The signature MZ is associated with which file type?

Study for the Wireshark Block 5 Exam. Prepare with flashcards and multiple choice questions, each offering hints and explanations. Ace your exam with the best resources!

Multiple Choice

The signature MZ is associated with which file type?

Explanation:
The MZ signature is the classic magic header for executable files. It comes from the DOS executable format created by Mark Zbikowski, and Windows PE executables preserve this MZ header at the very start. When a loader sees MZ at the beginning, it signals that the file is an executable and should be treated as code to be run (often with the real PE header located further inside the file). That makes MZ a reliable indicator of executables, rather than a compressed archive or a document. By contrast, ZIP files start with PK, PDFs with %PDF-, and PNG images with an 8-byte signature beginning 89 50 4E 47, so those formats wouldn’t have the MZ header.

The MZ signature is the classic magic header for executable files. It comes from the DOS executable format created by Mark Zbikowski, and Windows PE executables preserve this MZ header at the very start. When a loader sees MZ at the beginning, it signals that the file is an executable and should be treated as code to be run (often with the real PE header located further inside the file). That makes MZ a reliable indicator of executables, rather than a compressed archive or a document. By contrast, ZIP files start with PK, PDFs with %PDF-, and PNG images with an 8-byte signature beginning 89 50 4E 47, so those formats wouldn’t have the MZ header.

Subscribe

Get the latest from Passetra

You can unsubscribe at any time. Read our privacy policy