The section table is an array of structures called IMAGE_NT_HEADERS, this structure provided information about the corresponding section such as location and length. You’ll notice that the section header names have been changed to UPX 0 and UPX 1 respectively. We can investigate these sections with CFF Explorer. UPX will compress the sections stored within the Section Table of the PE file, these sections are sorted by their RVAs (Relative Virtual Addresses). However, I haven’t explained how UPX works as of yet, in order to do this, I will assume you understand the PE layout. There are several other tools which can detect packers, like ExeInfo Pe, RDG Packer Detector and PEID. Furthermore, most static analysis programs like PEStudio will consider UPX packing as suspicious because of it’s large use. These requires the malware to be unpacked manually.

These custom packers are unknown, and therefore unpacking programs won’t be able to unpack them. The general process is to pack the malware with a common packer like UPX and then pack the same binary again but with a custom packer. Multi-Layer Packing is a popular technique employed by malware developers to prevent unpacking from lesser skilled security analysts.

Pestudio on an img file