Packing & Crypters

A universal Mach-O binary bundles multiple architecture slices under one file; hiding a payload in an unusual slice, or exploiting how tools disagree on which slice is 'the' binary, can desync what a reviewer sees from what runs.

Creating an anonymous, in-memory file descriptor with memfd_create and executing an ELF payload from it via fexecve — the payload never touches disk, defeating file-based scanning and disk forensics.

Bundling malware inside a compiled AutoIt executable, where the interpreter stub carries the obfuscated script and payload as appended resources.

Code virtualization, mutation, and anti-dump layers from commercial protectors like Themida and VMProtect, abused by malware to turn whole functions into bytecode for a custom virtual machine.

Stacking multiple packers and stages so each unpacking step only reveals the next packed layer, forcing analysts to recurse to the real payload.

After loading, the stub zeroes the in-memory PE header or corrupts SizeOfImage so memory dumpers that rely on the header fail, forcing the analyst to reconstruct the header before a dump can be parsed.

A small unpacking stub that decrypts the real payload into freshly allocated RWX memory and transfers control to the reconstructed original entry point.

Corrupting the UPX magic, version, or l_info fields so the standard `upx -d` refuses to unpack, while the runtime stub still decompresses normally.

The packer copies the original entry point's first instructions into dynamically allocated stub memory and redirects the EP, so a naive dump lacks those bytes and the real OEP stays hidden until they are recovered.

Compressing a payload with aPLib's LZ-based codec so the real code is unreadable on disk until a tiny depacker inflates it in memory at runtime.

Destroying or hiding the original Import Address Table so static tools see an empty or tiny import list, while the packer reconstructs the real API pointers at runtime.

Compressing an ELF binary with UPX or a modified packer so its code only materialises after a self-decompressing stub runs at load time on Linux.

Packers wipe or redirect the Import Address Table and resolve APIs through a custom thunk stub at runtime, so a static dump has no usable imports and must be reconstructed before analysis.

Hiding an encrypted second-stage payload inside the PE .rsrc section, loaded at runtime via FindResource/LoadResource and decrypted before execution.

Malware registers Thread Local Storage callbacks that execute before the PE entry point, running anti-debug or unpacking logic that most debuggers miss at startup.

A crypter wraps an encrypted payload and a small stub that, at runtime, decrypts the original code in memory and transfers execution to it, so static AV sees only the stub and a high-entropy blob.

Code that rewrites its own instructions at runtime — decrypting or generating the real logic on the fly so a static disassembly never sees the bytes that actually execute.

Compressing an executable with UPX so its real code and strings are only revealed after a self-unpacking stub runs at load time, defeating naive static analysis.

An open-source .NET protector that compresses the assembly into a packed module, then anti-tampers and decrypts constants and methods at runtime.

An encrypted or compressed payload appended after the last section of a PE file — the overlay — that the loader never maps but the stub reads from disk and unpacks at runtime.

Wrapping malware inside a Nullsoft (NSIS) installer so the payload ships as compressed data the setup stub extracts and runs at install time.