Tip: Use command pepack fake-malware-packed.exeĭoes the PEScan tool in Linux detect the file is packed? If so, what does it report about it? Tip: Use command trid fake-malware-packed.exeĭoes the PEPack tool in Linux detect the file is packed? If so, what does it report about it? Tip: Use command diec fake-malware-packed.exe.ĭoes the TrID tool in Linux detect the file is packed? If so, what does it report about it? (This is the command-line version of Detect It Easy for Linux, so results should be similar to Windows). Tip: Use command pescan fake-malware-packed.exeĬompare and contrast the unpacked and packed files using information obtained from PeStudio and IDA. What is the address of the program entry point, and what code section is it within? (Look under the optional-headers category).

What interesting strings do you see? (Don't list them all for the original file) How many of those functions does PEStudio flag on its blacklist? How many API calls are used? (Imported functions) PESTUDIO 8.

How many subroutines (functions) exist in the program code? (In IDA, View->Open Subviews->Functions) What is the name of each section, its virtual-size, its raw-size, and its entropy?įrom that observation alone, what section of the packed file likely has a payload?įrom that observation alone, where do you think the unpacked payload will go? (Not every packer will have such an obvious location). Unpack it via upx -d fake-malware-packed.exe to fake-malware-unpacked.exe, and then.Note that UPX will overwrite the original file with its output file! Thus, you should: Use the open-source UPX packer to unpack your fake malware. Note that real malware packers will not have convenient command-line extraction capabilities. Also, it is unlikely that you will have access to the same packer program that the malware author used.

Pestudio