#packer #evasion
UPX compresses files which makes it harder for AV and EDR to detect them.
Usage
$ upx -h
Ultimate Packer for eXecutables
Copyright (C) 1996 - 2020
UPX 3.96 Markus Oberhumer, Laszlo Molnar & John Reiser Jan 23rd 2020
Usage: upx [-123456789dlthVL] [-qvfk] [-o file] file..
Commands:
-1 compress faster -9 compress better
--best compress best (can be slow for big files)
-d decompress -l list compressed file
-t test compressed file -V display version number
-h give this help -L display software license
Options:
-q be quiet -v be verbose
-oFILE write output to 'FILE'
-f force compression of suspicious files
--no-color, --mono, --color, --no-progress change look
Compression tuning options:
--brute try all available compression methods & filters [slow]
--ultra-brute try even more compression variants [very slow]
Backup options:
-k, --backup keep backup files
--no-backup no backup files [default]
Overlay options:
--overlay=copy copy any extra data attached to the file [default]
--overlay=strip strip any extra data attached to the file [DANGEROUS]
--overlay=skip don't compress a file with an overlay
Options for djgpp2/coff:
--coff produce COFF output [default: EXE]
Options for dos/com:
--8086 make compressed com work on any 8086
Options for dos/exe:
--8086 make compressed exe work on any 8086
--no-reloc put no relocations in to the exe header
Options for dos/sys:
--8086 make compressed sys work on any 8086
Options for ps1/exe:
--8-bit uses 8 bit size compression [default: 32 bit]
--8mib-ram 8 megabyte memory limit [default: 2 MiB]
--boot-only disables client/host transfer compatibility
--no-align don't align to 2048 bytes [enables: --console-run]
Options for watcom/le:
--le produce LE output [default: EXE]
Options for win32/pe, win64/pe, rtm32/pe & arm/pe:
--compress-exports=0 do not compress the export section
--compress-exports=1 compress the export section [default]
--compress-icons=0 do not compress any icons
--compress-icons=1 compress all but the first icon
--compress-icons=2 compress all but the first icon directory [default]
--compress-icons=3 compress all icons
--compress-resources=0 do not compress any resources at all
--keep-resource=list do not compress resources specified by list
--strip-relocs=0 do not strip relocations
--strip-relocs=1 strip relocations [default]
Example
$ ls -lh ./nc.exe
-rwxr-xr-x 1 i4 i4 58K Jan 29 00:07 ./nc.exe
$ upx -9 ./nc.exe
Ultimate Packer for eXecutables
Copyright (C) 1996 - 2020
UPX 3.96 Markus Oberhumer, Laszlo Molnar & John Reiser Jan 23rd 2020
File size Ratio Format Name
-- -- --
59392 -> 29696 50.00% win32/pe nc.exe
Packed 1 file.
$ ls -lh ./nc.exe
-rwxr-xr-x 1 i4 i4 29K Jan 29 00:07 ./nc.exe