Practical Malware Analysis

Identifying Packed Programs

An early step when analyzing malware is to recognize that it is packed. We have covered techniques for detecting if malware is packed in earlier chapters. Here, we’ll provide a review and also introduce a new technique.

Indicators of a Packed Program

The following list summarizes signs to look for when determining whether malware is packed.

• The program has few imports, and particularly if the only imports are LoadLibrary and GetProcAddress.

• When the program is opened in IDA Pro, only a small amount of code is recognized by the automatic analysis.

• When the program is opened in OllyDbg, there is a warning that the program may be packed.

• The program shows section names that indicate a particular packer (such as UPX0).

• The program ...