Enum PeAnomaly 

pub enum PeAnomaly {
    WritableExecutableSection {
        section_name: String,
    },
    EntryPointOutsideSections {
        entry_point_rva: u32,
    },
    VirtualOnlySection {
        section_name: String,
    },
    LargeVirtualToRawRatio {
        section_name: String,
        ratio: u32,
    },
    TlsCallbacksPresent {
        count: usize,
    },
    OverlayPresent {
        offset: u64,
        size: u64,
    },
    RichHeaderAbsent,
}

A structural anomaly found in a PE binary.

Individual anomalies are low-to-medium confidence signals; clusters of multiple anomalies on the same binary are high confidence.

Variants

WritableExecutableSection

A section has both executable and writable characteristics (W+X). Legitimate code sections are executable but not writable; shellcode injected at runtime needs both.

Fields

section_name: String

EntryPointOutsideSections

The entry-point RVA falls outside the virtual address range of every defined section. This is the classic hallmark of shellcode loading or in-memory PE patching.

Fields

entry_point_rva: u32

VirtualOnlySection

A section’s raw size on disk is zero but its virtual size is non-zero. The runtime loader expands this section, which is where packed malware decompresses into.

Fields

section_name: String

LargeVirtualToRawRatio

A section’s virtual size exceeds its raw size by more than ratio×. Legitimate compressed resources occasionally show this; ratios > 20 almost always indicate runtime decompression of an encrypted payload.

Fields

section_name: String

ratio: u32

TlsCallbacksPresent

TLS (Thread Local Storage) callbacks are registered. These execute before the PE entry point, giving malware a window for anti-debug and anti-VM checks before the main payload runs.

Fields

count: usize

OverlayPresent

Extra bytes are appended after the last section’s raw data. Legitimate packers (installers, SFX archives) use overlays; so do malware droppers that store an encrypted second stage here.

Fields

offset: u64

size: u64

RichHeaderAbsent

No Rich header was found in the DOS stub area of a large binary. Every MSVC/MinGW binary emits a Rich header; its absence on a file

4 KiB suggests deliberate stripping for anti-attribution.

Trait Implementations

impl Clone for PeAnomaly

fn clone(&self) -> PeAnomaly

Returns a duplicate of the value.

fn clone_from(&mut self, source: &Self)

Performs copy-assignment from source.

impl Debug for PeAnomaly

fn fmt(&self, f: &mut Formatter<'_>) -> Result

Formats the value using the given formatter.

impl Observation for PeAnomaly

fn severity(&self) -> Option<Severity>

Severity, or None if the analyzer deliberately does not grade this kind.

fn category(&self) -> Category

Analytical lens; defaults to Category::from_code of Observation::code. Override when a code’s keyword classification is wrong.

fn code(&self) -> &'static str

Stable, scheme-prefixed machine code.

fn note(&self) -> String

Human-readable, consistent-with note.

fn mitre(&self) -> &'static [&'static str]

MITRE ATT&CK technique ids this kind is consistent with (default: none).

fn evidence(&self) -> Vec<Evidence>

Backing evidence rows (default: none).

fn subjects(&self) -> Vec<SubjectRef>

Non-disk subjects this kind is about (default: none).

fn confidence(&self) -> Option<Confidence>

Heuristic confidence, if inferential (default: none).

fn to_finding(&self, source: Source) -> Finding

Assemble the canonical Finding from this kind and its producing source.

impl PartialEq for PeAnomaly

fn eq(&self, other: &PeAnomaly) -> bool

Tests for self and other values to be equal, and is used by ==.

fn ne(&self, other: &Rhs) -> bool

Tests for !=. The default implementation is almost always sufficient, and should not be overridden without very good reason.

impl Serialize for PeAnomaly

fn serialize<__S>(&self, __serializer: __S) -> Result<__S::Ok, __S::Error>

where __S: Serializer,

Serialize this value into the given Serde serializer.

impl StructuralPartialEq for PeAnomaly