49
2015180 TWikiGuest 2013-01-04 - 06:49
2014968 TWikiGuest 2012-09-17 - 23:48
2015320 TWikiGuest 2012-08-21 - 21:40
2015120 TWikiGuest 2012-08-21 - 21:40
2015589 TWikiGuest 2012-08-07 - 22:52
2015588 TWikiGuest 2012-08-07 - 22:51
2009034 TWikiGuest 2012-08-07 - 22:51
2013414 TWikiGuest 2012-08-07 - 22:51
2011457 TWikiGuest 2012-08-07 - 22:51
2013037 TWikiGuest 2012-08-07 - 22:51
2012524 TWikiGuest 2012-08-07 - 22:51
2012523 TWikiGuest 2012-08-07 - 22:51
2009035 TWikiGuest 2012-08-07 - 22:51
2014471 TWikiGuest 2012-08-07 - 22:51
2014313 TWikiGuest 2012-08-07 - 22:51
2009028 TWikiGuest 2012-08-07 - 22:51
2007671 TWikiGuest 2012-08-07 - 22:51
2009033 TWikiGuest 2012-08-07 - 22:51
2001047 TWikiGuest 2012-08-07 - 22:51
2001683 TWikiGuest 2012-08-07 - 22:51
2012816 TWikiGuest 2012-07-12 - 23:24
2014819 TWikiGuest 2012-05-30 - 04:23
2014230 TWikiGuest 2012-04-18 - 01:48
2014567 TWikiGuest 2012-04-16 - 22:46
2014520 TWikiGuest 2012-04-06 - 00:07
2014519 TWikiGuest 2012-04-06 - 00:07
2014465 TWikiGuest 2012-04-04 - 21:18
2014464 TWikiGuest 2012-04-04 - 21:18
2014314 TWikiGuest 2012-03-20 - 03:39
2014019 TWikiGuest 2012-03-07 - 23:45
2013442 TWikiGuest 2012-03-07 - 23:45
2013437 TWikiGuest 2012-03-07 - 23:45
2012633 TWikiGuest 2012-03-07 - 23:45
2012634 TWikiGuest 2012-03-07 - 23:45
2012292 TWikiGuest 2012-03-07 - 23:45
2012591 TWikiGuest 2012-03-07 - 23:45
2012291 TWikiGuest 2012-03-07 - 23:45
2012195 TWikiGuest 2012-03-07 - 23:45
2010869 TWikiGuest 2012-03-07 - 23:45
2003184 TWikiGuest 2012-03-07 - 23:44
2001684 TWikiGuest 2012-03-07 - 23:44
2003186 TWikiGuest 2012-03-07 - 23:44
2008367 TWikiGuest 2012-03-07 - 23:44
2001685 TWikiGuest 2012-03-07 - 23:44
2003185 TWikiGuest 2012-03-07 - 23:44
2000424 TWikiGuest 2012-03-07 - 23:44
2000423 TWikiGuest 2012-03-07 - 23:44
2000425 TWikiGuest 2012-03-07 - 23:44
2000427 TWikiGuest 2012-03-07 - 23:44
2013036 TWikiGuest 2011-12-07 - 02:59
2011803 TWikiGuest 2011-10-12 - 23:32
2009988 TWikiGuest 2011-10-12 - 23:28
2009581 TWikiGuest 2011-10-12 - 23:27
2000426 TWikiGuest 2011-10-12 - 23:09
2001046 NlKiw 2011-01-10 - 01:08
2011459 TWikiGuest 2010-09-11 - 03:36
2010504 FrankEargle 2010-01-04 - 12:52
2009523 DarrenSpruell 2009-10-30 - 22:05
2007594 MattJonkman 2009-03-31 - 04:17
2009006 TWikiGuest 2009-02-07 - 02:39
Scalability VictorJulien 2008-12-09 - 08:19
2008576 MikeWazowski 2008-09-21 - 11:36
WinPEHeaders MattJonkman 2008-07-11 - 15:05
DropperWin32VBcn MattJonkman 2008-07-11 - 15:03
2001693 TWikiGuest 2008-01-08 - 22:35
2001694 TWikiGuest 2008-01-08 - 22:35
2006385 MattJonkman 2007-07-09 - 04:14
SnortSamREADMEnetscreen MattJonkman 2007-03-09 - 14:32
SnortSamFAQ MattJonkman 2007-03-09 - 14:12

-- MattJonkman - 25 Apr 2007

Topic revision: r2 - 2008-07-11 - MattJonkman
 
This site is powered by the TWiki collaboration platform Powered by Perl This site is powered by the TWiki collaboration platformCopyright © Emerging Threats