PE Header Parser & EXE Section Inspector

Parse Windows PE32/PE32+ executable headers, section tables (.text, .data, .rsrc), import/export directory tables, and compile timestamps in your browser.

How to Use PE Header Parser & EXE Section Inspector

  1. Upload Windows Executable: Select a PE binary (.exe, .dll, .sys) for static forensic inspection.
  2. Parse Headers & Data Directories: Inspect the DOS header (MZ magic), COFF file header, optional header, and section headers.
  3. Evaluate Section Entropy & Imports: Analyze suspicious imported API calls (e.g. VirtualAlloc, WriteProcessMemory) and section entropy indicating packers.

Frequently Asked Questions

What is a PE (Portable Executable) file?

PE is the standard binary format used by Windows for executables, DLLs, and kernel drivers, defining headers, sections, and dynamic import tables.

How does high section entropy indicate packed malware?

Standard compiled code has an entropy of ~6.0. An entropy score above 7.0 strongly indicates encrypted, compressed, or packed malware designed to evade antivirus signatures.