Digital Forensic Certification Practice Exam

Which technique is used to detect packers in malware samples?

1. PEiD

2. OllyDbg

3. ResourcesExtract

4. WhatChanged Portable

The correct answer is: PEiD

PEiD is a tool specifically designed for the detection of packed executable files. It analyzes Portable Executable (PE) files and identifies whether they have been packed, which is a common obfuscation technique used by malware authors to make their code less readable and to evade detection by security tools. By recognizing the signatures of various packers, PEiD can effectively inform a user whether a sample has been packed and which packer was used. This feature is particularly important in malware analysis, as unpacking the file is often a necessary step to inspect its true behavior and functionalities. In contrast, the other options serve different purposes within the field of malware analysis. OllyDbg is a powerful debugger used for dynamic analysis, allowing analysts to execute and step through code, but does not specialize in detecting packed files. ResourcesExtract is a tool that can extract resources from Windows executable files, and WhatChanged Portable is used for monitoring changes in the system rather than detecting packed files. Therefore, the selection of PEiD as the method to detect packers in malware samples is based on its dedicated functionality in this area.