PEiD for Packer Identification and Unpacking
A forensic analyst is examining a malware sample that uses packing to obfuscate its code. Which static analysis tool is BEST suited to identify the packer used and potentially unpack the executable?
Quick Answer
The answer is PEiD, the Portable Executable Identifier, because it is the best static analysis tool for packer identification and unpacking malware during forensic triage. PEiD works by scanning the executable’s entry point against a database of known signatures for packers, cryptors, and compilers, allowing an analyst to quickly identify the obfuscation method. Once the packer is identified, PEiD can often invoke the packer’s own unpacking stub or use its built-in generic unpacker to restore the original code. On the Computer Hacking Forensic Investigator CHFI exam, this question tests your ability to choose the correct static analysis tool for initial malware triage, with a common trap being to select a dynamic analysis tool like Process Monitor instead. Remember that PEiD is strictly for static signature matching at the entry point, not for runtime behavior. A helpful memory tip: “PEiD peeks at the PE’s entry point to ID the packer.”
⚠ Common exam trap
EC-Council often tests the distinction between static and dynamic analysis tools, and the trap here is that candidates may confuse a dynamic analysis sandbox (Cuckoo) or a general-purpose disassembler (Ghidra, IDA Pro) with a specialized static packer identifier like PEiD.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
PEiD
PEiD (Portable Executable Identifier) is specifically designed to detect packers, cryptors, and compilers used in PE files by scanning for known signatures in the executable's entry point. It is the best static analysis tool for identifying the packer and can often unpack the executable using its built-in generic unpacker or by invoking the packer's own unpacking stub. This makes it ideal for the initial triage of packed malware samples.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✓
PEiD
Why this is correct
PEiD uses signatures to detect packers, cryptors, and compilers. It can also assist in unpacking by identifying the entry point.
- ✗
Cuckoo Sandbox
Why it's wrong here
Cuckoo Sandbox performs dynamic analysis, not static packer identification.
- ✗
Ghidra
Why it's wrong here
Ghidra is a reverse engineering framework, not specifically for packer identification.
- ✗
IDA Pro
Why it's wrong here
IDA Pro is a disassembler/decompiler, not primarily a packer identifier.
Go deeper
Related to this question
About these practice questions
Courseiva writes every CHFI question from scratch — 205 in total, each with an explanation and a wrong-answer breakdown. None are copied from real exams or dumps. Learn why practice questions differ from exam dumps →
Same concept, more angles
1 more way this is tested on CHFI
These questions test the same concept from different angles. Work through them to make sure you can recognise it however the exam phrases it.
Variation 1. A forensic analyst is examining a Windows malware sample using static analysis. Which tool is BEST suited for viewing the PE header structure, including sections, imports, and exports?
easy- A.Strings
- B.Ghidra
- C.IDA Pro
- ✓ D.PEiD
Why D: PEiD is specifically designed to analyze PE (Portable Executable) headers, making it ideal for quickly viewing section tables, import/export tables, and detecting packers or compilers. It parses the IMAGE_NT_HEADERS structure directly, providing a concise summary of the PE layout without requiring disassembly or decompilation.
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This CHFI practice question is part of Courseiva's free EC-Council certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the CHFI exam.