• Tutorials
  • Courses
  • Tracks

What is a strong indicator that a Windows binary might be packed or obfuscated when viewed in PEStudio?

Last Updated :
Discuss
Comments

What is a strong indicator that a Windows binary might be packed or obfuscated when viewed in PEStudio?

The file has many readable ASCII strings.

Import Table shows only a few generic APIs like LoadLibrary and GetProcAddress.

The file has a digital signature from Microsoft.

The PE header checksum matches exactly.

This question is part of this quiz :

Cyber Quiz Day 46
Tags:
Ethical Hacking
Cybersecurity
Share your thoughts in the comments