Recently I have been working on reverse engineering of binary samples and executables of known malware. Most of them have been packed or encrypted. And to reach the actual data or part of the program we have to find where it is unpacking.

Is there any common way or some technique to unpack malware samples for easier analysis?

  • buts its about malware sample unpacking and malware analysis – Bruteforce Jan 16 '18 at 13:00
  • Nothing to do with information security, its about reverse engineering ! – Soufiane Tahiri Jan 16 '18 at 13:01

To add to what Hector said, I'd like to offer a couple of excellent tools, as well as an illuminating YouTube channel from an industry expert who shows you techniques and tools used to reverse modern malware targets.

  1. Process Dump: Dumps malware memory components back to disk for analysis. Dumping of regions without PE headers is supported and in these cases PE headers and import tables will automatically be generated. Process Dump supports creation and use of a clean-hash database, so that dumping of clean files such as kernel32.dll can be skipped.

  2. PE-Sieve: Detects inline hooks, hollowed processes, process doppelgänging, and much more.

  3. Malware Analysis for Hedgehogs: Funny name for a channel, but absolutely invaluable tutorials for reversing modern malware, including everything from tools, to techniques, to how to set up environments for successful reversing, etc.

There are of couse a multitude of tools and techniques, but what I've mentioned herein should put you on the right path, especially if using the tools mentioned and utilized by MalwareAnalysisForHedgehogs.

| improve this answer | |

Dependent on how the packing/encryption works one common approach is to run the malware (in a sandboxed environment) and then take a dump of it while in memory.

If the malware only temporarily decrypts the parts you wish to see you may need to run the process within a debugger environment.

| improve this answer | |

Not the answer you're looking for? Browse other questions tagged or ask your own question.