How can these pe attributes be used to identify malware.

I was going though a paper link at page 10 he mentioned.

"BYTES_REVERSED_HI and BYTES_REVERSED_LO both make ideal candidates as a primary indicator due to the significant detection rate with a low false positive rate"

  • Please share your hypothesis and reasoning, as well as the relevant research you have done.
    – julian
    Mar 5, 2019 at 10:32
  • 1
    let me google this for you docs.microsoft.com/en-us/windows/desktop/debug/pe-format
    – blabb
    Mar 5, 2019 at 10:47
  • Can you help with why does some malware has this flag set? Mar 5, 2019 at 10:52
  • that paper describes a statistical analysis of differences between two sets of binaries the flags are set by linker and i don't think a define or switch exist to set them while compiling so i am not sure about the reasoning behind that assertion
    – blabb
    Mar 5, 2019 at 11:48
  • I don't understand the hostility in the responses here. Mar 5, 2019 at 16:00

1 Answer 1


I actually think this is a good and valid question.

And I think the answer here is - it is because it is. What I mean is that they analyzed a bunch of samples, separated them into malicious/benign, and then found out that when these flags are set it's almost always malware, so it makes a good indicator because they observed it to be a good one.

I can't think of a logical reason. It's probably a field nobody sets on purpose in legit software. Maybe some packers or whatever sets the field in order to alter the files' checksum? Google says those flags are obsolete so setting them should not have any effect at all, but it would change a file's checksum.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.