What changes can happen when an exe is packed?
A compressed executable can be considered a self-extracting archive, where a compressed executable is packaged along with the relevant decompression code in an executable file. Some compressed executables can be decompressed to reconstruct the original program file without being directly executed.
What is UPX packed executable file?
UPX (Ultimate Packer for Executables) is an open source executable packer supporting a number of file formats from different operating systems.
What Packed file?
A packed file is a file in a compressed format. Many operating systems and applications contain commands that enable you to pack a file so that it takes up less memory.
Is it possible to detect packed executable malware?
If you ever spend time in blackhat forums, people advertise ‘FUD Crypters/Packers’ which means that they’ve usually modified the way their packers work so that AV’s don’t pick up the signatures for a while allowing for malware to slip through. Symantec has collected a large number of packers – more than 2000 variants in more than 200 families.
Is it possible to detect a packer executable?
The ‘most common’ packer UPX and its variations are usually flagged as ‘suspicious’ by Anti-virus engines due to a signature detection in the EXe. RDG Packer Detector which detects specific packers based on signature checking (presumably the same way AV does it
What can you do with a packed executable?
Packed executables have very little, if any, strings that you can view. You can also look at any imports. Packed executables do not show many of their imports. This makes it hard for us to detect what a program is doing when we go to reverse engineer it.
Is it possible to detect packed executables in Python?
PEiD detects most common packers, cryptors and compilers for PE files as well as allowing for disassembly (available to download via softpedia) A simple signature DB checker in python for you to play with (not sure where to grab the DB from though ( try here?)