Identifying Packers Used on Acquired Malware
An investigator has acquired packed software and needed to analyze it for the presence of malice. Which of the following tools can help in finding the packaging software used?
Community Insight
The question tests static malware triage: recognizing that packer identification is done by matching compiler/packer signatures in a Portable Executable header, and the trap is picking a generic system-analysis or dependency tool that never inspects packing signatures.
When an investigator acquires packed software, one of the first triage steps is identifying which packer, cryptor, or compiler produced the binary, because that determines the unpacking and static-analysis workflow. PEiD (PE Identifier) is the tool in this list purpose-built for that signature-based packer detection, making B the correct answer.
Learners often choose A (SysAnalyzer) or D (Dependency Walker) because both sound like legitimate malware-analysis utilities. SysAnalyzer automates dynamic behavioral logging of a running sample, and Dependency Walker lists imported DLLs and API calls — neither compares the executable's header against a packer/compiler signature database, which is exactly what the question asks for.
Community Discussion (3 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
PEiD (PE Identifier) exists specifically to identify the compiler, linker, packer, cryptor, or protector used to build a Windows Portable Executable by matching the file's signature entries against an embedded database. For packed malware, detecting the packer name is the decisive first step: it tells the investigator whether unpacking, emulation, or a targeted script is required before strings, imports, and disassembly become meaningful. PEiD also reports whether the header appears mutated or bogus, which is a common anti-forensics trick used to defeat naive signature scans. That is precisely the capability the question asks about — finding the packaging software used — so B is correct.Why the Other Options Are Wrong
SysAnalyzer (A) is a dynamic-analysis harness that records system, file, registry, API, and network activity while the suspect binary executes, so it profiles behavior rather than naming the packer; it also fails against samples that refuse to run in an analysis environment. Comodo Programs Manager (C) is an application/patch-management and sandboxing product unrelated to executable signature forensics. Dependency Walker (D, depends.exe) maps imported and exported functions and DLL dependencies, but packed malware typically shows only a stub loader importing a handful of APIs, so the output reveals almost nothing about the packer itself and cannot answer the question. None of these three consults a packer signature database.Community Comment Notes
The community converged on B, with aqeel1506 explaining that "PEiD is a popular tool for detecting packers, cryptors, and compilers used in executable files" and noting that this identification "can help in further unpacking and analyzing the software." Elb concurred in the most direct terms, summarizing PEiD's role as being able to "detect which packer was used to pack the binary." No comment defended SysAnalyzer, Comodo Programs Manager, or Dependency Walker, and none offered evidence contradicting the signature-detection rationale for PEiD.Official Reference
Exam Strategy
In malware-forensics tool questions, sort the options by what stage of analysis they serve: acquisition, static triage (signatures, headers, strings, imports), or dynamic execution (behavioral logs). A question asking what packer or compiler was used is always asking for a static signature-scanner such as PEiD, Die, or Detect It Easy.
Frequently Asked Questions
Why is PEiD the right tool for finding packaging software on packed malware?
PEiD matches the Portable Executable's signature entries against a database of compilers, linkers, packers, and cryptors, so it directly names the tool that packed the file.
Can Dependency Walker or SysAnalyzer identify the packer of a malicious executable?
No. Dependency Walker only reports DLL imports and exports, while SysAnalyzer logs runtime behavior; neither scans packer signatures, so both fail on a heavily packed sample.