Today we publish the researchers’ paper in both HTML<\/a> and PDF <\/a>format, as well as the recording of their presentation in London.<\/p>\n \u00a0<\/p>\n \u00a0<\/p>\n![\"04_table.png\"](\"https:\/\/www.virusbulletin.com\/files\/cache\/c32127a7c267423e5df8098ccbb4b4ad_f4325.png\")
The unencrypted Rich Headers structure.<\/span><\/p>\n
When analysing malware, especially if it’s new and rare, researchers look for every possible clue that could give them details on the context and perhaps help them find similar samples. One such clue could be what has been called \u2018rich headers\u2019, an undocumented chunk of data inside PE files.<\/p>\n
In a paper presented at VB2019 in London, ESET<\/em> researchers Peter K\u00e1lnai and\u00a0Michal Poslu\u0161n\u00fd discussed the subject of rich headers and how it can be useful in malware research.<\/p>\n Today we publish the researchers’ paper in both HTML<\/a> and PDF <\/a>format, as well as the recording of their presentation in London.<\/p>\n \u00a0<\/p>\n \u00a0<\/p>\nThe unencrypted Rich Headers structure.<\/span><\/p>\n