Skip to content

Commit

Permalink
Update packer_upx.py
Browse files Browse the repository at this point in the history
Correct signature for PE static info format
  • Loading branch information
kevross33 authored Oct 4, 2024
1 parent 2bcef9d commit 8ca5a8e
Showing 1 changed file with 11 additions and 15 deletions.
26 changes: 11 additions & 15 deletions modules/signatures/all/packer_upx.py
Original file line number Diff line number Diff line change
Expand Up @@ -15,7 +15,6 @@

from lib.cuckoo.common.abstracts import Signature


class UPXCompressed(Signature):
name = "packer_upx"
description = "The executable is compressed using UPX"
Expand All @@ -29,18 +28,15 @@ class UPXCompressed(Signature):
mbcs = ["OB0001", "OB0002", "OB0006", "F0001", "F0001.008"]

def run(self):
if "static" in self.results and "pe" in self.results["static"]:
if "sections" in self.results["static"]["pe"]:
for section in self.results["static"]["pe"]["sections"]:
if section["name"].startswith("UPX"):
descmsg = "name: {0}, entropy: {1}, characteristics: {2}, raw_size: {3}, virtual_size: {4}".format(
section["name"],
section["entropy"],
section["characteristics"],
section["size_of_data"],
section["virtual_size"],
)
self.data.append({"section": descmsg})
return True
ret = False

target = self.results.get("target", {})
if target.get("category") in ("file", "static") and target.get("file"):
pe = self.results["target"]["file"].get("pe", [])
if pe:
for section in pe["sections"]:
if section["name"].lower().startswith(".upx"):
self.data.append({"section": section})
ret = True

return False
return ret

0 comments on commit 8ca5a8e

Please sign in to comment.