UPX packed PE/COFF executable detected (UPX_Packed_Executable)

About this signature or vulnerability

IBM Security Host Protection for Servers (Unix), Proventia Server IPS for Linux technology, IBM Security Network Protection, Virtual Server Protection for Vmware, Proventia Network IDS, Proventia-G 1.1 and earlier, Proventia Network IPS, IBM Security Host Protection for Desktops, IBM Security Host Protection for Servers (Windows), RealSecure Server Sensor, Proventia Network MFS:

This signature detects PE/COFF executable files that have been packed using the UPX tool. While the presence of a UPX packed executable does not in itself represent an attack, it can be considered an anomaly. The UPX tool is commonly used to pack trojans and malware, while it is somewhat uncommon for the tool to be used to distribute legitimate commercial software. The file should be examined to determine if it constitutes malware.


False positives

IBM Security Host Protection for Servers (Unix), Proventia Server IPS for Linux technology, IBM Security Network Protection, Virtual Server Protection for Vmware, Proventia Network IDS, Proventia-G 1.1 and earlier, Proventia Network IPS, IBM Security Host Protection for Desktops, IBM Security Host Protection for Servers (Windows), RealSecure Server Sensor, Proventia Network MFS: Legitimate software packed using UPX will trigger this signature.

Default risk level

Low risk vulnerability  Low

Sensors that have this signature

IBM Security Host Protection for Servers (Unix): 2.2.2, Proventia Server IPS for Linux technology: 1.0, IBM Security Network Protection: 5.1, Virtual Server Protection for Vmware: 1.0, Proventia Network IDS: XPU 24.2, Proventia-G 1.1 and earlier: XPU 24.2, Proventia Network IPS: XPU 1.42, IBM Security Host Protection for Desktops: 8.0.614.1, IBM Security Host Protection for Servers (Windows): 1.0.914.0, RealSecure Server Sensor: XPU 24.2, Proventia Network MFS: XPU 1.41, IBM Security Host Protection for Servers (Windows): 2.1.14.2400

Systems affected

Microsoft Windows 2003 Server, Microsoft Windows XP, Microsoft Windows 98SE, Microsoft Windows 2000, Microsoft Windows Me, Microsoft Windows 98, Microsoft Windows NT: 4.0, Microsoft Windows 95

Type

Suspicious Activity

Vulnerability description

A PE/COFF executable file that has been packed using the UPX tool has been detected. The UPX tool is commonly used to pack Trojans and malicious programs. The presence of a UPX packed executable itself does not represent an attack, however, it is uncommon for the tool to be used to distribute legitimate commercial software. The file should be examined to determine if it is malicious.

How to remove this vulnerability

This check is for informational purposes only.

Examine the contents of the file to determine if it contains malicious programs.

References

UPX Web site
UPX: the Ultimate Packer for eXecutables - Homepage
http://upx.sourceforge.net/

ISS X-Force
UPX packed PE/COFF executable detected
http://www.iss.net/security_center/static/19041.php