> For the complete documentation index, see [llms.txt](https://cyber-reaper.gitbook.io/my-malware-analysis-guide/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://cyber-reaper.gitbook.io/my-malware-analysis-guide/guide/basic-static-analysis/packing-and-packed-malware.md). # Packing & Packed Malware ## What is Packing? You can think of packing like compression or encoding/encryption mechanism to make a piece of malware look different from its original form. The packer first keeps the PE header then crunches the code inside the executable and adds a stub that will later extract the code at the runtime and executes as in the original version of it.

## How to Discover Packing? And it is obviously clear, the program size when it is on the disk is significantly smaller that when it is executed. Here is an example of a piece malware and the difference between when it is packed and when it is not. We need to import the **Portable Executable** into the `PEView` tool, then we will go to the `IMAGE_SECTION_HEADER .text` , the first image shows a Not Packed malware, as the difference in the sizes is barely noticeable:

The size of the raw data here is bigger a bit that the virtual size, but what is the case in the packed malware? check the image below:

The virtual size is significantly bigger than the raw size! this thing indicates that the whole malware is getting unpacked at the runtime, another thing to consider is the section name, here in the image above it is different from what we actually saw as it has `UPX0` instead of the `.text` in the sample before, also when you give a look at the **IAT** you will find that it has imports less than what could a minimal program have, but when you also check what APIs are being called we can see the 2 in the red boxes, these are used to import functions and **DLLs** in the runtime, this is another indicator of having a packed program, check in the image below: