Section: New Software and Platforms

PEPAC

PE PAcker Classifier. Version 1.4

Keywords: Packer classification - Packer detection - Entropy - Machine learning - Feature selection - Portable Executable file - Obfuscation - Malware

Functional Description: This program takes a number of PE binary files and runs many packer detection and classification techniques on them, including YARA rules, PEiD rules, hash lists, and ML classifiers. The results are outputted to screen and dumped to disk on .json form.

This program is meant as a convenient way to compare the effectiveness of ML packer classifiers, but can also be used to detect and classify packing techniques in given binaries.

• Participants: Lamine Noureddine and Fabrizio Biondi

• Partner: Cisco

• Contact: Lamine Noureddine

• Publication: Effective, Efficient, and Robust Packing Detection and Classification