Anthropic-Cybersecurity-Skills/skills/analyzing-packed-malware-with-upx-unpacker/references/api-reference.md

API Reference: Packed Malware and UPX Analysis

UPX - Ultimate Packer for eXecutables

Syntax

upx -d <packed_file>                    # Decompress/unpack
upx -d -o <output> <packed_file>        # Unpack to new file
upx -t <file>                           # Test if packed
upx -l <file>                           # List compression info
upx --version                           # Version info

Output Format

        File size         Ratio      Format      Name
   --------------------   ------   -----------   -----------
    184320 <-     98304   53.33%   win32/pe      malware.exe

pefile - Python PE Analysis

Usage

import pefile

pe = pefile.PE("sample.exe")

# Section analysis
for section in pe.sections:
    name = section.Name.rstrip(b"\x00").decode()
    entropy = section.get_entropy()
    print(f"{name}: entropy={entropy:.2f}")

# Import analysis
for entry in pe.DIRECTORY_ENTRY_IMPORT:
    dll = entry.dll.decode()
    for imp in entry.imports:
        print(f"{dll}: {imp.name}")

pe.close()

Packing Indicators

Indicator	Threshold
Section entropy	> 7.0 (high, likely packed/encrypted)
Import count	< 10 (few imports suggest packing)
Virtual/Raw ratio	> 5x (large in-memory expansion)
Section names	UPX0, UPX1, .packed, .nsp

Detect It Easy (DIE) - Packer Identification

Syntax

diec <sample.exe>           # CLI scan
diec -j <sample.exe>        # JSON output

Output

PE32 executable
  Packer: UPX(3.96)[NRV2B_LE32,best]
  Compiler: MSVC(2019)

PEiD - Packer Identification (Legacy)

Packer Signatures Database

Packer	Section Names	Magic Bytes
UPX	UPX0, UPX1, UPX2	UPX! at end of file
ASPack	.aspack, .adata	N/A
PECompact	.pec1, .pec2	N/A
Themida	Various	Encrypted sections
VMProtect	.vmp0, .vmp1	Virtualized code

PEStudio - Static PE Analysis

Key Indicators

Check	Description
Entropy	Section-level entropy analysis
Imports	API import analysis
Strings	Embedded string extraction
Signatures	Packer/compiler identification
Virustotal	Hash-based lookup

x64dbg / x32dbg - Dynamic Unpacking

Generic Unpacking Steps

1. Set breakpoint on VirtualAlloc / VirtualProtect
2. Run until breakpoint
3. Check memory map for new RWX regions
4. Step until original entry point (OEP) reached
5. Dump memory at OEP using Scylla plugin
6. Fix import table with Scylla

Key API Breakpoints

API	Purpose
VirtualAlloc	Memory allocation for unpacked code
VirtualProtect	Change memory protection (RWX)
LoadLibraryA	Load DLLs for import resolution
GetProcAddress	Resolve API addresses
NtWriteVirtualMemory	Write unpacked code to memory

Entropy Interpretation

Range	Interpretation
0-1	Nearly empty/uniform data
1-5	Normal code/data
5-7	Compressed or obfuscated
7-8	Encrypted or packed (maximum ~8.0)