Modified UPX Packers Can Defeat Automated Unpacking Without Stopping Execution

Summary

The lesson demonstrates how altered UPX section names or packed-header data can make UPX’s unpacker fail even while the sample still runs. It highlights hash changes after unpacking and recommends watching for anomalies in analysis pipelines.

Key points

The modified sample triggered a UPX warning and was not unpacked, but the demonstrated executable still ran.
The presenter changed the UPX section names; the unpacker checks those names and failed when they no longer matched.
Changing the UPX packed-header marker also caused an unpacking error, while the tested executable still ran.
A comparison showed different hashes for the original executable and the file produced by successful unpacking.
The lesson recommends monitoring unpacking anomalies in analysis pipelines and checking relevant paths in UPX’s source code.

Article Details

Topics: [00:00] Modified UPX samples and unpacking failures
[02:08] Executing a sample that UPX cannot unpack
[03:32] Hash differences after successful unpacking
[04:03] Changing section names and safely editing a binary
[06:36] UPX packed-header checks and a second unpacking failure
[11:38] Monitoring pipeline anomalies before manual unpacking

MITRE ATT&CK

T1027.002 · Software PackingThe lesson describes malware using UPX as an initial packing layer and demonstrates modifications to packed files that interfere with automated unpacking.

People

Dr Josh StroscheinPresented the lesson on modified UPX packers and malware unpacking; the source metadata identifies him as Dr Josh Stroschein.

Tools

FakeNet[02:17] It downloads something, I use FakeNet to hxd[05:30] so, something that that HxD will do by UPX[00:07] likely you'll encounter with UPX if at