Dissecting PE Headers

Prompts and answers

• What data type are the PE headers?
  STRUCT
• How many bytes are present in the IMAGE_DOS_HEADER?
  64
• What does MZ stand for?
  Mark Zbikowski
• In what variable of the IMAGE_DOS_HEADER is the address of IMAGE_NT_HEADERS saved?
  e_lfanew
• In the attached VM, open the PE file Desktop/Samples/zmsuz3pinwl in pe-tree. What is the address of IMAGE_NT_HEADERS for this PE file?
  0x000000f8
• In the attached VM, there is a file Desktop\Samples\zmsuz3pinwl. Open this file in pe-tree. Is this PE file compiled for a 32-bit machine or a 64-bit machine?
  32-bit machine
• What is the TimeDateStamp of this file?
  0x62289d45 Wed Mar 9 12:27:49 2022 UTC
• Which variable from the OPTIONAL_HEADER indicates whether the file is a 32-bit or a 64-bit application?
  Magic
• What Magic value indicates that the file is a 64-bit application?
  0x020B
• What is the subsystem of the file Desktop\Samples\zmsuz3pinwl?
  0x0003 WINDOWS_CUI
• How many sections does the file Desktop\Samples\zmsuz3pinwl have?
  7
• What are the characteristics of the .rsrc section of the file Desktop\Samples\zmsuz3pinwl
  0xe0000040 INITIALIZED_DATA | EXECUTE | READ | WRITE
• The PE file Desktop\Samples\redline imports the function CreateWindowExW. From which dll file does it import this function?
  User32.dll
• Which of the files in the attached VM in the directory Desktop\Samples seems to be a packed executable?
  zmsuz3pinwl