A WinAppDbg script that automates malware unpacking by detecting unpacking behaviors and dumping decrypted memory.
Unpacker is a Python-based automated malware unpacking tool that uses WinAppDbg to detect and extract packed malware code during execution. It solves the problem of manual unpacking by automatically identifying unpacking behaviors, dumping decrypted memory blocks, and extracting the original malicious payload for analysis.
Malware analysts, reverse engineers, and security researchers who need to analyze packed Windows malware samples efficiently.
Developers choose Unpacker because it automates the tedious process of malware unpacking using behavioral analysis, supports multiple unpacking techniques, and integrates with standard Windows debugging tools.
Automated malware unpacker
Open-Awesome is built by the community, for the community. Submit a project, suggest an awesome list, or help improve the catalog on GitHub.
Focuses on runtime observations like entry point jumps and unpacking loops, making it adaptable to various packing techniques without relying on static signatures, as per the project philosophy.
Dumps unpacked code, decrypted memory blocks from CryptDecrypt(), and decompressed buffers from RtlDecompressBuffer(), essential for extracting original malicious payloads during analysis.
Attempts to identify and dump memory blocks injected via process hollowing techniques, a common malware evasion method highlighted in the README.
Extracts decrypted network traffic from malware communications, aiding in further analysis of command-and-control servers and data exfiltration.
The README explicitly states it only detects certain unpacking behaviours and not all, meaning it may fail on novel, complex, or unsupported packing techniques, limiting reliability.
Requires installation of Python and WinAppDbg, which can be non-trivial and time-consuming for users unfamiliar with these tools or debugging environments.
Primary guidance is via external blog posts, and the README lacks detailed usage instructions, making onboarding and troubleshooting difficult for new users.