Unpacking

Packing compresses or encrypts a program's real code and wraps it in a small stub. At runtime the stub unpacks the original code into memory and runs it.

Malware authors use packing to evade signatures and frustrate static analysis.

A packed binary shows few strings, few imports, and high entropy. The meaningful code is hidden until the stub runs.

Unpacking recovers the original code so you can analyze it statically and extract real IOCs.