Can corrupted PE files be executed in some versions of Windows but not others?

Question

I'm doing some research on corrupted PE files and I wanted to hear your thoughts and experiences with them. I've been processing a ton of samples which are essentially corrupted Windows Portable Executable files. They will not run on XP or Windows 7 and they won't run on 32 bit or 64 bit. If I open them in a hex editor, it's very clear that they are missing entire header data structures, the MZ and surrounding data is missing or altered, etc... When I attempt to execute these .exe files, I get errors along the lines of "This is not a valid Windows executable" and/or "This executable cannot be run on this system, it may be designed for 64 bit and you are on a 32 bit or vice versa." Not verbatim but that's the general idea. Basically, I cannot get these to run or operate at all. So the question is, why do they exist? Are they files which could possibly come packaged with other files that when run, repair these files before loading them into memory as a sort of "obfuscated library file?" I feel like this is an unlikely scenario.

Another possibility is, perhaps these files are made for a much older version of Windows? I've done some deep study of the PE file format though and am not aware of any previous PE format with altered headers, etc..

EXAMPLE: See first a regular PE file that runs fine:

Now see the above compared with a specimen file:

Finally, I was able to locate "PE" much further down then normal, amongst a bunch of binary data:

This is all just one example but this is the kind of thing I'm talking about.

Answer 1

The PE format is actually backwards compatible with the old DOS EXE format (also called MZ-exe). That's why it has to start with the MZ signature. It's perfectly possible to have executables which have a complete DOS executable in the compatibility part (also called "stub") and Win32 one in the PE part (e.g. Windows 95 reg.exe was one such - it could run both in Windows and in DOS). The offset to the PE header, by the standard, is the dword value at offset 0x3C in the file. in your screenshot the value seems to be 0x9C0000. if there is no PE signature at 0x9C0000 (or it's outside of the file), it means the file is not a PE, but either some other kind of MZ extension format (e.g. NE for Win16 or OS/2) or simply a plain DOS file. You can try running it in DOSBox or another DOS environment, or use a disassembler which handles DOS-MZ (e.g. IDA)

Answer 2

These are probably either files corrupted during their copy over the network or storage (this does happen rarely). They may be files built for certain versions of Windows and therefore inoperable with newer versions.

Window's PE loader change between major windows versions, and such documented and undocumented limitations might apply to executing a PE file, especially if the PE has some format edge cases, which might be the case if done intentionally.

Depending on the source, for example, different hypotheses might arise: for example, the malware industry has multiple feed providers and some of them tend to label corrupt PE files as malware, or extract PE resources from different places (an exploit pack, a dropper) with those corruptions. It might be that the PE was damaged in memory and a dropper was about to fix and drop, but some kind of automatic unpacking environment dumped the corrupt PE from memory before the dropper had the chance to fix that.

This is a broad question, and without any specifics it's hard to tell why those PE files you're analyzing are corrupt, why they exist and if they can be fixed (or if you'll want them fixed)