PE File Triage Cheat Sheet

What it is

Every Windows executable, DLL, driver, screen saver and Control Panel item uses the Portable Executable (PE) format. Execution artifacts (Prefetch, Amcache, ShimCache) tell you a path ran or existed; the PE file itself tells you what it is. Static triage of the header, imports, resources and signature answers most first questions without running the sample: is it a renamed legitimate tool, a signed vendor binary, or a packed unknown?

Location

Where	Why
Paths listed by Prefetch, Amcache, ShimCache, BAM, services, tasks and Run keys	Binaries that ran or persist
`\Users\<user>\AppData\`, `\Users\Public\`, `\ProgramData\`, `\Windows\Temp\`	Common attacker staging folders
Recycle Bin, carved unallocated space, shadow copies	Deleted binaries
Memory images and crash dumps	Unpacked or fileless modules
Defender quarantine	Detected samples (encrypted in the quarantine store)

What it proves

Identity: hashes identify the exact file; imphash and Rich-header hashes cluster related builds of the same malware or tool family.
Origin: version information, Authenticode signature, certificate signer and PDB path show who built or signed it.
Renaming: OriginalFilename / InternalName in the version resource that differ from the on-disk name reveal renamed tools (for example svchost.exe that is really rclone.exe).
Capabilities: imports, strings and rules (capa, YARA) indicate what the code can do (network, injection, credential access).
It does not prove execution; that comes from execution artifacts.

Key fields

Field	Meaning
MD5 / SHA-1 / SHA-256	File hashes; Amcache stores SHA-1 (of the first 30 MB)
Imphash	Hash of the ordered import table; similar for builds from the same source
Rich header	Undocumented Microsoft linker metadata (tool versions); its hash clusters builds
`TimeDateStamp` (COFF header)	Link time, seconds since 1970 UTC
Sections (`.text`, `.rdata`, `.rsrc`…)	Names, sizes and entropy; entropy near 8 or names like `UPX0` suggest packing
Imports / exports	APIs used; DLL export names
Version info	`CompanyName`, `FileDescription`, `OriginalFilename`, `ProductVersion`
Authenticode	Embedded signature, signer and timestamp; Windows components are often catalog-signed instead
Debug directory	PDB path such as `C:\Users\dev\source\repos\loader\Release\loader.pdb`
Overlay	Data appended after the last section (installers, embedded payloads)

Timestamps

Timestamp	Set when	Format	Pitfalls
`TimeDateStamp`	Linking	UNIX time, UTC	Trivially forged; reproducible builds (many Windows 10/11 system files) store a hash, not a date; some compilers use fixed values
Signature timestamp (countersignature)	Signing	UTC from the timestamping authority	Much harder to forge; dates the signing, not the build
File system times ($SI / $FN)	File creation on this system	NTFS, UTC	Describe the copy on disk, see timestomping

Retention and clearing

Attackers delete tools after use; recover them from the Recycle Bin, shadow copies, unallocated space, memory or EDR/antivirus quarantine.
If only the hash survives (Amcache), search it in threat-intelligence sources and across the fleet.

Collection

KAPE: no target collects arbitrary binaries by default; add the paths you found with a custom target or copy them with a raw-access tool.
Velociraptor (Windows.Triage.Targets): PrefetchBinaries collects the binaries referenced by Prefetch files; Windows.Search.FileFinder and Windows.Detection.BinaryHunter locate others.
Built-in:

Get-FileHash C:\Users\Public\svc.exe -Algorithm SHA256
Get-AuthenticodeSignature C:\Users\Public\svc.exe
(Get-Item C:\Users\Public\svc.exe).VersionInfo | Format-List *

Handle samples in a controlled environment and never execute them on the evidence system.

Parsing tools

sigcheck (Sysinternals): sigcheck -a -h -i file.exe shows version info, hashes and signature, including catalog signatures.
PEStudio (free edition): flags suspicious imports, strings, resources and indicators.
pefile (Python, open source): scripted access to headers, sections, imports, Rich header and imphash.
Detect It Easy: compiler, packer and installer identification.
capa (Mandiant, open source): maps code features to capabilities and ATT&CK techniques.
YARA: match against rule sets for known families and tools.

Investigation tips

Start with the hash and the signature: a validly signed vendor binary in an odd path is often a LOLBin or DLL side-loading setup, so check the DLLs next to it.
Compare the on-disk name with OriginalFilename; renamed remote-access and exfiltration tools are common.
A PDB path or unusual Rich header can link a sample to other incidents.
Treat TimeDateStamp as a hint, never as proof of when the attacker built or deployed the file.
Correlate the binary's SHA-1 with Amcache on other hosts to scope the incident, and check Defender detections for the same path.

PE files (Windows executables)

Tools