Reverse Engineering and Malware Analysis
Reverse Engineering and Malware Analysis
Sign in to save your progress, earn points, and unlock module exams.
Topic 5.1 of In-Depth Malware Analysis
How packers work, the four structural indicators of packing, packer identification with Detect-It-Easy, common packer families from UPX to VMProtect, and when high entropy alone is insufficient evidence.
By the end of this topic, you will
Quadrant 1 · e-Tutorial
EZ Bytes · quick recaps
Your AV Said Clean. It Was Packed. | Identifying Packed Malware
79s
Video lessons
Quadrant 2 · e-Content
Quadrant 3 · Web Resources
Downloadable reference material
External links
Detect-It-Easy (DIE) — Packer Identifier
Free tool that identifies packers, compilers, and protectors by signature matching with entropy graphs per section.
UPX — Official Download and Documentation
Official UPX packer. Download to unpack UPX-compressed samples with upx -d. Understand the format before manual unpacking.
Quadrant 4 · Self-Assessment
In-Depth Malware Analysis
Covers packed malware, manual unpacking, obfuscated PowerShell, fileless malware, code injection, API hooking, memory forensics with Volatility, sandbox analysis, and network signatures.
REMA: Complete Assessment
A comprehensive 120-question assessment covering the entire Reverse Engineering and Malware Analysis curriculum: malware taxonomy and reverse engineering fundamentals, static and dynamic analysis, reversing malicious code, malicious web and document files, in-depth analysis of packed and fileless malware, and self-defending malware techniques.
Quadrant 5 · Play
Ungraded practice for Identifying Packed Malware: games and hands-on Skill Labs that use this topic, plus the crossword for In-Depth Malware Analysis. It never affects your unit assessment, and clearing a game or lab for the first time earns EZ Board points when you are signed in.
Lab
PE Autopsy: Triage a Real Signed Windows Binary
15 tasks from this unit. Free to play. Earn 30 EZ Board points on your first clear.
Lab
Packed and Unpacked: Defeat a Packer
13 tasks from this unit. Free to play. Earn 30 EZ Board points on your first clear.
Crossword
In-Depth Malware Analysis
9 key terms from this unit. Free to play.
Race
Unpack Underpass
6 checkpoints from this unit. Free to play. Earn 30 EZ Board points on your first clear.
Discussion · 0 comments
This is the discussion thread for the lesson "Identifying Packed Malware" (Reverse Engineering and Malware Analysis, Unit 5). Ask questions, share real-world examples, and help classmates who are stuck. Conversation starters. Try explaining one of these in your own words: - Describe the five-step packer execution cycle from stub launch to OEP transfer - Identify the four structural indicators of packing in PEStudio output - Explain why a binary with only LoadLibraryA and GetProcAddress in its IAT is almost certainly packed
No comments yet. Start the conversation. Comments here also appear in the forum.
Open in forumREMA eBook 2026 — Chapter 5, Packed Malware
Full packed PE structure diagram and packer family comparison table in the REMA eBook Chapter 5.