A packer is a tool that compresses or encrypts an executable file and adds a small stub that unpacks the original code in memory at run time.
How a packer works
The packer takes a program, compresses and often encrypts its code and data, and wraps it in a new executable. When the packed file starts, the unpacking stub restores the original program in memory and jumps to its real entry point. On disk the file looks completely different from the original.
- Compression packers such as the open-source UPX simply make files smaller.
- Protectors such as Themida or VMProtect add anti-debugging and code virtualisation to protect commercial software from cracking.
- Crypters are packers sold on criminal forums specifically to make malware undetectable.
Why packers matter for security
Most malware today is packed. Packing hides strings, imports and code patterns that antivirus signatures look for, and each new build can look unique. Security teams therefore treat packing as a warning sign: high entropy in file sections, very few imported functions or unusual section names are typical indicators. Static analysis alone often fails, so analysts use sandboxes, memory dumps and debuggers to unpack samples. At the same time, legitimate software also uses packers, so a packed file is not automatically malicious.
Best practices
- Use endpoint protection with behaviour and memory analysis, not only file signatures.
- Treat packed executables from unknown sources as high risk and analyse them in a sandbox.
- Software vendors should sign their packed files so they can be distinguished from malware.
