Analyzing Packed Malware with UPX Unpacker

When to Use

• Static analysis reveals high entropy sections and minimal imports indicating the binary is packed
• PEiD, Detect It Easy, or PEStudio identifies UPX or another known packer
• The import table contains only LoadLibrary and GetProcAddress (runtime import resolution typical of packed binaries)
• You need to recover the original binary for proper disassembly and decompilation in Ghidra or IDA
• Automated UPX decompression fails because the malware author modified UPX magic bytes or headers

Do not use when dealing with custom packers, VM-based protectors (Themida, VMProtect), or samples where dynamic unpacking via debugging is more appropriate.

Prerequisites

• UPX (Ultimate Packer for eXecutables) installed (apt install upx-ucl or download from https://upx.github.io/)
• Detect It Easy (DIE) for packer identification
• Python 3.8+ with pefile library for manual header repair
• x64dbg or x32dbg for manual unpacking when automated tools fail
• PE-bear or CFF Explorer for PE header inspection and repair
• Isolated analysis VM without network connectivity

Workflow

Step 1: Identify the Packer

Determine if …