关键词: PE头部, 壳检测, 带权欧拉距离

Abstract:

More and more malware is appearing on the Internet, the authors of the malware want to gain illegal purposes by inserting malicious code into the users’ computers, such as achieving the users’ names and passwords. In order to prevent computers from being attcked, software analyzers need to analyze the principle of the malware, however, if the malware is packed, it is very difficult to analyze. We must unpack the malware and the first step of unpacking is to detect whether the malware is packed or not. This paper proposes a packed PE file detection method based on a weighted Euclidean distance analysis (PDWED) algorithm by analyzing and comparing the differences between the unpacked and the packed software on the PE header, which includes constructing a vector of 10 elements,distributing weighted value for each element,and calculating the weighted Euclidean distance of the vector. The experimental results show that PDWED can detect whether the software is packed or not quickly and accurately.

Key words: PE header；packed detection;weighted Euclidean distance