.exe
Windows executable
A program the Windows loader maps into memory and runs directly. The extension is a convention: what makes it executable is the header, not the name.
at a glance
- container
- PE
- executes
- the loader runs it
- elevation
- sometimes
- install scope
- either
- inventory
- partially enumerated
Knowing it is really that
The extension is a property of the directory entry, not of the file. What identifies the format is what is in the bytes.
| offset | bytes |
|---|---|
| 0 | 4D 5A |
| 60 | → PE\0\0 |
MZ. The DOS stub, kept for forty years of compatibility. Shared with every PE, so it identifies the container, not the type.
The value at 0x3C is the offset to the real header. Reading it is what separates a PE from anything else starting MZ.
What is actually inside
A DOS stub, a COFF header, an optional header that is not optional, and a section table. Sections carry code, data, resources and relocations, each with its own memory permissions. The import table names the libraries and functions the loader must resolve before the first instruction runs; the export table names what this file offers others. Anything appended past the last section is overlay, and belongs to no section at all.
What reading it tells you
- the declared architecture, subsystem and whether it is a console, GUI or driver image
- every DLL and function it imports, which is the closest thing to a statement of intent the file makes
- the compile timestamp and, where present, the version resource: company, product, original filename
- per-section entropy and permissions, which is how packed and self-modifying code announces itself structurally
- whether it requests elevation, from the embedded manifest, before it is run
What it does not tell you
The useful half, and the half a file-type reference usually leaves out.
- what it does at runtime. Imports are resolved before execution, but code can load libraries dynamically by name at any point afterwards, and nothing in the header records that
- whether the version resource is true. CompanyName and ProductName are strings typed by whoever built it, present in unsigned files, and copied verbatim by anything imitating a known product
- what is in the overlay. Appended data sits outside every section, is not mapped into memory by the loader, and is used by legitimate installers and by anything that wants to carry a payload past a size check
- whether it is the product it claims to be. Every identifying string in the file is authored, and a copy with a different name is byte-identical in every respect that matters to the loader
- what it does when it is not being watched. Behaviour can branch on the machine, the user, the date, or whether an analysis environment appears to be present
Why it turns up on an endpoint
Everything ends up as one. Applications, installers, updaters, and the small helper binaries that ship alongside them. It is also the format most often found somewhere an inventory does not look: a user profile, a temp directory, inside an archive that was extracted once and never cleaned up.