<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->

# Packed Malware Analysis — API Reference

## UPX (Ultimate Packer for eXecutables)

### Commands

```bash
upx -d packed.exe -o unpacked.exe     # Decompress
upx -t packed.exe                      # Test integrity
upx -l packed.exe                      # List file info
upx --best sample.exe -o packed.exe    # Compress (for testing)
```

### Notes

- UPX adds `UPX0`, `UPX1` section names
- Modified UPX (corrupted magic) requires manual fix before `-d`
- Fix: restore `UPX!` magic at expected offset

## pefile (Python)

### Key Methods

```python
import pefile

pe = pefile.PE("sample.exe")

# Section entropy
for s in pe.sections:
    s.get_entropy()          # Shannon entropy (0-8)
    s.Name                   # Section name (bytes)
    s.Misc_VirtualSize       # Virtual size
    s.SizeOfRawData          # Raw size on disk

# Import table
pe.DIRECTORY_ENTRY_IMPORT   # List of ImportData
entry.dll                   # DLL name (bytes)
entry.imports               # List of ImportData with .name

# Entry point
pe.OPTIONAL_HEADER.AddressOfEntryPoint
```

## Unipacker

```bash
pip install unipacker
unipacker sample.exe          # Automatic generic unpacking
```

## PE-sieve

```bash
pe-sieve.exe /pid <PID>                # Scan process
pe-sieve.exe /pid <PID> /shellc        # Include shellcode detection
pe-sieve.exe /pid <PID> /iat 2         # Full IAT scan
pe-sieve.exe /pid <PID> /dmode 1       # Dump modified modules
```

### Output Directory Structure

```
process_<pid>/
├── scan_report.json
├── <module>.dll          # Dumped modified modules
└── shellcode_<addr>.bin  # Detected shellcode
```

## x64dbg Manual Unpacking

### Key Breakpoints

| API | Purpose |
|-----|---------|
| `VirtualAlloc` | Memory allocation for unpacked code |
| `VirtualProtect` | Permission changes before OEP jump |
| `NtWriteVirtualMemory` | Process hollowing writes |
| `IsDebuggerPresent` | Anti-debug check |

### Scylla (IAT Reconstruction)

1. At OEP → Plugins → Scylla
2. IAT Autosearch → Get Imports
3. Fix invalid entries manually
4. Dump → Fix Dump

## Detect It Easy (DiE)

```bash
diec sample.exe              # CLI packer detection
diec -j sample.exe           # JSON output
diec --deep sample.exe       # Deep scan mode
```
