11 replies to this topic

[MedEvil]

A friend came to me with a problem. He has a file, which is only about 40% of the original and he would like to know which packer is used.
I looked at it in a Hex viewer, but couldn't find any packer header. Also PeId couldn't find any packer.
So i'm fresh out of ideas, how to figure out, what's going on.

[sbaeder]

A friend came to me with a problem. He has a file, which is only about 40% of the original and he would like to know which packer is used.
I looked at it in a Hex viewer, but couldn't find any packer header. Also PeId couldn't find any packer.
So i'm fresh out of ideas, how to figure out, what's going on.

Juat to be 100% clear...the size is smaller, but it is still functional? In other words, it is some sort of executable, and it functions correctly even though it is 40% of the original (that is also fuunctional)...

You might have to look at the binary code, but often (in Linux/Unix), executables can be built with debug information embedded into the binary and also less than optimal code optimization. There are also thins like symbol tables that are used to "link" together different pieces of the executable. These can also be "stripped" out.

So, it may be that thing like this have been done, and the binary isn't actually "compressed" (or packed)

[Icecube]

You can try one of the tools (or text files) listed here:
http://www.woodmann....fier_Signatures

[MedEvil]

Yes it is an executable and still fully functional, at least that's what i've been told.
He found the program on the net, labled as a portable version for USB-Stick. The manufacturer site features no portable version for USB-Stick.

So far it was determined, that it contains no known virus and does not show any suspicious behavior in a sandbox.
But what exactly was done to the program, stays an enigma.

[MedEvil]

You can try one of the tools (or text files) listed here:

Thanks Icecube! FastScanner was able to tell what it was. Simple UPX. Will see tomorrow if it was right.

[MedEvil]

Ok, couldn't wait. Had to try.
UPX can't unpack the file. Not sure, if because the file has been patched afterwards, or because Fastscanner named the wrong program.

[joakim]

Lots of things could have been done to it. Just delete a resource for instance and your exe gets smaller in size without any compression involved...

What does the sections table look like? Ie the names. (sometimes a simple rename back to what is expected may be sufficient for upx to decompress it)
Does it look ok in a disassembler?
Is oep detectable?

[Icecube]

This might help to see if the UPX compressed binary was scrambled:

PE Explorer ships with the UPX Unpacker plug-in, a start-up processing plug-in for unpacking files compressed with UPX. All versions of UPX are supported, from the obsolete early versions (prior to 0.80) up to the latest 3.0x versions.

In addition, PE Explorer supports for files modified with many UPX scramblers such as Advanced UPX Scrambler, UPoLyX, UPX Lock, and even more: now it supports for Upack and NSPack.

http://www.heaventools.com/PE_Explorer_plug-ins.htm

[Brito]

Yes, I already saw some files using scrambled UPX packers.

Also, it is relatively simple to build your own packer and it will pass at online scans like virustotal.

Not easy to detect these headers if they are custom modified.

[homes32]

a good tool I have found currently is ExEinfo
its not as mature as PeID but it has alot of features.

PeID is dead. (RIP)

[Brito]

ExEinfo seems very nice.

A year ago I've also created libraries to read PE headers, the goal was to read the version encoded inside the binaries: http://reboot.pro/11890/

It was really interesting to see how they are composed.

[MedEvil]

Finally got around to solve this.
Got myself the original and compressed it with upx. Then i compared the two files and added all references to upx from my comressed file to the other.
Afterwards upx could decompress the file without problem.

Unfortunately, the producer seems to to not reflect all changes in their version number. I have now already 3 files, all claiming to be the same version, two of them directly downloaded from the manufacturers site, which are not identical.
So that makes it a bit complicated to figure out, what was done to the file to make it portable.

Thanks for all the help. Couldn't have done it without you, guys.