Search code examples
windowsexeportable-executablemalwaredumpbin

Which parts/sections of PE files (.exe .dll) contain most their behaviours?

I’m doing Windows malware research by machine learning method. I read the PE format, using dumpbin to extract PE files and found that there are many parts in there. Eg:.idata .edata .pdata .data .rdata .sxdata .text .rscr .tls... But not all of them are used for actions/behaviours. I just care about their behaviours and to reduce the large data before the next steps. Thanks

Solution

  • Since you are analyzing malware, you shouldn't be looking at the name of the sections. It is not difficult for a malware developer to change the names of the sections, and the msvc compiler also allows you to create custom sections.

    Instead what you should do, is look at the characteristics of the sections. By reading the IMAGE_SECTION_HEADER, you can see whether the section contains executable code, static data, if its writable, etc.