Packing and Entropy (Bridge to Dynamic Analysis)

Packing: compress/encrypt the real code into a section, prepend a

small unpacking stub. At runtime the stub restores the original code in

memory, then jumps to it.

• Defeats static analysis: strings and imports are hidden until runtime.
• Common packers: UPX (easy), ASPack, Themida, VMProtect (hard).

Entropy measures randomness (0—8 bits/byte):

• Normal code / data: roughly 4—6.5.
• Compressed or encrypted: approaching 8 — a packing indicator.

Why this leads to dynamic analysis

You often cannot fully understand a packed sample from headers alone. The

next step is to run it safely and dump the unpacked image from

memory — our upcoming dynamic-analysis material.