pe-analysis

Activate this skill whenever the user mentions PE analysis, PE file, PE header, portable executable, Windows executable analysis, EXE analysis, DLL analysis, SYS driver analysis, OCX analysis, PE structure, PE format, PE parsing, PE triage, PE inspection, binary headers, file headers, DOS header, MZ header, COFF header, optional header, PE signature, image base, entry point, AddressOfEntryPoint, section table, section headers, section entropy, section permissions, .text section, .rdata section, .rsrc section, .reloc section, .data section, UPX section, import table, IAT, import address table, import directory, DLL imports, suspicious imports, API hashing, GetProcAddress hashing, delayed imports, bound imports, export table, EAT, export address table, DLL exports, forwarded exports, ordinal exports, resource table, resource directory, embedded resources, PE resources, resource extraction, version info, file version, manifest, embedded manifest, icon extraction, overlay data, appended data, PE overlay, data after last section, PE anomalies, header anomalies, suspicious PE, malformed PE, corrupted PE, timestamp analysis, compile time, TimeDateStamp, checksum validation, PE checksum, rich header, Rich signature, linker info, compiler detection, debug directory, PDB path, debug info, CodeView, authenticode, digital signature, signed binary, certificate validation, TLS callbacks, TLS directory, thread local storage, data directories, CLR header, .NET PE, COM descriptor, pefile, pestudio, PE-bear, CFF Explorer, dumpbin, objdump, readpe, packed binary detection, packer identification, UPX detection, section padding, security features check, ASLR, DEP, NX, CFG, SafeSEH, guard flags, PE file triage, unknown binary triage, suspicious binary, malware triage, binary classification, executable classification, initial binary assessment.