3

While checking the PE header of DLLs and EXE(s) by PEviewer, I found something called "magic number".

After googling "magic number". I found that it is used to determine the file type. My question is how can a malware analysist benefits from this magic number ? And why is it in the PE header ?

1 Answer 1

5

A magic number is a set of bytes used when accessing a file to determine its type. For example, the standard Microsoft PE begins with (in ASCII) MZ, the initials of one of the developers of MS-DOS.

The initial headers in a portable executable specify a variety of information regarding the file, ranging from the supported platform, number of symbols, number of sections, time stamps, etc. As such, it is a logical location to store the magic number, as it is also part of the file metadata.

How can a malware analyst benefit from this magic number?

The only information the magic number provides is the file type, and as such that is all that can be garnered by a malware analyst, or any type of analysis. Although one can refer to the file extension to check a file type, they can be changed without affecting the contents of the file. As such, checking the magic number is a method to determine the true file type. Discrepancies would then indicate potential malicious behavior or attempts to hide data.

4
  • Could you provide me with the magic number of other populer file type of malware
    – Ahmed
    Aug 3, 2014 at 12:57
  • 1
    @Ahmed: Wikipedia has a list of many: en.wikipedia.org/wiki/List_of_file_signatures.
    – JamalS
    Aug 3, 2014 at 13:15
  • 2
    @Ahmed: you got it the wrong way around. Malware doesn't have a "magic number". Their containers do. Malware can be hidden inside executables, but also in PDFs, JPEGs, and even DOS batch files.
    – Jongware
    Aug 3, 2014 at 13:54
  • 1
    @Ahmed: Yes, don't confuse file types with malware. The file types serve as a way of storing malicious code.
    – JamalS
    Aug 3, 2014 at 15:02

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge that you have read and understand our privacy policy and code of conduct.

Not the answer you're looking for? Browse other questions tagged or ask your own question.