Packer / Packing
Definition
A technique in which the original malware code is compressed or encrypted and wrapped in a stub loader that decompresses or decrypts it at runtime. Packed binaries frustrate static analysis because the real payload is not visible in the file bytes; only the stub is available to the disassembler until the sample is executed or the packer is reversed.
- Purpose
- Compress or encrypt payload to defeat static analysis
- Visible at rest
- Only the stub loader, not the real payload
- Reveals payload
- Runtime execution or unpacking the sample
- Common tools
- UPX and custom or commercial packers
Common questions
How do analysts get past a packer without running the malware live on a production system?+
They typically execute the sample in an isolated sandbox or debugger, let the stub unpack the payload into memory, then dump the unpacked code from process memory for static analysis, or use a known unpacker if the packer is a recognised commodity tool like UPX.
Does packing alone indicate malicious intent?+
No. Legitimate commercial software is also packed to protect intellectual property and reduce file size, so packing is a flag that warrants deeper analysis rather than proof of malice on its own.
Related terms
- Cryptographic Hash
- A fixed-length digest produced from a file's bytes by an algorithm such as MD5 (128-bit), SHA-1 (160-bit), or SHA-256 (256-bit). Identical files...
- Disassembly
- The process of converting raw binary machine code back into human-readable assembly language instructions. Disassembly is always achievable from a binary, unlike...
- Import Address Table (IAT)
- A section of the PE header that lists every external DLL and the functions the executable calls from each. A malware sample's...
- Indicator of Compromise (IoC)
- An observable artefact that suggests a system has been involved in a malicious event. Static analysis produces file-based IoCs: cryptographic hashes, embedded...
- Portable Executable (PE)
- The binary file format used by Windows executables (.exe), dynamic-link libraries (.dll), and drivers (.sys). The PE header contains a structured metadata...