analyzing-packed-malware-with-upx-unpacker

Featured

Identifies and unpacks UPX-packed and other packed malware samples to expose the original executable code for static analysis. Covers both standard UPX unpacking and handling modified UPX headers that prevent automated decompression. Activates for requests involving malware unpacking, UPX decompression, packer removal, or preparing packed samples for analysis.

AI & Automation 12,642 stars 1468 forks Updated today Apache-2.0

Install

View on GitHub

Quality Score: 99/100

Stars 20%
100
Recency 20%
100
Frontmatter 20%
70
Documentation 15%
100
Issue Health 10%
50
License 10%
100
Description 5%
100

Skill Content

# Analyzing Packed Malware with UPX Unpacker ## When to Use - Static analysis reveals high entropy sections and minimal imports indicating the binary is packed - PEiD, Detect It Easy, or PEStudio identifies UPX or another known packer - The import table contains only LoadLibrary and GetProcAddress (runtime import resolution typical of packed binaries) - You need to recover the original binary for proper disassembly and decompilation in Ghidra or IDA - Automated UPX decompression fails because the malware author modified UPX magic bytes or headers **Do not use** when dealing with custom packers, VM-based protectors (Themida, VMProtect), or samples where dynamic unpacking via debugging is more appropriate. ## Prerequisites - UPX (Ultimate Packer for eXecutables) installed (`apt install upx-ucl` or download from https://upx.github.io/) - Detect It Easy (DIE) for packer identification - Python 3.8+ with `pefile` library for manual header repair - x64dbg or x32dbg for manual unpacking when automated tools fail - PE-bear or CFF Explorer for PE header inspection and repair - Isolated analysis VM without network connectivity ## Workflow ### Step 1: Identify the Packer Determine if the sample is packed and identify the packer: ```bash # Check with Detect It Easy diec suspect.exe # Check with UPX (test without unpacking) upx -t suspect.exe # Python-based entropy and packer detection python3 << 'PYEOF' import pefile import math pe = pefile.PE("suspect.exe") print("Section A...

Details

Author
mukul975
Repository
mukul975/Anthropic-Cybersecurity-Skills
Created
3 months ago
Last Updated
today
Language
Python
License
Apache-2.0

Similar Skills

Semantically similar based on skill content — not just same category

AI & Automation Featured

performing-static-malware-analysis-with-pe-studio

Performs static analysis of Windows PE (Portable Executable) malware samples using PEStudio to examine file headers, imports, strings, resources, and indicators without executing the binary. Identifies suspicious characteristics including packing, anti-analysis techniques, and malicious imports. Activates for requests involving static malware analysis, PE file inspection, Windows executable analysis, or pre-execution malware triage.

12,642 Updated today
mukul975
Data & Documents Listed

malware-analyst

Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral analysis, and malware family identification. Handles static/dynamic analysis, unpacking, and IOC extraction. Use PROACTIVELY for malware triage, threat hunting, incident response, or security research.

335 Updated today
aiskillstore
AI & Automation Featured

reverse-engineering-dotnet-malware-with-dnspy

Reverse engineers .NET malware using dnSpy decompiler and debugger to analyze C#/VB.NET source code, identify obfuscation techniques, extract configurations, and understand malicious functionality including stealers, RATs, and loaders. Activates for requests involving .NET malware analysis, C# malware decompilation, managed code reverse engineering, or .NET obfuscation analysis.

12,642 Updated today
mukul975
AI & Automation Featured

malware-analyst

Expert malware analyst specializing in defensive malware research, threat intelligence, and incident response. Masters sandbox analysis, behavioral analysis, and malware family identification.

39,227 Updated today
sickn33
AI & Automation Featured

reverse-engineering-malware-with-ghidra

Reverse engineers malware binaries using NSA's Ghidra disassembler and decompiler to understand internal logic, cryptographic routines, C2 protocols, and evasion techniques at the assembly and pseudo-C level. Activates for requests involving malware reverse engineering, disassembly analysis, decompilation, binary analysis, or understanding malware internals.

12,642 Updated today
mukul975