I want to make a black campaign and my target is some consistently ignorant AntiVirus makers.
Thanks to virustotal.com for make this painless
Simple case:
1. gplc.exe (gnu prolog) https://www.virustotal.com/en/file/9e2acb4176669e48f7a0aadd3fcbb39ade979b8843be87db9da5a42fe10ec290/analysis/1362534179/
2. pack gplc.exe with UPX https://www.virustotal.com/en/file/381976956f94d747407e9beaa9231dacdbd6bc19093621cc8058a3bbd09f3b06/analysis/1362534370/
3. unpack packed gplc.exe with UPX https://www.virustotal.com/en/file/86323543730fc67432854d6ff4eceaa6b0a8096befbce37fa6062d9e4450d4ff/analysis/1362534576/
The suspect file http://osspack32.googlecode.com/files/GPLC.7z
And the award goes to:
1. TheHacker
2. TrendMicro
3. TrendMicro-HouseCall
Now that's just a simple case, but if an executable involving networking functionality the analysis of our AV "champion" will goes into cosmic territory and hallucination... such pathetic and irresponsible (they will rely on user report) behavior should never exist in a software of AntiVirus caliber. More.. some big company make actually malware-behaving software and force AV maker to whitelist them as reported by nirsoft. But when false-positive involve open source technology it become ignorance
UPX itself is an open source software to compress executable.
So stay tuned with this page for most updated list of antivirus whose programmer can't read any single line of UPX source codez. ha ha
So what? Why just "don't use UPX" and that "UPX is useless, bla bla... anyway" ?
Well because we're human dude, and we fix our mistake !
How come compressing and decompressing with UPX doesn't generate the same file? I thought it was a loseless compressor.
ReplyDeleteA ricochet then, do you ever use UPX yourself? cause I'm surprised you asked that.
ReplyDeleteI think you mistaken UPX as some kind of 7zip, WinRAR or WinZip. It's true that UPX can use lzma method (used in 7z) but it works differently. I suggest to goggling what is PE a.k.a Portable Executable format. Which part compressed, which preserved, and which modified