Executable Files
An executable file is a file that contains encoded instructions that can be executed by an operating system. Executable files can be platform specific (only executes in a Windows environment for example) or they can be cross platform (also executes on Unix/Linux, OSX and so on).
Most users associate executable files with the extension ‘.EXE’ but these file types can have several extension associations examples include:
| File Extension | File Header (ASCII) |
| EXE | MZ |
| DLL | MZ |
| SYS | MZ |
| AX | MZ |
| COM | MZ |
Many other Windows file types can also execute code not just the above examples.
Remember it is the file extension which associates the file with particular application(s) to execute the program. It is the file header which identifies the file as containing compiled executable code (instructions) which are loaded into the computers memory when the file is accessed.
Malware must execute in order to infect a computer and must therefore contain executable code to facilitate this.
Remember malware can be hidden (using binding or wrapping techniques) or otherwise packed in other file types and when those file types are accessed their contents are executed and loaded into memory. Any nefarious code present inside such a file will therefore also be executed and loaded into memory.
Additional information…
The designer of the original MS DOS executable file format at Microsoft was called Mark Zbikowski. He chose his initials to be the executable file header in ASCII – how cool!
Introduction to Digital Forensics: Malware Analysis and Investigations
Introduction to Digital Forensics: Malware Analysis and Investigations
