Beyond the
section table.

The supplied EXE is 89,526,543 bytes long. Its PE signature is at file offset 216; its optional-header magic is 0x010b, and the COFF header declares five sections. The last nonempty section ends at file offset 38,400. That leaves 89,488,143 trailing bytes after the last section’s raw data.

This is a structural observation, not a malware verdict. Installers and other formats can carry additional content outside their PE sections. A review that measures only the mapped sections has not accounted for the entire file.

section   file offset range       raw size     virtual size
.text     [1,024, 27,648)           26,624       26,151
.rdata    [27,648, 33,280)           5,632        5,282
.data     [33,280, 34,816)           1,536      462,840
.ndata    no raw data                   0      589,824
.rsrc     [34,816, 38,400)           3,584        3,320

The Microsoft PE specification distinguishes file offsets from relative virtual addresses. It also treats the security directory’s address as a file position. Those distinctions matter when implementing an inspector: subtracting an image base or translating every directory as an RVA can report the wrong bytes.

inspect_pe.py is a standard-library Python inspector with explicit input limits. It records the content hash, headers, section ranges, trailing range, and declared security-directory location. It accepts a local file or one named member of a ZIP archive without extracting or launching it.

Its synthetic tests challenge truncated headers, invalid offsets, raw ranges that overlap, valid sections with no raw data, both optional-header formats, and unsafe archive inputs. The public report was produced from the supplied file; the original binary is not hosted here.

python inspect_pe.py /path/to/sample.exe
python -m unittest -v test_inspect_pe.py

Sample SHA-256:
035097eba52bf471f1148520a27f390ada0f0c8e0613bf8d38636c61c9cb8b76

The inspection identifies an i386 PE32 structure and the file ranges its headers declare. It does not establish that the trailing bytes are encrypted, that any particular packer produced them, or that the sample is benign or malicious. A content hash identifies these bytes; it does not authenticate their publisher.

The inspector locates a claimed certificate range but verifies neither Authenticode signatures nor trust chains. This sample declares no certificate table.

The accompanying archive also contained scripts that modify an assistant’s local configuration. Those scripts were read as untrusted source and were not executed. A document’s assertion that every target is a lab asset does not establish the provenance or behavior of an executable beside it.