A magic number is a set of bytes used when accessing a file to determine its type. For example, the standard Microsoft PE begins with (in ASCII) MZ
, the initials of one of the developers of MS-DOS.
The initial headers in a portable executable specify a variety of information regarding the file, ranging from the supported platform, number of symbols, number of sections, time stamps, etc. As such, it is a logical location to store the magic number, as it is also part of the file metadata.
How can a malware analyst benefit from this magic number?
The only information the magic number provides is the file type, and as such that is all that can be garnered by a malware analyst, or any type of analysis. Although one can refer to the file extension to check a file type, they can be changed without affecting the contents of the file. As such, checking the magic number is a method to determine the true file type. Discrepancies would then indicate potential malicious behavior or attempts to hide data.