Technique 4 – detecting a small import table

For most applications, the import table is full of APIs from system libraries, as well as third-party libraries; however, in most of the packed PE files, the import table will be quite small, and will include a few APIs from known libraries. This is enough to unpack the file. Only one API from each library of the PE file would be used after being unpacked. The reason for this is that most of the packers load the import table manually after unpacking the PE file, as you can see in the following screenshot:

Figure 4: The import table of an unpacked sample versus a packed sample with UPX

The packed sample removed all the APIs from ADVAPI32.dll and left only one, so the library will be automatically loaded by Windows Loader. After unpacking, the unpacker stub code will load all of these APIs again using the GetProcAddress API.

Now that we have a fair idea of how to identify a packed sample, let's venture forward and explore the automatic...