Malware Static Analysis with UPX
UPX is a famous tool that is used to pack and unpack a PE file and used by both benign and malicious software for their own gain.
Static Analysis Tool Lists
Use Trid to detect the file type.
Now, it detects 34.7% of the file as UPX compressed which gives us an idea that a packer is present inside the file. (using Trid is optional, you can use other tools for detecting packer)
We try to unpack this sample using UPX.
To do this, run UPX tool with -d, -q -f parameter to unpack the file: upx -dqf file
We can then use TRiD into our newly unpacked PE file and spot the differences.
You can see UPX compressed is gone and it is replaced with the real data.
