Skip to content
Get packs

UPX Malware Unpacker

Unpacks UPX-packed malware samples, including ones with tampered UPX headers, for static analysis.

Source Download skill
Repository
mukul975/Anthropic-Cybersecurity-Skills
Stars
35,430
Licence
Apache-2.0
Files
3 files

What it does

This skill guides an AI agent through analyzing suspicious Windows programs that have been compressed with the UPX packer, a common technique malware authors use to hide their code. The agent identifies the packer, tries standard UPX decompression, repairs tampered headers if that fails, and describes how to unpack manually in a debugger so the original program can be examined in tools like Ghidra or IDA. It is meant for a security analyst working in an isolated lab.

Great for

  • Malware analysts who receive packed Windows samples and need the original code for reverse engineering
  • Security students learning how packers and static analysis work
  • Incident responders preparing a packed binary for disassembly in an isolated analysis VM

Skip it if

  • Custom packers or VM-based protectors such as Themida or VMProtect, which the skill itself says are out of scope (the techniques will not work on them)
  • Running samples on a normal or networked machine, because the skill is built around handling live malware and should only be used in an isolated environment
  • Non-malware use cases such as unpacking commercial software you do not have rights to modify

Try asking

  • “Analyze suspect.exe: check whether it is packed with UPX and report the section entropy and import count”
  • “Try to decompress this UPX sample, and if the headers were modified, repair them and retry”
  • “Prepare this packed binary so I can load the unpacked version into Ghidra”
Step-by-step guide: how to use UPX Malware UnpackerInstall, first run, examples, tips and FAQs

Install in 3 steps

  1. 1

    Download the skill

    The ZIP contains the 3 original files, the Apache-2.0 licence and an attribution note.

    analyzing-packed-malware-with-upx-unpacker.zip
  2. 2

    Add it to your agent

    Claude Code (all projects)

    mkdir -p ~/.claude/skills && unzip analyzing-packed-malware-with-upx-unpacker.zip -d ~/.claude/skills/

    Claude Code / Agent SDK (this project only)

    mkdir -p .claude/skills && unzip analyzing-packed-malware-with-upx-unpacker.zip -d .claude/skills/

    Claude apps (web/desktop): Settings → Capabilities → Skills → Upload skill, and choose the ZIP.

  3. 3

    Ask for the task

    No special command needed — the agent reads the skill's description and loads it when your request matches. Try one of the prompts above.

Get better results

  • Work only inside an isolated, snapshotted analysis VM with networking disabled, since the sample is live malware and the agent will run tools on it
  • Review the header-repair script before running it, because it writes a modified copy of the sample and searches binary data with broad patterns
  • Expect manual debugger steps to need human judgment; the agent can guide them but an analyst should confirm each step

What's inside

  • references/api-reference.md
  • scripts/agent.py
  • SKILL.md

Redistributed unmodified from mukul975/Anthropic-Cybersecurity-Skills under the Apache-2.0 licence. The assessment was drafted with AI from the skill's files on 2026-10-29. Skills can instruct your agent to run code — read SKILL.md and any scripts before installing.