“” is published by Andrey Pautov in InfoSec Write-ups.

InfoSecWriteUps' platform is  dedicated to providing insights and resources for cybersecurity professionals and enthusiasts. Through articles, tutorials, and security research, InfoSecWriteUps offers insights into cybersecurity vulnerabilities, attack techniques, and defense strategies. Readers can learn about penetration testing, threat intelligence, and incident response to enhance their cybersecurity knowledge and skills.

InfoSec Write-ups

Unpacker is a modular Python tool for detecting and unpacking packed malware (UPX, ASPack, Themida, VMProtect, MPRESS). It uses a pipeline of detection methods—section names, entropy, heuristics, and path hints—to identify the packer, then dispatches to the appropriate unpacker module. UPX uses native decompression; ASPack, Themida, and VMProtect use emulation-based unpacking via Unipacker (PE32) or Qiling (PE32+). The guide covers architecture, per-packer unpacking techniques, CLI usage, and validation workflows using two companion tools: String Analyzer (entropy and string classification) and fileinfo.py (file metadata and PE structure). Real examples show entropy dropping from 7.86 to 6.21 and file size doubling after unpacking, providing reproducible proof of successful decompression. Limitations include PE32-only support for Unipacker-based unpackers and potential timeouts for complex protectors.

Unpacker: A Practical Guide to Modular Malware Packer Detection and Unpacking