Packers

Packing compresses an executable and leaves it harder to read from the file alone, which buys time against a signature and against anyone working statically. It buys much less against behaviour, since a packed binary runs the same way an unpacked one does and is watched the same way. The cost is that packing is itself conspicuous: a file that resists reading is a file worth a second look.

Packing/Unpacking

The unpacking stub unpacks the original executable into memory, resolves imports, and
transfers execution to the OEP

Tells of a packed file

  • Opening a packed executable with tools like OllyDbg and IDA-Pro will produce a warning that the executable may be packed.

  • Packed programs have very few imports (usually LoadLibrary and GetProcAddress), or no import at all.

  • Many packers leave text signatures inside the packed binary.

  • In some cases, the file command will be able to identify the packer (UPX compressed, PECompact2 compressed)

  • Tools like PEiD (python version) and pev detect most common packers, cryptors and compilers for PE files.