A Heuristics-based Static Analysis Approach for Detecting Packed PE Binaries

摘要: Malware authors evade the signature based detection by packing original malware using custom packers. In this paper, we present a static heuristics approach for of packed executables. We 1) PE considered analysis and taxonomy heuristics; 2) method computing score power distance on weights risks assigned to defined 3) classification executable threshold obtained with training data set, results achieved test set. The experimental show that our has high rate 99.82% low false positive 2.22%. also bring out difficulties in detecting DLL, CLR Debug mode executables via header analysis.