pescan

pescan <sample.exe>

Detects the packing of a PE executable with pescan, identifying the packer (UPX, Themida...) by section signatures.

Run it when you need to know if the sample is packed and with what: pescan analyzes the PE sections and compares them against known packer signatures (UPX, Themida, VMProtect, ASPack...) — the result is the identified packer or packing indicators (entropy, anomalous sections). It's the precision tool for packing: knowing the sample is UPX indicates direct unpacking (upx -d), while Themida or VMProtect require manual unpacking. In IR, pescan is the step before deep analysis: the packed binary is unpacked before capa and FLOSS.

Don't use it as a complete analysis: pescan identifies packing, not capabilities or content — the rest of the analysis (capa, FLOSS, sandbox) is still necessary. Custom or modified packers won't match signatures: the absence of a match doesn't mean there's no packing (section entropy suggests it). And watch out: false positives exist — legitimate compilers and protectors share characteristics with packers; cross-check the result with peframe and section analysis. For UPX-packed samples, automatic unpacking; for the rest, manual unpacking tools.