I am starting up on malware analysis, and I am analyzing a file to see if it is packed or obfuscated.

Using PEview I am examining the .text, .rdata and .data headers.

I know that if there is a big difference between the Virtual Size (size consumption on the memory) and Size on Disk, then it is probably packed.

My question is, what should I conclude from each scenario?

  • Virtual size = Size on Disk
  • Virtual size > Size on Disk (bigger with a considerable amount, not just some bits)
  • Virtual size < Size on Disk (smaller with a considerable amount, not just some bits)
  • from my experience I have seen that most of the time there's unpacker stub is at the end of the PE which is in most case padded with zero bytes Aug 1 '12 at 13:46

The raw size is as it appears in the filesection. The Virtual Size is how large it will be during runtime. Often malware will modify these memory segments during runtime. These segments could be modified without changing the virtual size, but often that is not that case. A way of thinking about this is that they "unpack" themselves from a container such that looking at the static binary will not provide much insight into the inner workings of the binary.

If you where to view these segments while they where running with a debugger such as ollydbg or windbg you will probably have a more accurate view of malware. However, malware are often utilizing anti-debuggin measures. By contrast there are anti-anti-debugging plugins for ollydbg. Its a game of cat and mouse.

  • Can you explain to me the "basic" conclusions I should make when examining each scenario out of the three? For example - Virtual Size is noticeably bigger Size on Disk, I should conclude that it is a packed executable and hence I should suspect it?
    – Franko
    Jun 20 '12 at 9:27

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.