CHFI Mobile and Malware Forensics Practice Question

A forensic investigator is analyzing a malware sample that appears to be packed. Using PEiD, the analyst detects an entropy value of 7.8 and the entry point section is named 'UPX0'. Which of the following tools should the analyst use NEXT to unpack the malware for static analysis?

⚠ Common exam trap

EC-Council often tests the distinction between tools for unpacking versus tools for analysis, expecting candidates to recognize that UPX -d is the direct unpacking utility, while Ghidra and IDA Pro are analysis tools that require an already-unpacked binary for effective static analysis.

Answer choices

Why each option matters

Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.

Correct answer & explanation

✓

UPX -d

The presence of 'UPX0' as the entry point section name and an entropy value of 7.8 (very high, indicating compression or encryption) strongly suggests the malware is packed with UPX (Ultimate Packer for eXecutables). The correct next step is to use UPX with the -d (decompress) switch to unpack the binary, restoring the original executable for static analysis. This is a standard, reversible unpacking method that does not require dynamic analysis or disassembly of the packed stub.

Answer analysis

Option-by-option breakdown

For each option: why learners choose it and why it is or isn't the right answer here.

✓
UPX -d
Why this is correct
UPX -d is the correct command-line invocation because the -d flag tells the UPX utility to decompress (unpack) an executable that was previously packed with UPX. This restores the original program code and data so a malware analyst can statically inspect the actual malicious logic rather than the small decompression stub. It is the most direct, automated method available in the standard toolset for this exact purpose.
✗
Ghidra
Why it's wrong here
Ghidra is an open-source reverse engineering suite that provides disassembly and decompilation, but it does not include a dedicated UPX unpacking operation analogous to UPX -d. When you load a UPX-packed binary, Ghidra shows the unpacking stub and compressed payload as if they were code, which distorts analysis unless you manually perform scripted unpacking. Its role is to analyze the unpacked executable after a proper unpacker, not to replace the unpacking step itself.
✗
Process Monitor
Why it's wrong here
Process Monitor (procmon) is a Windows dynamic analysis tool that logs real-time file system, registry, and process/thread activity; it is completely unrelated to unpacking a UPX-packed file. If you run a packed malware sample in Process Monitor, you observe the runtime behavior of the unpacked code that has been written to memory or disk, but you never recover the original static binary. It is used for behavioral analysis after execution, not for obtaining a clean, packed-then-unpacked executable for disassembly.
✗
IDA Pro
Why it's wrong here
IDA Pro is an interactive disassembler/debugger that can sometimes auto-detect a UPX header and ask if you want to apply a scripted unpacking routine, but it does not have a simple, deterministic command-line flag like UPX -d. Even when IDA 'auto-unpacks', it rarely produces a fully recovered original binary; instead it patches the database to try to make the code analyzable, leaving artifacts of the packer. For a straightforward extraction of the original program, running UPX -d on the file is the preferred and more reliable approach.

Go deeper

CHFI Mobile and Malware Forensics Practice Question

Why each option matters

Option-by-option breakdown

Related to this question