I am starting up on malware analysis, and I am analyzing a file to see if it is packed or obfuscated.
Using PEview I am examining the .text, .rdata and .data headers.
I know that if there is a big difference between the Virtual Size (size consumption on the memory) and Size on Disk, then it is probably packed.
My question is, what should I conclude from each scenario?
- Virtual size = Size on Disk
- Virtual size > Size on Disk (bigger with a considerable amount, not just some bits)
- Virtual size < Size on Disk (smaller with a considerable amount, not just some bits)