Share:
Glossary Forensics

Packer

A packer compresses or encrypts an executable and adds a small stub that restores the original code in memory when the program runs.

Last reviewed:

AdSense Placeholder
Slot: header_reference_page

In more detail

Legitimate software uses packers to shrink files, and malware uses them to hide from scanners. Tell-tale signs are sections with very high Entropy (close to 8 bits per byte), few imports and unusual section names; UPX is a common packer.

Try these tools

Executable Forensics

Inspect Windows PE, Linux ELF and macOS Mach-O executables in your browser - headers, sections with per-section entropy, imports/exports.

Binary & Archive Forensics

Inspect any file's true type by magic bytes, carve embedded files at any offset.

See also

  • Glossary Entropy
    In security, entropy measures how unpredictable something is, such as a password or key, usually expressed in bits.
  • Glossary Portable Executable (PE) file
    The Portable Executable format is the structure of Windows programs and libraries (.exe, .dll, .sys).
  • Glossary Malware
    Malware is any software designed to harm a device or steal from its user, including viruses, worms, ransomware, spyware and trojans.
Back to Glossary
AdSense Placeholder
Slot: footer_leaderboard