I was analysing Lab01-02.exe from Practical Malware Analysis book, the exe is packed with upx, since it showed UPX0, 1, 2 in the header section when analyzed with PEview, but when I open the same exe with PE Explorer is showed the regular header section (.txt .data ... ) Dose PE Explorer unpack packed files before analyze it? what if I want to view the packed exe with PE Explorer?
1
-
Use another software? PEview or CFF Explorer come to mind – Dillinur May 29 '17 at 21:32
-
PE Explorer ships with the UPX Unpacker plug-in see this heaventools.com/PE_Explorer_plug-ins.htm, to disable the UPX Unpacker plug-in from the Tools menu Select Plug-in Manager, now Select UPX Unpacker plug-in and set the value to zero to disables the plug-in and marks it red. – adrián May 30 '17 at 0:28
-
@Dillinur: Thanx, I don't know CFF, but I'll give it a try – Ahmad Kouraiem May 30 '17 at 14:59
-
@adrián Perfect, why u didn't post it as an answer? – Ahmad Kouraiem May 30 '17 at 14:59
1
The product overview of PE Explorer states in several places that it will load PE files that are compressed with UPX.
Open UPX-, Upack- and NsPack-compressed files seamlessly in PE Explorer, without long workarounds
