UPX or Ultimate Packer for Executable is an open-source packer that can reduce the file size of an executable drastically. And it is compatible with a large range of executable formats, like Windows DLLs, macOS apps, or Linux ELF.
$ file x86_64
x86_64: ELF 64-bit LSB shared object, x86-64, version 1 (SYSV), statically linked, no section headerSo the artifact is a Linux ELF (64-bit). It does not say much, so I went further by using hex editor:
Turns out, the application is using UPX packer, as the signature ASCII texts highlighted above. Further investigation led to me its version.
Having both the packer tool and version, I will utilize its own to decompress the file.
upx -d x86_64 -o x86_64_decompressed
Ultimate Packer for eXecutables
Copyright (C) 1996 - 2024
UPX 4.2.4 Markus Oberhumer, Laszlo Molnar & John Reiser May 9th 2024
File size Ratio Format Name
-------------------- ------ ----------- -----------
4674831 <- 1724832 36.90% linux/amd64 x86_64_decompressed
Unpacked 1 file.Calculating Shannon entropy
python3 entropy_cal.py ~/Downloads/x86_64 ~/Downloads/x86_64_decompressed
File Entropy Analysis:
Filename Size (bytes) Entropy (bits) ELF
----------------------------------------------------------------------
x86_64 1,724,832 7.999863 ✓
x86_64_decompressed 4,671,408 6.488449 ✓
Comparison Summary:
Highest entropy: 7.999863 bits
Lowest entropy: 6.488449 bits
Entropy difference: 1.511414 bits
| File Type | Typical Entropy Range | Your Values |
|---|---|---|
| Packed/Compressed | 7.8 - 8.0 bits | 7.999863 bits |
| Unpacked Executable | 6.0 - 6.8 bits | 6.488449 bits |
| Text Files | 4.0 - 5.5 bits | N/A |
| Encrypted Data | 7.9 - 8.0 bits | N/A |