All-in-One Framework for Detection, Unpacking, and Verification for Malware Analysis

Table 3

Existing or proposed techniques used in each phase of the all-in-one unpacking system.

Analytical phase	Techniques used or proposed
Detection	(i) EP Section test to be proposed in Section 4.1
	(ii) Signature test [23]
	(iii) WRITE attribute test [16]
	(iv) Entropy test [17]
Unpacking	(i) Static—library-based unpacking [33]
	(ii) Dynamic—entropy change-based unpacking [14, 27]
Verification	Verification algorithm to be proposed in Section 4.3