Packed and Unpacked: Defeat a Packer
Packed and Unpacked: Defeat a Packer
The same PuTTY you triaged, now packed with UPX. Spot the packing, unpack it, and prove the original is back, byte for byte.
Briefing
A packer compresses or encrypts a program and wraps it in a small stub that rebuilds the original in memory as it starts. Real malware uses packing constantly to shrink itself and to hide from signature scanners: the code a scanner sees on disk is not the code that runs.
This sample is the exact PuTTY 0.83 from the PE Autopsy lab, packed with UPX, the most common packer. Nothing malicious was added; only the packing changed. Because you already know the unpacked file inside out, you can prove your unpacking is perfect.
The download is a ZIP encrypted with the password "infected". That is the long-standing convention for moving samples safely: the password stops your browser and antivirus from opening or running the file by accident. Unzip it only inside an analysis VM.
Topics you practise
Evidence
putty-upx.zip (password: infected)
A UPX-packed build of PuTTY 0.83 x64, inside a password-protected ZIP. The SHA-256 below is of the packed EXE once you extract it. (896 KB)
Source: Built for this lab from official PuTTY 0.83 with UPX 5.2.1. PuTTY under the MIT licence; UPX is free software.
3120d674918f092b3e605e9ffcff54c0572e904029e5aa5e6eec855653c05152Suggested tools: PE-bear or CFF Explorer, pefile (Python), Detect It Easy, the official UPX tool, x64dbg with the Scylla plugin.
Extract the ZIP with the password "infected". What is the SHA-256 of putty-upx.exe?
Format: 64 hex characters.
What are the names of the first two sections?
Format: two names, like name1,name2.
What is the entropy of the UPX1 section, in bits per byte?
Format: a number to 2 decimal places.
How many functions does the packed file import in total?
Format: a number.
Which KERNEL32 function does the stub use to look up each original function by name at run time?
Format: a function name.
What is the AddressOfEntryPoint RVA of the packed file?
Format: hex, like 0x1a2b.
The unpacked PuTTY was signed by Simon Tatham. Does the packed file still carry that digital signature? Answer yes or no.
Format: yes or no.
Unpack the file (UPX can decompress its own output, or do it manually in x64dbg). What is the original entry point RVA of the recovered file?
Format: hex, like 0xbe504.
How many functions does the unpacked file import in total?
Format: a number.
What is the SHA-256 of the fully unpacked file?
Format: 64 hex characters.
Each task is worth 100 points: minus 15 per wrong answer and 25 for a hint (never below 40). Finish when you are done; 13 unsolved tasks score 0. Your progress is saved on this device.