Why does PE ImageBase address change in memory?

Question

I'm reversing a malicious 32-bit x86 Windows executable. Statically reviewing PE headers in Ghidra, I see that ImageBase is set to 0x400000 as expected. However, when the binary is loaded into memory, the initial RVA does not match the ImageBase defined in the file. For example, I have seen the in-memory base address set to 0x4B0000 and 0x900000. This behavior occurs on a clean VM, and when debugging with Immunity and x32dbg as well as IDA Free.

My understanding is that the Windows loader reads ImageBase and uses that offset to begin mapping sections into virtual address space. Because system code handles loading, and my system is clean upon first execution, my assumption is that the unusual ImageBase is a symptom of a loader nuance rather than tampering. I've never encountered this scenario and would appreciate any insights.

MD5: 1f63d04ee95ea041f2f6b1e818d94a7c

SHA1: 823ad6abb05f2393c44cf4b7f1d00e32ac04d1d1

---

ImageBase set to 0x400000 when viewing PE headers in Ghidra:

---

ImageBase in memory-mapped PE header (0x4B0000) does not match ImageBase set in static file:

---

PE sections mapped into memory with ImageBase at 0x4B0000

Answer 1

This is just a preferred address. Windows can load the binary at almost any address and rebase it to this new location.

ImageBase: The preferred address of the first byte of image when loaded into memory; must be a multiple of 64 K. The default for DLLs is 0x10000000. The default for Windows CE EXEs is 0x00010000. The default for Windows NT, Windows 2000, Windows XP, Windows 95, Windows 98, and Windows Me is 0x00400000.

Source: MSDN