[R00tKit]

hi
how can find my PE is packed? and what packer is used for pack it ?

manually find packer any tools like PEID ,...

[Xylitol]

You can use some tool like PEiD yep http://www.peid.info/
or Protection iD is more recent than PEiD about packer signature http://pid.gamecopyworld.com/
but in malware you will see alot of custom packing technics (and ephemeral, a crypter will not be full undetect a long time)
or simply by loading your binary in a debugger like ollydbg, it will says you if something is wrong with the file.
about packer there is alot of packer we cant says all names :)
the most know and used is upx i think

[EP_X0FF]

DiE v0.64
http://unpacking.narod.ru/analiz/DiE_0.64.rar

EXEInfo PE
http://www.softpedia.com/get/Programmin ... o-PE.shtml

RDG Packer Detector v0.6.6
http://unpacking.narod.ru/analiz/RDGPac ... .6_2k8.rar

[kareldjag/michk]

hi
Cheking these days a few Go of cloud malware collection...and about 30% are compressed by UPX.
ProtectionID is mostly designed vs gaming protection.
To Peid and Exeinfo PE could also be added Stud PE that comes as a program http://www.cgsoftlabs.ro/studpe.html
Also Fuu designed with the help of Titan Engine http://code.google.com/p/fuu/ (x64 version available)
PackerBreaker from the dev. of SysReveal http://www.sysreveal.com/pb-peidt-v0-4/
Bit Detector, promising with plugins, but i do not link to the dev. site full of Keygens...
http://www.softpedia.com/get/PORTABLE-S ... ctor.shtml

As usual, tools, programs like antivirus are just a help that save time, they are not the panacea...as summarized by this exemple
http://fumalwareanalysis.blogspot.nl/20 ... ation.html
Packers signatures is the same dead end as for malwares...an NP-Complete problem and a Sisyphus task http://en.wikipedia.org/wiki/Sisyphus
Even if some editors try to help like Panda http://research.pandasecurity.com/blogs ... userdb.txt
Well...can not attach some files (http://www.kernelmode.info/forum/viewto ... 844#p20312)...new version of RDG and DIE, plus FastScanner, DNiD, interesting for Dot/Net files, and a python plugin for Immunity Debugger
The password is the usual one for my attached files http://sendbox.fr/pro/sb2dveglktjt/Detectors.zip.html

Rgds