Malware Theory - Five Unpacking Methods and a Generic Unpacking Approach
An overview to unpacking methods, when to apply them and what generic approach to use for unpacking malware.
Malware analysis courses: https://malwareanalysis-for-hedgehogs...
Follow me on Twitter: / struppigel
infographics: https://struppigel.github.io/WisdomFo...
Additional resources:
Packer identification: • Malware Theory - Packer identifiers don't ...
Virtualization based obfuscation: • Analysis of Virtualization-based Obfuscati...
Skim for obvious XOR encryption: • Malware Analysis - Unpacking AutoIt stub w...
Run and Dump with PE-Sieve: • PE-sieve: an open-source scanner for hunti...
Debugging and Breakpoints - Agniane Stealer: • Malware Analysis - Agniane Stealer, Native...
Memory Mapping: • Malware Theory - Memory Mapping of PE Files
Dumpulator: • Dumpulator - Using Binary Emulation To Aut...
Self-Extracting Patch: • Malware Analysis - 3 ways to deobfuscate J...
Tools:
mal_unpack: https://github.com/hasherezade/mal_un...
binary refinery: https://github.com/binref/refinery
CyberChef: https://gchq.github.io/CyberChef/
00:00 Intro
01:00 Five unpacking methods
03:50 Generic unpacking approach
04:17 Identification
06:10 Skim for obvious encryption
08:03 Run and Dump
08:27 Debugger and Breakpoints
11:30 Emulation and Self-Extracting Patch
#packers #unpacking #reverseengineering #injection