> For the complete documentation index, see [llms.txt](https://docs.hex-rays.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.hex-rays.com/ida-9.5/add-ons/malware/how-tos/unpack-a-malware-sample.md).

# Unpack a Malware Sample

The generic unpacker tries to be as independent as possible, only making a few questions and making sure the default options are good enough for most use cases. In the following sections we will show how to unpack a specific malware sample, the following one with SHA256 hash `18ddfc65f3f0111445818f4b23e4f9aad5bd21930d133a5e326d0bd44ae019ad`, which seems to be packed with Enigma Protector, a legal commercial software protector.

## A simple step by step guide

First, we will simply open the binary in IDA and let it finish the initial auto-analysis. After a while, it will finish, the unpacker will do its first checks and determine the binary is packed. Checking if the binary seems to be packed is done by checking the ratio of bytes of code correlated to the total number of bytes in the sections with code, and as we can see with this specific malware sample, it's (almost) 0.0%:

```
[2026-10-05 17:24:56,516] INFO: Code-to-section ratio: 0.0% (threshold: 10%)
[2026-10-05 17:24:56,516] INFO: Binary appears packed
```

Also, it only has one function imported per library in the Import Address Table (IAT), with the only exception of Kernel32.dll, which is a usual indicator of a sample being packed:

![Initially imported libraries and functions](https://492083732-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFP6ibt8r6WPBHTqekG9u%2Fuploads%2Fgit-blob-457f2a8688accb70792266b38dffb399e4b2ef0d%2Fpacker-initial-iat.png?alt=media)

So, when a sample looks like packed, the unpacker will ask us if we like to unpack it now:

![The 'Do you want to try to unpack it' dialogue](https://492083732-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFP6ibt8r6WPBHTqekG9u%2Fuploads%2Fgit-blob-49fbf01e59662d3abc6d1565a3dd81b2631e2fbc%2Funpack-dialogue-1.png?alt=media)

We will press on "No" for now. As we can see in the screenshot below, IDA only found 2 wrong functions and that's it, we have not enough information to start the analysis with vanilla IDA:

![Initial view in IDA of the sample just opened](https://492083732-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFP6ibt8r6WPBHTqekG9u%2Fuploads%2Fgit-blob-867d113c43c2882bac7d8042ebe6ce3121042c64%2Finitial-load-ida.png?alt=media)

Now, we will run the generic unpacker by either using its shortcut (Shift+P) or going to menu `Extensions -> Malware Analysis -> Unpacker -> Unpack now`. It will first show a warning message telling us that unpacking is a destructive process as it will undefine almost everything inside the current database. Click on "Yes", and it will show the following dialogue:

![Dialogue to choose an unpacking heuristic](https://492083732-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFP6ibt8r6WPBHTqekG9u%2Fuploads%2Fgit-blob-09107e4bc1b291262909c63a553982e6d31670fe%2Fchoose-unpacking-heuristic.png?alt=media)

Here we can choose which unpacking strategy we want to use for unpacking the sample. The unpacker asks registered heuristic plugins to determine if a specific one is the best suited one for the currently opened binary, in case there is a specific heuristic for some specific packer, and otherwise will just offer as the default option the heuristic `run-until-timeout`. In this case, we will choose this heuristic and press OK. The unpacker will run the malware sample using the previously configured safe debugging backend, like the Bochs debugger, which is the default one in case none was configured. While the sample is running it will show some execution errors which are fine to ignore, as they happen because in this case we aren't using a complete Windows environment but rather a partial emulator (Bochs):

`8D15DF: Page fault at 0x300905A55, error code 4 -> 0000000300905A55 (exc.code e, tid 2476)`

Moments later, it will pause the execution and start doing its job, as shown in the screenshot below:

![IDA's output window showing some data about the unpacked malware](https://492083732-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFP6ibt8r6WPBHTqekG9u%2Fuploads%2Fgit-blob-24a83c1f5ed637b181c2627c25412be65037681e%2Funpacker-output-window.png?alt=media)

If configured to do so, which is the default option, it will stop the execution, and simply jump to the discovered original entry point. Now, if we take a look to the information provided in the previous screenshot, we can see that the whole IAT was found:

![A portion of the newly discovered IAT shown in IDA](https://492083732-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFP6ibt8r6WPBHTqekG9u%2Fuploads%2Fgit-blob-bcb085f55fd6f3a0a1d950eeb136244d10d007f2%2Fiat-after-unpacking.png?alt=media)

And also that the code ratio improved from the initial 0.0% ratio to 18.38, finding a total of 8347 functions, when initially there were only 2 (wrong) ones. At this point, we have the full sample unpacked in IDA and we can start analysing it, with all the imported API function names resolved, as in the following example function:

![Decompilation showing resolved API calls in a random function in the binary after unpacking](https://492083732-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FFP6ibt8r6WPBHTqekG9u%2Fuploads%2Fgit-blob-a1d461d4b4e543a5e06fd353acc08450b1d037c3%2Funpacker-decompilation-random-function.png?alt=media)

And that's it! This is the most basic example of how to use the generic unpacker.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.hex-rays.com/ida-9.5/add-ons/malware/how-tos/unpack-a-malware-sample.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.