This question already has an answer here:

Recently I have been working on reverse engineering of binary samples and executables of known malware. Most of them have been packed or encrypted. And to reach the actual data or part of the program we have to find where it is unpacking.

Is there any common way or some technique to unpack malware samples for easier analysis?

marked as duplicate by julian, perror, Megabeets, Paweł Łukasik, Community Jan 19 '18 at 19:18

This question has been asked before and already has an answer. If those answers do not fully address your question, please ask a new question.

migrated from security.stackexchange.com Jan 16 '18 at 15:24

This question came from our site for information security professionals.

  • buts its about malware sample unpacking and malware analysis – Bruteforce Jan 16 '18 at 13:00
  • Nothing to do with information security, its about reverse engineering ! – Soufiane Tahiri Jan 16 '18 at 13:01

To add to what Hector said, I'd like to offer a couple of excellent tools, as well as an illuminating YouTube channel from an industry expert who shows you techniques and tools used to reverse modern malware targets.

  1. Process Dump: Dumps malware memory components back to disk for analysis. Dumping of regions without PE headers is supported and in these cases PE headers and import tables will automatically be generated. Process Dump supports creation and use of a clean-hash database, so that dumping of clean files such as kernel32.dll can be skipped.

  2. PE-Sieve: Detects inline hooks, hollowed processes, process doppelgänging, and much more.

  3. Malware Analysis for Hedgehogs: Funny name for a channel, but absolutely invaluable tutorials for reversing modern malware, including everything from tools, to techniques, to how to set up environments for successful reversing, etc.

There are of couse a multitude of tools and techniques, but what I've mentioned herein should put you on the right path, especially if using the tools mentioned and utilized by MalwareAnalysisForHedgehogs.


Dependent on how the packing/encryption works one common approach is to run the malware (in a sandboxed environment) and then take a dump of it while in memory.

If the malware only temporarily decrypts the parts you wish to see you may need to run the process within a debugger environment.

Not the answer you're looking for? Browse other questions tagged or ask your own question.