How UPX Packing Compresses Executables and Reduces Analysis Visibility

Summary

A tutorial demonstrates how UPX compresses a Windows executable, unpacks it in memory, and changes its imports and visible strings, reducing static-analysis visibility and illustrating traits analysts can inspect.

Key points

• The demonstration compiles a sample program and uses UPX to compress it into a packed executable that unpacks in memory when run.
• The speaker identifies entropy, strings, and imports as characteristics analysts can inspect when assessing packed files.
• In the example, packing reduces the visible imports needed for unpacking, while some network-related imports remain.
• Strings visible in the original executable are not visible in the packed sample because the program code is compressed.
• The tutorial compares the packed and unpacked files and explains that packing reduces visibility until analysts understand how to unpack the executable.
• The speaker distinguishes UPX’s compression and efficiency goals from more obfuscation-focused malicious packers.

MITRE ATT&CK

Products

Tools

Related Articles

• Modified UPX Packers Can Defeat Automated Unpacking Without Stopping ExecutionDr Josh Stroschein - The Cyber YetiFakeNet · UPX · T1027.002
• Report Details How Malware Crypting Services Help Threat Actors Evade Detectionrecordedfuture.comMicrosoft Windows · UPX · T1027.002
• PhantomCore Campaign Compromises 181 Russian Hosts in Cyberespionage Operationglobal.ptsecurity.comMicrosoft Windows · UPX · T1027.002
• Dire Wolf Ransomware Disrupts Recovery and Encrypts Files Before Extorting Victimspicussecurity.comMicrosoft Windows · UPX
• Fake IT Support Scams Deliver Modified Havoc C2 Across Multiple Organizationshuntress.comMicrosoft Windows · UPX