Actually nothing :) I thought write "unpacked" for upx is too much.
Ring0 - the source of inspiration
A forum for reverse engineering, OS internals and malware analysis
Was it indeed pakced with UPX?How did you manage to unpack it?Why upx decompress didn't work for me?
Flamef wrote:Was it indeed pakced with UPX?Yes
How did you manage to unpack it?upx -d filename
Why upx decompress didn't work for me?Have no idea, i saw similar behavior before and even found a reason, but i totally forgot it because it was many years ago.
Probably most of other commands from cmd will fail also. Try "tracert", "ping", do they work?
Ring0 - the source of inspiration
Flamef wrote:How did you manage to unpack it?Why upx decompress didn't work for me?upx.exe -d Firefox_update.exe.exe
Well,thank you guys!Btw,since it's,obviously so easy to unpack UPX,why are most viruses etc packed with UPX,only to reduce the file size?Non-sense,isn't it? :D
Erm well, because
a) most malwar are simply stupid
b) most malware writers don't give a shit
c) it doesn't really matter whether a malware sample is packed or not since the A/V industry is mostly still unable to deal with new malware
Pick any.
a) most malwar are simply stupid
b) most malware writers don't give a shit
c) it doesn't really matter whether a malware sample is packed or not since the A/V industry is mostly still unable to deal with new malware
Pick any.
Flamef wrote:Well,thank you guys!Btw,since it's,obviously so easy to unpack UPX,why are most viruses etc packed with UPX,only to reduce the file size?Non-sense,isn't it? :DUsually they packed to reduce original stub size, or dropper size after obfuscation (or in both cases even multiple times). This one ransom is simple exception. Probably script-kiddies were unable to find/buy fud crypter for that time.
Ring0 - the source of inspiration
Flamef wrote:Was it indeed pakced with UPX?How did you manage to unpack it?Why upx decompress didn't work for me?No ideas.
Code: Select all
root@slax:~/Desktop# upx -d Firefox_update.exe.exe
Ultimate Packer for eXecutables
Copyright (C) 1996 - 2008
UPX 3.03 Markus Oberhumer, Laszlo Molnar & John Reiser Apr 27th 2008
File size Ratio Format Name
-------------------- ------ ----------- -----------
1109504 <- 145920 13.15% win32/pe Firefox_update.exe.exe
Unpacked 1 file.