@inproceedings{4ba02ae82941499e9d8e2e88c1f381d3,
title = "Packed PE file detection for malware forensics",
abstract = "In malware accident investigation, the most important thing is detection of malicious code. Signature based anti-virus software have been used in most of the accident. Malware can easily avoid signature based detection by using packing or encryption method. Because of this, packed file detection is also important. Detection methods can be divided into signature based detection and entropy based detection. Signature based detection can not detect new packing. And entropy based detection has a problem with false positive. We provides detection method using entropy statistics of the entry point section and 'write' properties of essential characteristic of packed file. And then, we show packing detection tool and evaluate its performance.",
keywords = "Component, Entropy, Malware forensics, PE file analysis, Packing detection",
author = "Seungwon Han and Keungi Lee and Sangjin Lee",
year = "2009",
doi = "10.1109/CSA.2009.5404211",
language = "English",
isbn = "9781424449460",
series = "Proceedings of the 2009 2nd International Conference on Computer Science and Its Applications, CSA 2009",
booktitle = "Proceedings of the 2009 2nd International Conference on Computer Science and Its Applications, CSA 2009",
note = "2009 2nd International Conference on Computer Science and Its Applications, CSA 2009 ; Conference date: 10-12-2009 Through 12-12-2009",
}