DOS/PE executable signature (MZ, PE\0\0)

A Windows PE executable (and any DOS MZ executable) begins with the ASCII 'MZ' (0x4D 0x5A). A PE file additionally contains the 'PE\0\0' (50 45 00 00) signature at the file offset stored in the MZ header field e_lfanew (at offset 0x3C).

file signature

magic: 4D 5A @ offset 0

ascii: MZ

.exe.dll.sys.scr.ocx application/vnd.microsoft.portable-executable

spec: Microsoft PE Format / MS-DOS MZ executable

Bytes 0-1: 'MZ' (4D 5A), the DOS MZ executable magic (initials of Mark Zbikowski). 'ZM' (5A 4D) is also tolerated by some loaders.
Offset 0x3C holds a 4-byte little-endian field (e_lfanew) pointing to the PE header.
At that offset the PE signature is 'PE\0\0' = 50 45 00 00, followed by the COFF file header.
A bare DOS executable has the MZ header but no PE signature.

provenance

source: https://learn.microsoft.com/en-us/windows/win32/debug/pe-format
version: Microsoft PE Format spec (MS-DOS Stub 'MZ', PE signature 'PE\0\0' at e_lfanew)
retrieved: 2026-05-29 · updated: 2026-05-29T00:00:00Z

per-fact attribution:

ext.magic_hex — https://learn.microsoft.com/en-us/windows/win32/debug/pe-format Files begin with the MS-DOS stub starting 'MZ'; the PE signature 'PE\0\0' is located at the file offset given by the 4-byte field at 0x3C (e_lfanew).
ext.notes — https://en.wikipedia.org/wiki/DOS_MZ_executable Corroborates 'MZ' = 0x4D 0x5A (initials of Mark Zbikowski) as the DOS executable magic shared by EXE/PE.

agent: curl -H 'accept: application/json' wire.phall.io/magic/pe-exe or /magic/pe-exe.json

DOS/PE executable signature (MZ, PE\0\0)

file signature

provenance

see also