Section Red Flags

Things that make an analyst suspicious at a glance:

• Writable AND executable (W+X) sections. Normal code is R-X; W+X screams self-modifying / unpacking stub.
• Weird section names: UPX0, UPX1, .aspack, .themida, random junk — packer signatures.
• Raw size 0 but large virtual size: nothing on disk, big region in memory — the section is filled at runtime by an unpacker.
• Entry point outside 0: execution starts in a data-looking section — often a packer stub.
• Very high entropy in a section — compressed or encrypted.

Example

UPX-packed files typically show UPX0 (raw size 0, huge virtual

size = the unpack target) and UPX1 (holds the compressed data +

the unpacking stub, which is W+X).