While checking the PE header of DLLs and EXE(s) by PEviewer, I found  something called magic number. After googling magic number. I found that it is used to determine the file type. My question is how can a malware analysist benefits from this magic number ? And why is it in the PE header ?
Is the magic number important
static analysis;pe
A magic number is a set of bytes used when accessing a file to determine its type. For example, the standard Microsoft PE begins with (in ASCII) MZ, the initials of one of the developers of MS-DOS.The initial headers in a portable executable specify a variety of information regarding the file, ranging from the supported platform, number of symbols, number of sections, time stamps, etc. As such, it is a logical location to store the magic number, as it is also part of the file metadata.How can a malware analyst benefit from this magic number?The only information the magic number provides is the file type, and as such that is all that can be garnered by a malware analyst, or any type of analysis. Although one can refer to the file extension to check a file type, they can be changed without affecting the contents of the file. As such, checking the magic number is a method to determine the true file type. Discrepancies would then indicate potential malicious behavior or attempts to hide data.