Take the 2-minute tour ×
Information Security Stack Exchange is a question and answer site for Information security professionals. It's 100% free, no registration required.

I am starting up on malware analysis, and I am analyzing a file to see if it is packed or obfuscated.

Using PEview I am examining the .text, .rdata and .data headers.

I know that if there is a big difference between the Virtual Size (size consumption on the memory) and Size on Disk, then it is probably packed.

My question is, what should I conclude from each scenario?

  • Virtual size = Size on Disk
  • Virtual size > Size on Disk (bigger with a considerable amount, not just some bits)
  • Virtual size < Size on Disk (smaller with a considerable amount, not just some bits)
share|improve this question
    
from my experience I have seen that most of the time there's unpacker stub is at the end of the PE which is in most case padded with zero bytes –  user1064504 Aug 1 '12 at 13:46
add comment

1 Answer

The raw size is as it appears in the filesection. The Virtual Size is how large it will be during runtime. Often malware will modify these memory segments during runtime. These segments could be modified without changing the virtual size, but often that is not that case. A way of thinking about this is that they "unpack" themselves from a container such that looking at the static binary will not provide much insight into the inner workings of the binary.

If you where to view these segments while they where running with a debugger such as ollydbg or windbg you will probably have a more accurate view of malware. However, malware are often utilizing anti-debuggin measures. By contrast there are anti-anti-debugging plugins for ollydbg. Its a game of cat and mouse.

share|improve this answer
    
Can you explain to me the "basic" conclusions I should make when examining each scenario out of the three? For example - Virtual Size is noticeably bigger Size on Disk, I should conclude that it is a packed executable and hence I should suspect it? –  Franko Jun 20 '12 at 9:27
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.