Windows PE Executable
| Format | Windows PE Executable |
|---|---|
| Short name | PE |
| Category | execution |
| Platforms | Windows |
| Crush support | Not yet supported |
| Status | Reviewed |
| Last reviewed | 2026-10-04 |
Forensic relevance
The Portable Executable format of Windows programs and libraries (.exe, .dll, .sys). An MS-DOS stub points to the PE header with the target machine, a link timestamp, section table, imports and exports; resources hold version information (company, product, original file name) and icons. The link timestamp is not always a date: reproducibly built binaries (including Windows 10+ system files) store a hash there, and 0 or 0xFFFFFFFF mean no timestamp. An undocumented Rich header lists the compiler and linker versions used. An Authenticode signature, if present, names the signer. Relevant for malware analysis and for linking a binary to its origin.
Signatures
| Offset | Hex | ASCII (non-printable as .) | Description |
|---|---|---|---|
| offset 0 (0x0) | 4D 5A | MZ | MS-DOS header 'MZ' (the PE header follows at e_lfanew) |
| offset unknown | 50 45 00 00 | PE.. | PE signature at the file offset stored in e_lfanew (0x3C) |
Known extensions
.exe, .dll, .sys, .scr, .cpl
References
- PE Format (Microsoft) https://learn.microsoft.com/en-us/windows/win32/debug/pe-format
- MZ, PE-COFF executable file format (libyal/libexe) https://github.com/libyal/libexe/blob/main/documentation/Executable%20(EXE)%20file%20format.asciidoc
- Why are the module timestamps in Windows 10 so nonsensical? (Raymond Chen, The Old New Thing) https://devblogs.microsoft.com/oldnewthing/20180103-00/?p=97705
Cite this entry
Crush Format Reference, “Windows PE Executable”. https://kalink0.github.io/crush-forensics/formats/pe/ — source: crush/data/build_formats_db.py at commit 640a2a9928f4e36a976b89901512a8dce824d093, built 2026-10-21 06:46:19 UTC.
Entry in the source at this commit · Change history of the source · Report a correction