1. A computer implemented method comprising: parsing, by a computing device, a binary image of a portable executable file to generate a parsed field; determining, by the computing device, an attribute of the parsed field; comparing, by the computing device, the attribute of the parsed field to a valid characteristic of a valid corresponding field based upon, at least in part, a portable executable file format specification; and determining, by the computing device, if the attribute of the parsed field matches the valid characteristic of the valid corresponding field.