LAB-16Medium

Packer Identification

Identify a packed binary and determine which packer was used.

15 min5 prerequisites8 tools

Investigate

Hints

Hint 1

The signature is 4 bytes near the start of the file.

Hint 2

Packed sections are conventionally named UPX0 and UPX1.

Hint 3

The compressed payload is high-entropy — looks random.

Submit Findings

Prerequisites

  • m4-obfuscation-packing
  • w1-pe-deep-dive
  • f1-binary-anatomy
  • Common packer signatures (UPX, ASPack, Themida, VMProtect, etc.)
  • Entropy analysis

Methodology

Investigation Methodology

1. Packer Indicators

Indicator What It Means
Few imports (only LoadLibrary/GetProcAddress) Manual import resolution
High entropy (>7.5) in all sections Encrypted/compressed
Entry point in last/weird section Packer stub
Non-standard section names Packer-specific (UPX0, .aspack, .themida, .vmp0)
Missing relocations with ASLR Packer strips them
TLS callbacks present Pre-entry unpacking
Signature in header UPX!, ASPack, MEW, etc.

2. Common Packer Signatures

Packer Signature Section Names Notes
UPX UPX! (0x20-0x23) UPX0, UPX1 Most common, open source
ASPack ASPack / .aspack .aspack, .adata Commercial
Themida .themida, .tmd .themida, .tmd Heavy anti-debug
VMProtect .vmp0, .vmp1 .vmp0, .vmp1 Virtualization-based
Enigma .enigma .enigma, .edata Virtualization
PECompact PEC2 .pec1, .pec2 Commercial
MPRESS MPRESS .mpress Free
Custom (none) Random / none Hardest

3. Entropy Analysis

import pefile, math
pe = pefile.PE('sample.exe')
for s in pe.sections:
    data = s.get_data()
    if len(data) == 0: continue
    entropy = -sum((data.count(b)/len(data))*math.log2(data.count(b)/len(data)) for b in set(data))
    print(f'{s.Name.decode().strip():10s} Entropy: {entropy:.2f}')
  • Normal code: 6.0-7.2
  • Packed/encrypted: 7.5-8.0

4. Identification Workflow

  1. Run die (Detect It Easy) or pestudio → auto-detect
  2. Check section names manually in PE-bear/CFF Explorer
  3. Scan for signatures at known offsets
  4. Check entropy per section
  5. Verify entry point location

5. Unpacking Strategy

Packer Method
UPX upx -d sample.exe (trivial)
ASPack ESP tracing / manual dump
Themida/VMProtect Dynamic dump at OEP (hardware BP on write to .text)
Custom Dynamic analysis, memory dump, import reconstruction

6. Post-Unpack Analysis

  • Dump memory at OEP (Scylla, LordPE, x64dbg)
  • Fix imports (Import ReConstructor, Scylla)
  • Re-analyze unpacked binary (strings, imports, CFG)

Common Pitfalls

  • Assuming high entropy = packed (could be encrypted resources, compressed data)
  • Missing that some packers don't change section names (custom/modified)
  • Not dumping at correct OEP — original entry point after unpack
  • Forgetting to fix imports after dump (IAT is rebuilt at runtime)
  • Overlooking that some packers have anti-dump tricks (nanomites, etc.)

Tools

  • Detect It Easy (DIE) — best auto-detection
  • PE-bear / CFF Explorer (section names, entropy)
  • upx -d (for UPX)
  • x64dbg + Scylla (dump + import fix)
  • LordPE (dump)
  • Import ReConstructor (IAT fix)
  • pestudio (static triage)
  • binwalk -E (entropy visualization)

References

  • Lesson M4: Obfuscation & Packing
  • Lesson W1: PE Format Deep Dive
  • Detect It Easy (DIE) signatures
  • UPX Source Code / Documentation
  • Scylla Dump + Import Reconstruction Guide

Extensions & Challenges

  • Unpack a UPX sample with `upx -d`, compare imports before/after
  • Analyze a Themida/VMProtect sample — find OEP, dump with x64dbg
  • Write a YARA rule for UPX signature + section names
  • Research: How does UPX compression work (LZMA/NRV)?
  • Build an automated unpacker for a simple custom packer