In this chapter, we have covered the PE structure of Windows' executable files. We have covered the PE header field by field and examined its importance for static analysis, finishing with the main questions for incident handling and threat intelligence that the PE header of this sample can help us to answer.
We also covered the dynamic link libraries and how PE files that reside together in the same virtual memory are able to communicate and share code and functions through what are called APIs. And we covered how import and export tables work.
We also covered the dynamic analysis from the basic foundation, such as what a process is and what a thread is with step-by-step guidance on how Windows creates a process and loads a PE file, from your double-click on an application in Windows Explorer until the program is running in front of you.
And, last but not least, we...
