12 ms·
Not entirely true. Most AV will only flag 'non-standard' UPX packed executables as suspicious. Standard UPX packed binaries are easily unpacked by the scanner a
by fileoffset 10y ago
Not entirely true. Most AV will only flag 'non-standard' UPX packed executables as suspicious. Standard UPX packed binaries are easily unpacked by the scanner and the contents scanned without notifying user.
- pilif 10y agoIt's anecdotal of course, but a small application of ours went from about one false-positive per month to no false positive in over a year when I stopped UPX packing it.
- SyneRyder 10y agoMore anecdata here, but I've experienced the same thing as well (not quite as frequent as one false-positive a month though). UPX just seems to occasionally trip up the antivirus heuristic scans until you can get your application whitelisted.