Revealing Packed Malware

  • Authors:
  • Wei Yan;Zheng Zhang;Nirwan Ansari

  • Affiliations:
  • Trend Micro;McAfee;New Jersey Institute of Technology

  • Venue:
  • IEEE Security and Privacy
  • Year:
  • 2008

Quantified Score

Hi-index 0.00

Visualization

Abstract

In concert with the ever-growing network applications, a significant increase in the spread of malware over the Internet has been observed. In cases where malware are the zero-day threats, generating their signatures for detection via anti-virus (AV) scan engines becomes an important reactive security function. However, modern malware can easily bypass AV scanners using packers, which can hide malicious file contents from detection. This article describes how packers work, and the three most commonly used unpacking methods. The authors describe the logic flow and behavior of Upack, a popular packer, as an example of a software packer.