3

While checking the PE header of DLLs and EXE(s) by PEviewer, I found something called "magic number".

After googling "magic number". I found that it is used to determine the file type. My question is how can a malware analysist benefits from this magic number ? And why is it in the PE header ?

5

A magic number is a set of bytes used when accessing a file to determine its type. For example, the standard Microsoft PE begins with (in ASCII) MZ, the initials of one of the developers of MS-DOS.

The initial headers in a portable executable specify a variety of information regarding the file, ranging from the supported platform, number of symbols, number of sections, time stamps, etc. As such, it is a logical location to store the magic number, as it is also part of the file metadata.

How can a malware analyst benefit from this magic number?

The only information the magic number provides is the file type, and as such that is all that can be garnered by a malware analyst, or any type of analysis. Although one can refer to the file extension to check a file type, they can be changed without affecting the contents of the file. As such, checking the magic number is a method to determine the true file type. Discrepancies would then indicate potential malicious behavior or attempts to hide data.

  • Could you provide me with the magic number of other populer file type of malware – Ahmed Aug 3 '14 at 12:57
  • 1
    @Ahmed: Wikipedia has a list of many: en.wikipedia.org/wiki/List_of_file_signatures. – JamalS Aug 3 '14 at 13:15
  • 2
    @Ahmed: you got it the wrong way around. Malware doesn't have a "magic number". Their containers do. Malware can be hidden inside executables, but also in PDFs, JPEGs, and even DOS batch files. – usr2564301 Aug 3 '14 at 13:54
  • 1
    @Ahmed: Yes, don't confuse file types with malware. The file types serve as a way of storing malicious code. – JamalS Aug 3 '14 at 15:02

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.