Technique 1 – checking PE tool static signatures

The first way to identify whether the malware is packed is by using static signatures. Every packer has unique characteristics that can help you identify it. For example, the UPX packer renames all sections as UPX1, UPX2, and so on, while the UPX packer names the last section .aspack. Some PE tools, such as PEiD and CFF Explorer, are able to scan the PE file using these signatures or traits and identify the packer that was used to compress the file (if it's packed); otherwise, they will identify the compiler that was used to compile this executable file (if it's not packed):

Figure 2: PEiD tool detecting UPX

All you need to do is open this file in PEiD—you will see the signature that was triggered on this PE file (in the preceding diagram, it was identified as UPX). However, since they can't always identify the packer/compiler that was used, you need other ways to identify whether it's packed, and what...