In UPX0, the Virtual size and Raw size are suspicious in this section and if we see at the end of the image, you can see that this section is marked as Writable, executable, self-modifying and virtualized. I will move to Sections to Check them as are different than we saw in DiE, this is a reason to use a different tool to check a sample so you must practice with many tools, each tool will provide information to understand static analysis of a sample There are indicators that refer to UPX information, also there are two-section, one of them is Writable and another section is Executable, the indicator is referred to as malicious code in a sample The next stage I will use posted for our extraction information from a sample so let us fire a sample in pestudio and go to Indicators. The Virtual size and raw size seem logical in UPX1 but we can see that Entropy is 7.92 which is too high, so DiE detect classify this section as packed. rsrc, in UPX0 we can see interesting information that has a Virtual size of 0X014000 bytes, also we can see that the raw size is zero, and we Conclude that nothing in this section so the Entropy value is zero We see that there are three section UPX0, UPX1. In this section, I will use four tool to analysis PE file in a sample, I open the sample in DiE and click sections Button to see the next image

We can donload the sample from here Tools In this article, I will write about PE analysis and how to extract more information from more tool to best practice, do static analysis for the packed sample well, also i write about resources analysis in packed sample.

Pestudio indicators