analyzing-packed-malware-with-upx-unpacker

Analyzing Packed Malware with UPX Unpacker

When to Use

• Static analysis reveals high entropy sections and minimal imports indicating the binary is packed
• PEiD, Detect It Easy, or PEStudio identifies UPX or another known packer
• The import table contains only LoadLibrary and GetProcAddress (runtime import resolution typical of packed binaries)
• You need to recover the original binary for proper disassembly and decompilation in Ghidra or IDA
• Automated UPX decompression fails because the malware author modified UPX magic bytes or headers

Do not use when dealing with custom packers, VM-based protectors (Themida, VMProtect), or samples where dynamic unpacking via debugging is more appropriate.

Prerequisites

• UPX (Ultimate Packer for eXecutables) installed (apt install upx-ucl or download from https://upx.github.io/)
• Detect It Easy (DIE) for packer identification
• Python 3.8+ with pefile library for manual header repair
• x64dbg or x32dbg for manual unpacking when automated tools fail
• PE-bear or CFF Explorer for PE header inspection and repair
• Isolated analysis VM without network connectivity

Workflow

Step 1: Identify the Packer

Determine if the sample is packed and identify the packer:

# Check with Detect It Easy
diec suspect.exe

# Check with UPX (test without unpacking)
upx -t suspect.exe

# Python-based entropy and packer detection
python3 << 'PYEOF'
import pefile
import math

pe = pefile.PE("suspect.exe")

print("Section Analysis:")
for section in pe.sections:
    name = section.Name.decode().rstrip('\x00')
    entropy = section.get_entropy()
    raw = section.SizeOfRawData
    virtual = section.Misc_VirtualSize
    print(f"  {name:8s} Entropy: {entropy:.2f}  Raw: {raw:>8}  Virtual: {virtual:>8}")

# Check for UPX section names
section_names = [s.Name.decode().rstrip('\x00') for s in pe.sections]
if 'UPX0' in section_names or 'UPX1' in section_names:
    print("\n[!] UPX section names detected")
elif '.upx' in [s.lower() for s in section_names]:
    print("\n[!] UPX variant section names detected")

# Check import count (packed binaries have very few)
if hasattr(pe, 'DIRECTORY_ENTRY_IMPORT'):
    total_imports = sum(len(e.imports) for e in pe.DIRECTORY_ENTRY_IMPORT)
    print(f"\nTotal imports: {total_imports}")
    if total_imports < 10:
        print("[!] Very few imports - likely packed")
else:
    print("\n[!] No import directory - heavily packed")
PYEOF