Unprotect: parsing PE malware and extract evasion techniques

by do son · October 30, 2019

Unprotect Malware for the Mass

The Unprotect Project is an Open Source project that aims to propose a classification of Evasion Techniques to help to understand and analyze malware. This project is dedicated to Windows PE malware. It is licensed under Apache License version 2.0.

The Unprotect Project contains two main parts:

A website with a complete database and evasion techniques classification.
A python standalone tool to detect evasion technique in a specific malware.

The standalone tool available in this repository contains the following features:

This tool is an attempt to bring a tool to the community dedicated to malware evasion techniques. It started as a side project and of course requires some improvements. Of course, it is not perfect nor magic! This version is an early prototype.

Please take notes of the following:

This project currently works with python2.7 (it will be upgraded to python3 in next versions).
It might have some bugs or vulnerabilities.
This tool is currently working only with a valid PE file (support of additional format file will be added in a later version).
There is currently no option supported, the standard output will provide you a full report.
The analysis can take time depending of the PE size (more than 5 minutes for a PE bigger than 1MB).
This tool has been tested on Mac OS and Linux, a Windows version can be found in the folder unprotect_windows.