Packer Attribution in Malware Analysis

• Packer Attribution is the process of identifying the specific executable packer used to modify binary code, crucial for malware forensic analysis.
• It employs static program analysis and graph matching networks to extract and compare unpacking stubs from packer-transformed executables.
• The methodology enhances threat intelligence by automating malware triage through clustering, similarity measurement, and machine learning.

Packer Attribution is the technical discipline concerned with identifying the specific executable packer or packing tool used to transform a software sample's binary structure, with particular relevance to malware analysis and reverse engineering. Executable packers function by compressing, encrypting, or otherwise transforming a program's code and inserting a custom unpacking stub, defeating conventional static analysis tools that rely on unmodified code. Accurate packer attribution enables more effective forensic analysis, improves automation in malware triage, and enhances the precision of threat intelligence pipelines. The field integrates methodologies from static program analysis, graph-based representation learning, cluster analysis, and machine learning.

1. Problem Setting: Executable Packers and Their Significance

Executable packers modify the static structure of a program by obfuscating its true code and introducing an unpacking stub. This process undermines static signature-based scanners and classical feature-driven ML detectors, which may classify all packed binaries as generically suspicious or fail to observe the true program payload. Packers incorporate anti-analysis features, including environmental checks and virtualization-based obfuscation, to evade both manual and automated analysis, thereby complicating attribution and hindering malware reverse engineering tasks (Gennaro et al., 31 May 2025).

Signature-based identification tools such as Detect It Easy and PEiD depend on handcrafted or automatically extracted byte patterns that occur within unpacking stubs. These approaches require constant manual updates for new or customized packers, and tend to be fragile against packers employing dynamic anti-analysis methods (e.g., environmental awareness, code virtualization). Feature-based ML approaches extract global features—such as entropy profiles and control-flow/call-graph metrics—then train classifiers (e.g. SVM, k-NN), but are sample-intensive and generalize poorly to new or evolving packer variants.

2. Static Analysis Pipeline for Packer Attribution

A robust static analysis pipeline for packer attribution aims to extract packer-revealing structure from binary executables, independent of input code. The workflow comprises call-graph (CG) extraction, node-level feature encoding, and input reduction to the unpacking stub.

Call-Graph Extraction:

• Disassembly and function identification are performed on Windows Portable Executable (PE) files using tools such as radare2. All functions $F$ with at least one call instruction are included, and entry-point functions $E$ are recorded.
• The program's directed call-graph $G = (V, E)$ is constructed, with each node representing a function and edges denoting function calls.

Unpacking Stub Isolation:

• Algorithm 1 filters the CG to the unpacking stub by treating $G$ as undirected, then extracting components containing entry points. If no edges exist, entry points and any external-library calls are retained. This typically reduces the unpacking stub CG to ≈3 functions per instance (Gennaro et al., 31 May 2025).

Node-Feature Representation:

• Each node $v$ receives a 12-dimensional feature vector $x_v \in \mathbb{R}^{12}$, including:
  • type (internal/imported/entry)
  • size, real size (bytes)
  • is_pure (side effect-free)
  • calling convention
  • number of basic blocks, instructions, local variables, arguments
  • number of basic block edges, indegree, outdegree

The resulting stub CG is $G=(V, E, X)$, with $X$ as a $|V| \times 12$ feature matrix.

3. Graph Matching Networks for Packer Modeling

The core methodology in modern packer attribution is learning graph-based representations to capture the structural invariants of unpacking stubs across samples packed by the same tool.

Siamese Graph Matching Network (GMN):

• The GMN accepts pairs of stub call-graphs $(G_1, G_2)$ and generates embeddings $E$0, optimized for cosine similarity to reflect packer identity. The following procedure is adapted from Li et al. 2019 as outlined in PackHero (Gennaro et al., 31 May 2025):
  • Initial node features are projected with an MLP: $E$1, where $E$2.
  • $E$3 rounds of intra- and cross-graph message passing:
  • 1. Intra-graph messages are aggregated using learnable MLPs over the node neighborhood.
  • 2. Cross-graph attention weights are computed to gather corresponding information from the other graph.
  • 3. Node states are updated using a GRU with concatenated intra- and cross-graph messages.
  • Graph-level embeddings are computed using a permutation-invariant readout function (sum or mean pooling).

Similarity and Loss:

• Graph similarity is measured by cosine similarity:

$E$4

• A margin-based contrastive loss encourages high similarity for same-packer pairs and low similarity for others:

$E$5

4. Clustering and Inference Workflow

To enable scalable indexing and low-cost inference, packer embeddings are clustered and medoids are used as representatives. The clustering process is as follows:

Step	Description	Purpose
1	For each packer $E$6, maintain database $E$7 of all training CGs	Organize samples by packer
2	Compute pairwise similarities $E$8 within each $E$9	Measure intra-packer cohesion
3	Hierarchical clustering (single-linkage, silhouette-based cut)	Form clusters of similar CGs
4	For each cluster $G = (V, E)$0, select medoid $G = (V, E)$1 minimizing total intra-cluster distance	Reduce comparison set
5	Compute and store threshold $G = (V, E)$2 (mean intra-cluster similarity minus standard deviation)	Set acceptance boundary

Inference:

• Incoming sample is reduced to a stub CG, embedded via GMN.
• For each packer cluster, sample–medoid similarity is computed. Only clusters with non-negative similarity are considered further.
• Within selected clusters, sample is compared to all member CGs. The number of samples where similarity exceeds threshold $G = (V, E)$3 is counted:

$G = (V, E)$4

• Per-packer score: $G = (V, E)$5.
• The predicted packer $G = (V, E)$6 is chosen as $G = (V, E)$7 if $G = (V, E)$8; otherwise, the sample is labeled as "unknown."
• This design ensures inference complexity is independent of overall database size, depending only on the number of clusters and average cluster size (Gennaro et al., 31 May 2025).

5. Evaluation Methodologies and Metrics

Packer attribution approaches are evaluated using labeled datasets of executables packed by known tools. PackHero's evaluation employs:

Datasets:

• Lab-10: Windows x86 PEs, benign and malicious, each re-packed with 9 commercial and open-source packers (e.g., kkrunchy, MPRESS, Obsidium, PECompact