On malware sharing communities, I have been noticing that the samples shared are marked as unpacked or dumped. I have tried to load the dumped malware in
IDAFree, however, there is nothing in the
imports table. The malware samples are usually marked as
<hash>_dump_0x00980000 for instance.
0x00980000 seems like a memory address. But what does it mean for me trying to analyze it in IDA Free? Do I have to use that information somehow in
IDA to load the sample correctly?
What I know: I realize that most real-world malware are packed. I understand the motivation behind this obfuscation and I understand how it can either be automatically unpacked if we know which packer was used, or it can be manually unpacked by stepping through it in a debugger and dumping relevant memory sections.
However, I do not understand how to analyze these "dumped" samples in IDA free. Most of the time, I see nothing in imports section and that makes the sample really hard to analyze. Is there a difference between unpacked and dumped that I should know about while loading it in
IDA to see the actual imports section?