I am new to reverse engineering and I am learning about packed files. I saw that most of the time I can recognize a packed file with a little number of import functions in PE file and not many strings but can the export functions in PE file can give me hint if a file been packed?
The presence or absence of exports alone is not enough to tell if a file is packed or unpacked. Most executables have no or very few exports but there are also legitimate executables with many exports. Packing can hide exports but might also leave them visible so it’s not a reliable indicator either way.
It’s better to use other means of detecting packed files: entropy, signatures, runtime analysis and so on.