Examining packed files and packers

Packing is one of the most common techniques adversaries utilize to attempt to obfuscate their executables. Both commercially available packers and custom packers exist, but both serve the same functionality – to both reduce the size of the executable and render the data within the binary unreadable before unpacking.

Packers work by compressing and encrypting data into single or multiple packed sections, along with a decompression or decryption stub that will decrypt and decompress the actual executable code before the machine attempts to decode it. As a result of this, the entry point of the program moves from the original .text section to the base address of the decompression stub.

In the next few sections, we'll see how we can discover packed samples via several methodologies, and also how we may unpack these samples.

Detecting packers

Detecting the usage of a packer is fairly simple, and there are several indicators that...