# mal_unpack

> mal_unpack is a Windows dynamic unpacker based on PE-sieve. It runs a packed malware executable, waits for its payload to unpack, dumps the payload, and terminates the original process.

- Type: Tool
- Targets: Binary
- Category: Debugging and dynamic analysis
- Relationship: Foundation tool
- Sources reviewed: 2026-11-06
- Added to the catalog: 2026-11-06
- Original resource: <https://github.com/hasherezade/mal_unpack>
- Primary source: <https://github.com/hasherezade/mal_unpack/blob/cecb9eed03c63d651c5b47834b15bac8086cb2fb/README.md>
- Catalog page: <https://awesomerea.org/resources/mal-unpack/>
- Record JSON: <https://awesomerea.org/resources/mal-unpack/record.json>
- Chinese version: [简体中文](https://awesomerea.org/zh/resources/mal-unpack/index.md)

## Requirements & limits

- Run on Windows and provide a packed malware executable.
- Use only in a virtual machine because the tool launches the original malware.
- License: BSD-2-Clause.

## Primary sources

1. <https://github.com/hasherezade/mal_unpack/blob/cecb9eed03c63d651c5b47834b15bac8086cb2fb/README.md>

## More in Native binaries

- [Bloaty](https://awesomerea.org/resources/bloaty/index.md) · Tool
- [bingrep](https://awesomerea.org/resources/bingrep/index.md) · Tool
- [libPeConv](https://awesomerea.org/resources/libpeconv/index.md) · Tool
- [Viper](https://awesomerea.org/resources/viper-framework/index.md) · Tool
- [Cuckoo3](https://awesomerea.org/resources/cuckoo3/index.md) · Tool
- [Cuckoo Sandbox](https://awesomerea.org/resources/cuckoo-sandbox/index.md) · Tool

## About this entry

The description was reviewed against primary sources.
Original editorial content: MIT. Linked projects, papers and assets retain their own rights and licenses.