What are in the "Unmapped Data" part of PE?

Question

Anyone knows?

It seems to me most space of PE is taken up by Unmapped Data , is this the case in most occasions?

Answer 1

No that is not the case in most situations.

There should be no data past the last section, though there can be. If there is, it will be data that is not loaded into memory and hence the executable might be doing something fishy with its own fileimage at runtime.