Most packers compress PE file sections, including the code section, data section, import table, and so on, and then add a new section at the end which contains the unpacking code (stub). Since most of the unpacked PE files start the execution from the first section (.text or .code), the packed PE files start the execution from one of the last sections, which is a clear indication that a decryption process will be running. The following signs are an indication that this is happening:
- The entry point is not pointing to the first section (it would mostly be pointing to one of the last two sections) and this section's memory permission is EXECUTE (in the section's characteristics)
- The first section's memory permission will be mostly READWRITE
It is worth mentioning that many virus families that infect executable files have similar attributes.
