Malware › Module 3 › Lesson 3
PE ELF Named
PE (Windows) and ELF (Linux) headers named for static literacy — sections, imports, entry — review on copies, execute only on $MAL_LAB.
Visual · mal_pe_elf_named
PE/ELF named literacy. $MAL_LAB only. Original Cyberlium.
Opening
Headers tell you what the binary expects to load — imports hint capability before sandbox confirms.
PE files have DOS stub, PE signature, optional header, sections (.text,.data,.rdata), and import table listing DLLs/APIs. ELF files have ELF header, program headers, sections (.text,.rodata), and dynamic symbols. Analysts read imports for WinInet, Crypt32, WriteProcessMemory — capability hints mapped to ATT&CK. Cyberlium names PE/ELF structures for static reports on $MAL_LAB samples — not for building malicious binaries. Next: Static Lab.
1. PE structure (Windows literacy)
Key fields: Machine type, NumberOfSections, AddressOfEntryPoint, Import Directory. Suspicious imports: VirtualAlloc, CreateRemoteThread, URLDownloadToFile — context matters in full static+dynamic story.
Tools (peframe, pecheck literacy names) summarize headers on static copies — no execution required.
Command guide
Try these commands — PE structure (Windows literacy)
═══ TOOLS & WEBSITES ═══ Browse / read these (authorized learning only — stay in YOUR lab / program scope)
PE format overview — https://learn.microsoft.com/en-us/windows/win32/debug/pe-format (headers, sections literacy)
Optional command
file magic signatures — https://en.wikipedia.org/wiki/List_of_file_signatures (MZ, ELF literacy)
═══ INSTALL ═══
Linux (Debian/Ubuntu):
Command — copy this
sudo apt install python3
macOS:
Command — copy this
brew install python3
Windows: Use WSL or install file for Windows Download https://python.org/downloads/
═══ LINUX / macOS ═══
Command — copy this
source "$HOME/cyberlium-lab/t22-mal/lab.env" 2>/dev/null || export LAB_MAL=$HOME/cyberlium-lab/t22-mal cat > "$HOME/cyberlium-lab/t22-mal/samples/demo_bin.sh" <<'EOF' #!/bin/sh echo benign lab shell demo EOF
Command — copy this
chmod +x "$HOME/cyberlium-lab/t22-mal/samples/demo_bin.sh" file "$HOME/cyberlium-lab/t22-mal/samples/demo_bin.sh" head -1 "$HOME/cyberlium-lab/t22-mal/samples/demo_bin.sh"
Primary tools to practice this lesson: file, python3. Reference sites: PE format overview (https://learn.microsoft.com/en-us/windows/win32/debug/pe-format); file magic signatures (https://en.wikipedia.org/wiki/List_of_file_signatures). Run every command in the box — install first, then the usage lines — only on YOUR lab / program scope.
2. ELF structure (Linux literacy)
ELF header: e_type (EXEC/DYN), e_entry, program headers. Sections and.dynamic show linked libraries — libcurl, openssl hints for network or crypto behavior.
Many $MAL_LAB Linux samples are ELF — triage OS matches sandbox guest.
3. Imports are hints — sandbox confirms
Static imports suggest capability; dynamic on $MAL_LAB confirms actual API use. Forbidden: modifying PE/ELF to weaponize or bind malicious imports for deployment outside lab.
Ship: PE vs ELF comparison table — three header fields each + one import hint example. Next: Static Lab.
4. What you ship: PE/ELF literacy comparison table
Three fields each + import hint examples. Static copy only. $MAL_LAB dynamic confirms. chmod 600.
5. What you record before the next lesson
Date. PE/ELF table. $MAL_LAB named. File t22-m03-l03-pe-elf-named.txt chmod 600.
6. Wrong vs right: live malware on daily driver vs sandbox
Worked failure — same MSF word, opposite target. Right never needs a café Wi-Fi or classmate laptop.
Wrong
Patch import table on host sample for 'practice.' Execute to 'read headers.'
Right
Write PE/ELF literacy table. Next: Static Lab.
Mission: name PE and ELF headers
1) List three PE fields and three ELF fields. 2) Give one suspicious import example each. 3) chmod 600. Never weaponize binaries.
Stuck? Ask Cyberlium AI Mentor
Imports narrow hunt hypotheses — sandbox proves behavior.
Knowledge Check
APPLY: PE/ELF Named on Cyberlium teaches:
Multiple choice
Knowledge Check
APPLY: True or False: Import table entries suggest possible API use before dynamic confirmation.
True or False
Knowledge Check
APPLY: PE files on Windows often start with:
Multiple choice