Class 05 · KP 17 / 26

UPX: The Friendly Packer

UPX (Ultimate Packer for eXecutables): common, legitimate compressor —- also heavily used by malware.
Tell-tale sections UPX0 / UPX1; string UPX!.
Often reversible: upx -d sample.exe (when unmodified).
Many malware authors tweak UPX so -d fails → unpack dynamically instead.

Key Takeaway

UPX is the "hello world" of packing —- recognize it, but do not assume every packer unpacks so nicely.