🔴 Portable Executable Files: Analyzing In-Memory versus On Disk

Portable Executable files will have different characteristics, depending on whether they are loaded into memory for execution, or residing on disk. In this session, we'll take a look at some of those key differences and how they affect your analysis. We'll explore section alignment, discuss the entry point and wrap things up by looking at dumping PE files from memory, a common task when unpacking malware. Please note, this session is a continuation of a series exploring the PE file, and you can check out the first video title "Getting Started Analyzing the Portable Executable (PE) File Format" on my YouTube channel.