How can I check if a file is a valid PE file? What programs I should use for such a check? Can I use PEiD or DiE tool to check it? Also, do I need to unpack the sample prior to checking?
1 Answer
The ultimate judge is the particular operating system (more precisely, its loader), i.e. the validity of PE header is always necessary to consider in this context (as wrote the 0xC0000022L in his comment). If the loader loads and launch an executable, its PE header is (from its point of view) valid, even if some fields are empty or don't correspond to the documentation.
One loader may ignore some fields (e.g. a checksum) or even adjust an incorrect value(s), the other simply refuses to load the same PE file.
So your best testing tool is the operating system itself (but not for malware, of course ;-)).
.exefile samples (many of which are PE) and you will notice that some will be considered valid even by modern Windows, while others won't (but were in older Windows versions). That is: as it stands your question is far too vague to answer meaningfully. Please edit your question and add some context.