A set of 99 adversarial PE files was created to systematically test the behavior of six widely used PE analysis tools (IOCX, Ghidra, Detect It Easy, radare2, PEview, CFF Explorer) against specific corruption patterns. The files introduce single corruption types such as entrypoint redirection, overlapping/invalid sections, header inconsistencies, and others. The tools exhibited distinct behaviors: literal parsers never crashed but failed to show anomalies; semantic parsers fixed corruptions masking inconsistencies; heuristic tools ignored malformed metadata; reconstructive loaders rewrote metadata and sometimes crashed; hybrid tools preserved raw bytes and explicitly surfaced anomalies. This corpus maps how malformed PE files can be used to evade analysis or cause inconsistent parsing, which is relevant for exploit development and malware analysis.

The impact lies in the potential for attackers or malware authors to exploit differences and weaknesses in PE parsing tools to evade detection, cause crashes, or create confusion in analysis workflows. Malformed PE files can serve as primitives for evasion, crash induction, or metadata manipulation, complicating reliable static and dynamic analysis. However, no direct exploit or active threat is reported, and this work primarily informs tool developers and analysts about limitations and behaviors of existing PE parsers.

This is an analysis and research corpus rather than a vulnerability with a patch. No official fixes or patches are applicable. Security professionals and tool developers should review the findings to improve PE parsing robustness and anomaly detection in their tools. Users of these tools should be aware of potential blind spots or crash conditions when analyzing malformed PE files. No immediate remediation is required beyond incorporating these insights into tool development and analysis practices.