ASProtect or UPX?

[deroko]

Section .adata is common for asprotect and aspack, and because you have push/call/retn/retn at ep, it seems like asprotect. But be carful it might be fake signature

Check the section characteristics.

For UPX, there are either 2 to 3 sections found. The third section is the resource section. The first section characteristic has a flag 0xE0000080, the second flag 0xE0000040. The resource section characteristic 0xC0000040.

For Asprotect/Aspack, all the sections have the characteristic 0xE0000040. There are 3 to 5 sections found. Default compression with Asprotect, the first two sections usually have blank names.

In addition to deroko's reply, there are 5 sections where the first two sections have blank names. It is indeed packed by Asprotect.