Packer classifier based on PE header information

Abstract

Run-time binary packers are used in malware manufacturing to obfuscate the contents of the executable files. Such packing has proved an obstacle for antivirus software that relies on signatures, as the binary contents of packed malware often bears no resemblance to the original code on which the signature was generated. A naive approach, then, is to first attempt to unpack the malware before applying a signature. Unfortunately, malware authors make use of automated tools that drastically reduce the cost of constructing new packers, and as a result, attackers routinely use previously unseen packer when releasing new malware.As a first step towards addressing this problem, we seek to build a binary program classifier that can differentiate packers and identify new packers as they emerge. We hypothesize that programs generated from the same packer share many common attributes (e.g., PE header fields) and that these may be used for packer identification. Preliminary work shows that for some packers, we may be able to build effective classifiers. This is only the first step in a line of research that seeks to identify new packers, automate their unpacking, and ultimately track new versions of malware as they emerge.

Identifying Malware Packers through Multilayer Feature Engineering in Static Analysis

“…Jin et al [21] proposed a PE header-based method for packer classification, achieving around 0.99% precision and recall. Similar to [22], the approach used PE file header analysis with nine features and the Euclidean distance for classification.…”

Packer identification method based on byte sequences

“…Jin et al proposed a method to classify packers based on portable executable (PE) header information. Laxmi et al proposed a packer analysis method called PEAL (Packer Executable AnaLysis), which uses extracted features from the PE header, such as the number of sections, section name, size of code, image base, etc.…”

“…The PE header contains the starting addresses of sections, and the starting addresses and section names of encrypted sections for well‐known packers are known to the public, as shown in Table . Some of the previous packer detection methods use information obtained from only the header, but this information can be easily modified by attackers to avoid detection.…”

“…Jin et al 20 required to be updated continuously, but the tool was ceased to be maintained. Even though the above methods can identify known packers, these methods can be easily avoided by simply modifying header information.…”