Unpack a Malware Sample

The generic unpacker tries to be as independent as possible, only making a few questions and making sure the default options are good enough for most use cases. In the following sections we will show how to unpack a specific malware sample, the following one with SHA256 hash 18ddfc65f3f0111445818f4b23e4f9aad5bd21930d133a5e326d0bd44ae019ad, which seems to be packed with Enigma Protector, a legal commercial software protector.

A simple step by step guide

First, we will simply open the binary in IDA and let it finish the initial auto-analysis. After a while, it will finish, the unpacker will do its first checks and determine the binary is packed. Checking if the binary seems to be packed is done by checking the ratio of bytes of code correlated to the total number of bytes in the sections with code, and as we can see with this specific malware sample, it's (almost) 0.0%:

[2026-10-05 17:24:56,516] INFO: Code-to-section ratio: 0.0% (threshold: 10%)
[2026-10-05 17:24:56,516] INFO: Binary appears packed

Also, it only has one function imported per library in the Import Address Table (IAT), with the only exception of Kernel32.dll, which is a usual indicator of a sample being packed:

So, when a sample looks like packed, the unpacker will ask us if we like to unpack it now:

We will press on "No" for now. As we can see in the screenshot below, IDA only found 2 wrong functions and that's it, we have not enough information to start the analysis with vanilla IDA:

Now, we will run the generic unpacker by either using its shortcut (Shift+P) or going to menu Extensions -> Malware Analysis -> Unpacker -> Unpack now. It will first show a warning message telling us that unpacking is a destructive process as it will undefine almost everything inside the current database. Click on "Yes", and it will show the following dialogue:

Here we can choose which unpacking strategy we want to use for unpacking the sample. The unpacker asks registered heuristic plugins to determine if a specific one is the best suited one for the currently opened binary, in case there is a specific heuristic for some specific packer, and otherwise will just offer as the default option the heuristic run-until-timeout. In this case, we will choose this heuristic and press OK. The unpacker will run the malware sample using the previously configured safe debugging backend, like the Bochs debugger, which is the default one in case none was configured. While the sample is running it will show some execution errors which are fine to ignore, as they happen because in this case we aren't using a complete Windows environment but rather a partial emulator (Bochs):

8D15DF: Page fault at 0x300905A55, error code 4 -> 0000000300905A55 (exc.code e, tid 2476)

Moments later, it will pause the execution and start doing its job, as shown in the screenshot below:

If configured to do so, which is the default option, it will stop the execution, and simply jump to the discovered original entry point. Now, if we take a look to the information provided in the previous screenshot, we can see that the whole IAT was found:

And also that the code ratio improved from the initial 0.0% ratio to 18.38, finding a total of 8347 functions, when initially there were only 2 (wrong) ones. At this point, we have the full sample unpacked in IDA and we can start analysing it, with all the imported API function names resolved, as in the following example function:

And that's it! This is the most basic example of how to use the generic unpacker.