Malware Theory - Five Unpacking Methods and Generic Unpacking Approach

An overview to unpacking methods, when to apply them and what generic approach to use for unpacking malware.

Malware Course: https://www.udemy.com/course/windows-malware-analysis-for-hedgehogs-beginner-training/?couponCode=9E0FEBA1085CD0AB8036
Follow me on Twitter: https://twitter.com/struppigel

infographics: https://struppigel.github.io/WisdomForHedgehogs/Execution%20Environments/Infographics/

Additional resources:

- Packer identification: https://www.youtube.com/watch?v=ozyBOXpKm1I&t
- Virtualization based obfuscation: https://www.youtube.com/watch?v=b6udPT79itk
- Skim for obvious XOR encryption: https://www.youtube.com/watch?v=xzxg0Jxnv0E
- Run and Dump with PE-Sieve: https://www.youtube.com/watch?v=fwo4XE2xgis
- Debugging and Breakpoints - Agniane Stealer: https://www.youtube.com/watch?v=-KJ0HIvmVl0
- Memory Mapping: https://www.youtube.com/watch?v=cc1tX1t_bLg
- Dumpulator: https://www.youtube.com/watch?v=4Pfu98Xx9Yo
- Self-Extracting Patch: https://youtu.be/DjaptW9gL8E?si=wP0QVqW2S_WsVjiK&t=1865

Tools:

mal_unpack: https://github.com/hasherezade/mal_unpack/releases
binary refinery: https://github.com/binref/refinery
CyberChef: https://gchq.github.io/CyberChef/ …

breakpoints debugger emulation encryption identification malware resources run theory tools unpacking