Diagrams / Malware Analysis

PE Structure Diagram

A Portable Executable map for malware reversing, section parsing, and binary triage.

DOS Header

Starts with "MZ". Legacy support.

DOS Stub

"This program cannot be run in DOS mode."

PE Header

Starts with "PE". Architecture, Timestamp.

Optional Header

Entry Point, Image Base, Subsystem.

Section Table

Headers for .text, .data, etc.

.text Section

Executable Code (Instructions).

.data / .rdata

Global Variables, Imports, Constants.

.rsrc Section

Icons, Images, Strings, Version Info.

.reloc Section

Relocation information for ASLR.