I was to quick to ask this question because in the PE specification it says that when the virtualsize is greater than the size of raw data, it is padded with 0's. So now I have to look for the function where they load some data in this 0 area.