Program Database

2024-08-05 pe windows

Program Database (PDB) is a file format on Windows systems used to store debugging information about a program.

PDB files commonly have a .pdb file extension.

A PDB file is typically created at compile time and stores a list of all symbols in a module, their addresses, and sometimes the filename in which a symbol was declared.

PDB paths are useful in the context of malware analysis, as they often contain a path with the username, folder, and project name. This may reveal clues related to the attacker and the malware being analyzed and can be used as a weak form of attribution.

A PDB path may be present in a PE file near the top of the file. These can be viewed using the strings command.

An example PDB path may look like this: C:\droberson\projects\procinject\Test\Obj\Debug\inject.pdb

https://cloud.google.com/blog/topics/threat-intelligence/definitive-dossier-of-devilish-debug-details-part-one-pdb-paths-malware/


No notes link to this note