// REFERENCE
EXE/DLL (PE) signature
Signature (hex): 4D 5A (MZ)
High risk
A Windows PE executable (EXE/DLL) starts with 4D 5A (MZ, for Mark Zbikowski). Further in it carries the PE\0\0 signature. A file with an MZ signature but a different extension is a clear red flag.
Related tools
Work with this in:
Related
elf
ELF (Linux) signature macho
Mach-O (macOS) signature class
Java .class signature dex
DEX (Android) signature wasm
WebAssembly signature lnk
LNK shortcut signature
ELF (Linux) signature macho
Mach-O (macOS) signature class
Java .class signature dex
DEX (Android) signature wasm
WebAssembly signature lnk
LNK shortcut signature
Signatures verifiable with CyberEscudo's magic-bytes identifier. Educational content.