Detect-It-Easy

die <sample>

Identifies the compiler, packer, and protector of a binary with Detect-It-Easy, the precision signature-based detection.

Run it when you need to know what a binary is built with or protected by: DIE analyzes the file and detects the compiler (Visual C++, MinGW, Go...), the packer (UPX, Themida, VMProtect...), and the protector, along with section entropy. It's the most complete packer detection tool in static analysis — the modern version of pescan with more signatures and a CLI or GUI interface. In IR, DIE is the first step in analyzing a sample: knowing it's Go or packed with Themida completely changes your approach (Go binaries have recognizable signatures, and unpacking Themida is manual).

Don't use it as a complete analysis: DIE identifies format and protections, not capabilities — the rest of the analysis (capa, FLOSS, sandbox) is still necessary. Signatures fail with custom or modified protectors: the absence of detection doesn't mean there's no packing (entropy suggests it). And watch out: DIE detects by signature, and modern compilers change their characteristics — outdated versions give false negatives. For subsequent unpacking, DIE indicates the packer but doesn't unpack it (UPX yes with upx -d; Themida requires manual work).