Low-Entropy Packed Binary Detection via Accurate Hardware Events Profiling

Precisely identifying and classifying packed executables, especially those using a low entropy scheme to obfuscate malicious software, is a crucial aspect of packer analysis. Existing software-based solutions are inadequate, leading to inaccurate identification and classification. In this study, we address this challenge by leveraging Hardware Performance Counters (HPCs) to classify low-entropy packers in binary executables. To detect such packers, we employ kernel-level DLL hijacking to intervene in the unpacking process and collect corresponding HPC data for training classic machine learning models. Our experimental results demonstrate the effectiveness of our approach in identifying packers in both low-entropy and high-entropy packed programs, with the Decision Tree model achieving 100% accuracy. This demonstrates the significant role of HPCs in detecting lowentropy binary packing and suggests promising avenues for further advancement in security analysis techniques.