There are multiple tools and multiple ways to identify whether the sample is packed. In this section, we will take a look at different techniques and signs that you can use, from the easiest and most straightforward to more intermediate ones.
Identifying a packed sample
Technique 1 – checking PE tool static signatures
The first way to identify whether the malware is packed is by using static signatures. Every packer has unique characteristics that can help you identify it. For example, the UPX packer renames all sections as UPX1, UPX2, and so on, while the ASPack packer names the last section .aspack. Some PE tools, such as PEiD and CFF Explorer, are able to scan the PE file using these signatures or traits and identify...
