BinStat Tool for Recognition of Packed Executables

The quantity of malicious artifacts (malware) generated by the combination of unique attack goals, unique targets and various tools available for the developers, demands the automation of prospecting and analysis of said artifacts. Considering the fact that one problem handled by experts in analysis of executable code is packing, this paper presents a method of packing detection through the appliance of statistical and information theory metrics. The tool developed in this study, called BinStat, generated a high recognition rate of executable packing status within the test samples, proving its effectiveness.