On malware sharing communities, I have been noticing that the samples shared are marked as unpacked or dumped. I have tried to load the dumped malware in IDAFree
, however, there is nothing in the imports
table. The malware samples are usually marked as <hash>_dump_0x00980000
for instance. 0x00980000
seems like a memory address. But what does it mean for me trying to analyze it in IDA Free? Do I have to use that information somehow in IDA
to load the sample correctly?
What I know: I realize that most real-world malware are packed. I understand the motivation behind this obfuscation and I understand how it can either be automatically unpacked if we know which packer was used, or it can be manually unpacked by stepping through it in a debugger and dumping relevant memory sections.
However, I do not understand how to analyze these "dumped" samples in IDA free. Most of the time, I see nothing in imports section and that makes the sample really hard to analyze. Is there a difference between unpacked and dumped that I should know about while loading it in IDA
to see the actual imports section?