Malware Theory - Five Unpacking Methods and a Generic Unpacking Approach
Channel: MalwareAnalysisForHedgehogs
Date: 2024-03-16

An overview to unpacking methods, when to apply them and what generic approach to use for unpacking malware.

Malware Course: https://www.udemy.com/course/windows-malware-analysis-for-hedgehogs-beginner-training/?couponCode=9E0FEBA1085CD0AB8036
Follow me on Twitter: https://twitter.com/struppigel

infographics: https://struppigel.github.io/WisdomForHedgehogs/Execution%20Environments/Infographics/

Additional resources:

- Packer identification: https://www.youtube.com/watch?v=ozyBOXpKm1I&t
- Virtualization based obfuscation: https://www.youtube.com/watch?v=b6udPT79itk
- Skim for obvious XOR encryption: https://www.youtube.com/watch?v=xzxg0Jxnv0E
- Run and Dump with PE-Sieve: https://www.youtube.com/watch?v=fwo4XE2xgis
- Debugging and Breakpoints - Agniane Stealer: https://www.youtube.com/watch?v=-KJ0HIvmVl0
- Memory Mapping: https://www.youtube.com/watch?v=cc1tX1t_bLg
- Dumpulator: https://www.youtube.com/watch?v=4Pfu98Xx9Yo
- Self-Extracting Patch: https://youtu.be/DjaptW9gL8E?si=wP0QVqW2S_WsVjiK&t=1865

Tools:

mal_unpack: https://github.com/hasherezade/mal_unpack/releases
binary refinery: https://github.com/binref/refinery
CyberChef: https://gchq.github.io/CyberChef/

00:00 Intro
01:00 Five unpacking methods
03:50 Generic unpacking approach
04:17 Identification
06:10 Skim for obvious encryption
08:03 Run and Dump
08:27 Debugger and Breakpoints
11:30 Emulation and Self-Extracting Patch

#packers #unpacking #reverseengineering #injection