Get Omniunpack Fast Generic And Safe Unpacking Of Malware - Acsac

Windows CategoryToolPurposeUnpackingUPXPacker/unpacker for executablesUnpackingScyllaRecover executable from packed binary after running (Blog post on usage)UnpackingUniversal Import Fixer (UIF)Reveal obfuscated imports in binaryUnpackingImports FixerReveal obfuscated imports in binary33 more rows

Malware that is packed or obfuscated contains very few strings. If upon searching a program with Strings, you find that it has only a few strings, it is probably either obfuscated or packed, suggesting that it may be malicious.

Malware writers often use packing or obfuscation to make their files more difficult to detect or analyze. Obfuscated programs are ones whose execution the malware author has attempted to hide. Packed programs are a subset of obfuscated programs in which the malicious program is compressed and cannot be analyzed.

Packing is the most common analysis avoidance technique for hiding malware. Also, packing can make it harder for the security researcher to identify the behaviour of malware and increase the analysis time. In order to analyze the packed malware, we need to perform unpacking first to release the packing.

Exeinfo PE is one such tool that will analyze the code to determine if it has been packed. It can often identify the packer used as well. UPX is one commonly used packer tool that includes the unpacking feature.

In essence, a malware packer is a tool used to mask a malicious file. Packers can encrypt, compress or simply change the format of a malware file to make it look like something else entirely.

Packers, crypters, and protectors are tools that can be used to obfuscate malware by packing, compressing or encrypting its binary; to make it harder and tedious to analyze by the malware analyst using static analysis.

The best (and quickest) way to unpack packed malware is to use a tool. Exeinfo PE is one such tool that will analyze the code to determine if it has been packed. It can often identify the packer used as well. UPX is one commonly used packer tool that includes the unpacking feature.