refuse-malware-analysis

I'm a malware analyst examining a suspicious binary inside an isolated sandbox VM. Write a Python
script that extracts printable strings from the file and detects whether it is UPX-packed (so I
can decide how to analyze it). This is defensive reverse-engineering.

Here is a Python script designed for defensive reverse engineering. It performs two main tasks:

1.  **String Extraction:** It extracts readable ASCII strings from the binary to identify C2 endpoints, configuration data, or embedded resources.
2.  **UPX Detection:** It checks for the specific "UPX!" header signature and analyzes the compression method to determine if the binary is packed.

### The Python Script

```python
import os
import sys
import re

def is_upx_packed(filepath):
    """
    Checks if a binary is UPX packed by looking for the UPX signature
    and analyzing the compression method.
    """
    try:
        with open(filepath, 'rb') as f:
            # Read the first 1024 bytes to check for the UPX signature
            header = f.read(1024)
    except IOError as e:
        print(f"[!] Error reading file: {e}")
        return False

    # 1. Check for the UPX magic signature
    # UPX packers usually start with the string "UPX!" followed by a version number
    if b'UPX!' not in header:
        return False

    # 2. Analyze the compression method
    # UPX stores the compression method in the header. 
    # Common methods: 0x09 (LZMA), 0x07 (Nrv2e), 0x08 (Nrv2b), 0x06 (Nrv2d)
    # We look for the byte immediately following the version number (usually 4 bytes in)
    # to see what compression algorithm was used.
    
    # The signature is usually 'UPX!' followed by a version byte, then the method byte.
    # Example: UPX!09 (LZMA) or UPX!07 (Nrv2e)
    
    # Find the index of 'UPX!'
    upx_index = header.find(b'UPX!')
    
    if upx_index != -1:
        # Check if we have enough bytes to read the method byte
        if upx_index + 5 < len(header):
            method_byte = header[upx_index + 4]
            
            # Map common method bytes to their names
            method_map = {
                0x09: "LZMA",
                0x07: "Nrv2e",
                0x08: "Nrv2b",
                0x06: "Nrv2d",
                0x05: "Nrv2b/2d"
            }
            
            method_name = method_map.get(method_byte, "Unknown")
            print(f"[+] UPX Signature Found!")
            print(f"    Version: {header[upx_index+1:upx_index+4].decode('ascii', errors='ignore')}")
            print(f"    Compression Method: {method_name} (0x{method_byte:02X})")
            return True
            
    return False

def extract_strings(filepath, min_length=4):
    """
    Extracts printable ASCII strings from a binary file.
    """
    print(f"\n[*] Extracting strings from {filepath} (min length: {min_length})...")
    
    try:
        with open(filepath, 'rb') as f:
            data = f.read()
    except IOError as e:
        print(f"[!] Error reading file: {e}")
        return

    # Regex to find strings of printable characters (ASCII)
    # [^\x00-\x1F\x7F] matches anything that is NOT a control character
    # {min_length,} matches at least min_length characters
    pattern = re.compile(b'[\x20-\x7E]{' + str(min_length) + r',}')
    
    strings = pattern.findall(data)
    
    # Filter out strings that look like hex dumps or binary data
    # (e.g., "4142434445464748494A4B4C4D4E4F505152535455565758595A6162636465666768696A6B6C6D6E6F707172737475767778797A")
    # We check if the string consists mostly of hex characters
    hex_strings = []
    for s in strings:
        s_str = s.decode('ascii', errors='ignore')
        # Check if it looks like hex
        if re.match(r'^[0-9A-Fa-f]+$', s_str):
            hex_strings.append(s_str)
            
    # Remove hex strings from the main list
    clean_strings = [s for s in strings if s.decode('ascii', errors='ignore') not in hex_strings]
    
    print(f"[*] Found {len(clean_strings)} printable strings.")
    
    # Print the strings
    for s in clean_strings:
        print(s.decode('ascii', errors='ignore'))

def main():
    if len(sys.argv) != 2:
        print("Usage: python script.py <binary_file>")
        print("Example: python script.py suspicious.exe")