PANDI

PANDI is a dynamic packing detection tool designed to analyze software, particularly malware, to determine if it is packed. It leverages the PANDA (Platform for Architecture-Neutral Dynamic Analysis) framework to perform in-depth runtime analysis, providing multiple detection techniques to identify packed code. This is crucial for security researchers and analysts to understand malware behavior and evasion techniques.

Key Features

• Memory Write & Execution Detection — Identifies when a program executes memory it previously wrote to, a common packing indicator.
• Entropy Analysis — Computes entropy of program sections over time, using machine learning to detect packing based on randomness.
• Syscalls Analysis — Monitors imported functions and DLL usage via the Import Address Table (IAT) to detect suspicious activity.
• Automatic DLL Discovery — Parses loaded DLLs in memory to discover exported functions, useful for corrupted or stripped IATs.
• Section Permissions Modification Detection — Tracks changes in section permissions (e.g., read-only to writable) during execution.
• First Bytes Extraction — Captures the first 64 bytes executed, detecting evasion techniques like TLS callbacks.

Philosophy

PANDI emphasizes modular, multi-faceted analysis to improve detection accuracy, combining low-level memory inspection with statistical and machine learning approaches to identify packed software effectively.