Abstract: The disclosure relates to the field of artificial intelligence. Disclosed in the disclosure are a method and apparatus for detecting a malicious Portable Executable (PE) file, and a device and a medium. The method includes: disassembling a target PE file according to a preset file disassembling method, so as to acquire file header information, file optional header information, file section header information, and section information; using a trained sparse self-encoding neural network model to respectively vectorize each piece of header information, and using a trained text classification model to vectorize the section information; and fusing each vectorized vector, and inputting fused vectors into a neural network model, so as to acquire a detection result outputted by the neural network model. The neural network model is obtained by using a preset knowledge transfer method to perform model transfer on each trained sparse self-encoding neural network model and text classification model.