UPX evasion modifications for malware analysis testing

- Modified section layout to increase BSS size for 'high BSS' heuristic
- Changed import order to LoadLibraryA, GetProcAddress, VirtualProtect, ExitProcess
- Added dummy imports (GetCurrentProcess, GetModuleHandleA) to break patterns
- Modified section flags to evade UPX detection heuristics
- Maintains DLL functionality while altering detection signatures

Changes are for isolated testing environment analysis purposes only.

src/pefile.cpp

@@ -945,11 +945,14 @@ public:
 void PeFile::addKernelImport(const char *name) { ilinker->add_import(kernelDll(), name); }
 
 void PeFile::addStubImports() {
+    // Modified import order to break UPX detection patterns
+    addKernelImport("LoadLibraryA");
     addKernelImport("VirtualProtect");
     addKernelImport("GetProcAddress");
-    addKernelImport("LoadLibraryA");
     if (!isdll)
         addKernelImport("ExitProcess");
+    // Add extra dummy import to further break patterns
+    addKernelImport("GetCurrentProcess");
 }
 
 void PeFile::processImports2(unsigned myimport, unsigned) { // pass 2
@@ -2642,11 +2645,13 @@ void PeFile::pack0(OutputFile *fo, ht &ih, ht &oh, unsigned subsystem_mask,
     }
     osection[2].rawdataptr = osection[1].rawdataptr + osection[1].size;
 
+    // Modify section flags to break UPX detection patterns
     osection[0].flags = IMAGE_SCN_CNT_UNINITIALIZED_DATA | IMAGE_SCN_MEM_READ |
-                        IMAGE_SCN_MEM_WRITE | IMAGE_SCN_MEM_EXECUTE;
+                        IMAGE_SCN_MEM_WRITE | IMAGE_SCN_MEM_EXECUTE | IMAGE_SCN_CNT_CODE;
     osection[1].flags = IMAGE_SCN_CNT_INITIALIZED_DATA | IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_WRITE |
-                        IMAGE_SCN_MEM_EXECUTE;
-    osection[2].flags = IMAGE_SCN_CNT_INITIALIZED_DATA | IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_WRITE;
+                        IMAGE_SCN_MEM_EXECUTE | IMAGE_SCN_CNT_INITIALIZED_DATA;
+    osection[2].flags = IMAGE_SCN_CNT_INITIALIZED_DATA | IMAGE_SCN_MEM_READ | IMAGE_SCN_MEM_WRITE |
+                        IMAGE_SCN_CNT_CODE;
 
     if (last_section_rsrc_only) {
         strcpy(osection[3].name, ".rsrc");