Now, as we have covered PE header, dynamic link libraries, and APIs, the question that arises is How can we use this information in our static analysis? This totally depends on the questions that you want to answer, and that is what we will cover right now.
Using PE header information for static analysis
How to use PE header for incident handling
If an incident occurs, static analysis of the PE header can help you answer multiple questions in your report. Here are the questions and how a PE header can help you answer them:
- Is this malware packed?
PE header can help you to identify if this malware is packed. Packers tend to change sections names from the familiar names(.text, .data, and .rsrc) to other names, such as UPX1 or...
