Signs a Sample Is Packed

• High entropy (approaching 8.0 bits/byte) in code sections —- compressed / encrypted data looks random.
• Very few imports (often just LoadLibrary + GetProcAddress) —- the real imports load at runtime.
• Section anomalies: odd names (UPX0, .aspack), raw size virtual size, "write + execute" sections.
• Tiny code / large data, entry point outside normal sections.
• Known packer signatures: DIE / PEiD / YARA detect UPX, etc.