2023-09-30 09:59:32 +02:00
{
"namespace" : "runtime-packer" ,
"description" : "Runtime or software packer used to combine compressed or encrypted data with the decompression or decryption code. This code can add additional obfuscations mechanisms including polymorphic-packer or other obfuscation techniques. This taxonomy lists all the known or official packer used for legitimate use or for packing malicious binaries." ,
"version" : 2 ,
"predicates" : [
{
"value" : "dex" ,
"expanded" : "Dalvik Executable (DEX)"
} ,
{
"value" : "elf" ,
"expanded" : "Executable Linkable Format (ELF)"
} ,
{
"value" : "macho" ,
"expanded" : "Mach-object (Mach-O)"
} ,
2023-10-04 23:41:32 +02:00
{
"value" : "pe" ,
"expanded" : "Portable Executable (PE)"
} ,
2023-09-30 09:59:32 +02:00
{
"value" : "cli-assembly" ,
"expanded" : "CLI assembly"
}
] ,
"values" : [
{
"predicate" : "dex" ,
"entry" : [
{
"value" : "apk-protect" ,
"expanded" : "APK Protect"
} ,
{
"value" : "dexguard" ,
"expanded" : "DexGuard"
} ,
{
"value" : "dexprotector" ,
"expanded" : "DexProtector"
}
]
} ,
{
"predicate" : "elf" ,
"entry" : [
{
"value" : "bzexe" ,
"expanded" : "BzExe"
} ,
{
"value" : "ezuri" ,
"expanded" : "Ezuri"
} ,
{
"value" : "gzexe" ,
"expanded" : "GzExe"
} ,
{
"value" : "midgetpack" ,
"expanded" : "MidgetPack"
} ,
{
"value" : "pakkero" ,
"expanded" : "Pakkero"
} ,
{
"value" : "papaw" ,
"expanded" : "Papaw"
} ,
{
"value" : "shiva" ,
"expanded" : "Shiva"
} ,
{
"value" : "upx" ,
"expanded" : "UPX"
}
]
} ,
{
"predicate" : "macho" ,
"entry" : [
{
"value" : "eleckey" ,
"expanded" : "ElecKey"
} ,
{
"value" : "muncho" ,
"expanded" : "Muncho"
} ,
{
"value" : "mpress" ,
"expanded" : "MPRESS"
} ,
{
"value" : "upx" ,
"expanded" : "UPX"
}
]
} ,
{
"predicate" : "pe" ,
"entry" : [
{
"value" : ".netshrink" ,
"expanded" : ".netshrink"
} ,
{
"value" : "acprotect" ,
"expanded" : "ACProtect"
} ,
{
"value" : "alienyze" ,
"expanded" : "Alienyze"
} ,
{
"value" : "apack" ,
"expanded" : "aPack"
} ,
{
"value" : "armadillo" ,
"expanded" : "Armadillo"
} ,
{
"value" : "aspack" ,
"expanded" : "ASPack"
} ,
{
"value" : "asprotect" ,
"expanded" : "ASProtect"
} ,
{
"value" : "autoit" ,
"expanded" : "AutoIT"
} ,
{
"value" : "axprotector" ,
"expanded" : "AxProtector"
} ,
{
"value" : "bero" ,
"expanded" : "BeRo EXE Packer"
} ,
{
"value" : "boxedapp-packer" ,
"expanded" : "BoxedApp Packer"
} ,
{
"value" : "cexe" ,
"expanded" : "CExe"
} ,
{
"value" : "code-virtualizer" ,
"expanded" : "Code Virtualizer"
} ,
{
"value" : "confuserex" ,
"expanded" : "ConfuserEx"
} ,
{
"value" : "dotbundle" ,
"expanded" : "dotBundle"
} ,
{
"value" : "dragon-armor" ,
"expanded" : "Dragon Armor"
} ,
{
"value" : "eleckey" ,
"expanded" : "ElecKey"
} ,
{
"value" : "enigma-protector" ,
"expanded" : "Enigma Protector"
} ,
{
"value" : "enigma-virtual-box" ,
"expanded" : "Enigma Virtual Box"
} ,
{
"value" : "exe-bundle" ,
"expanded" : "EXE Bundle"
} ,
{
"value" : "exe-stealth" ,
"expanded" : "EXE Stealth"
} ,
{
"value" : "exe32pack" ,
"expanded" : "EXE32Pack"
} ,
{
"value" : "expressor" ,
"expanded" : "eXPressor"
} ,
{
"value" : "fsg" ,
"expanded" : "FSG"
} ,
{
"value" : "hxor-packer" ,
"expanded" : "hXOR Packer"
} ,
{
"value" : "jdpack" ,
"expanded" : "JDPack"
} ,
{
"value" : "kkrunchy" ,
"expanded" : "Kkrunchy"
} ,
{
"value" : "liapp" ,
"expanded" : "LIAPP"
} ,
{
"value" : "mew" ,
"expanded" : "MEW"
} ,
{
"value" : "molebox" ,
"expanded" : "MoleBox"
} ,
{
"value" : "morphine" ,
"expanded" : "Morphine"
} ,
{
"value" : "mpress" ,
"expanded" : "MPRESS"
} ,
{
"value" : "neolite" ,
"expanded" : "Neolite"
} ,
{
"value" : "netcrypt" ,
"expanded" : "NetCrypt"
} ,
{
"value" : "nspack" ,
"expanded" : "NSPack"
} ,
{
"value" : "obsidium" ,
"expanded" : "Obsidium"
} ,
{
"value" : "packman" ,
"expanded" : "Packman"
} ,
{
"value" : "pecompact" ,
"expanded" : "PECompact"
} ,
{
"value" : "pelock" ,
"expanded" : "PELock"
} ,
{
"value" : "pepacker" ,
"expanded" : "PE Packer"
} ,
{
"value" : "peshield" ,
"expanded" : "PEShield"
} ,
{
"value" : "pespin" ,
"expanded" : "PESpin"
} ,
{
"value" : "petite" ,
"expanded" : "PEtite"
} ,
{
"value" : "procrypt" ,
"expanded" : "ProCrypt"
} ,
{
"value" : "rlpack-basic" ,
"expanded" : "RLPack Basic"
} ,
{
"value" : "smart-packer-pro" ,
"expanded" : "Smart Packer Pro"
} ,
{
"value" : "squishy" ,
"expanded" : "Squishy"
} ,
{
"value" : "telock" ,
"expanded" : "Telock"
} ,
{
"value" : "themida" ,
"expanded" : "Themida"
} ,
{
"value" : "thinstall" ,
"expanded" : "Thinstall"
} ,
{
"value" : "upack" ,
"expanded" : "UPack"
} ,
{
"value" : "upx" ,
"expanded" : "UPX"
} ,
{
"value" : "vmprotect" ,
"expanded" : "VMProtect"
} ,
{
"value" : "xcomp-xpack" ,
"expanded" : "XComp/XPack"
} ,
{
"value" : "yoda-crypter" ,
"expanded" : "Yoda's Crypter"
} ,
{
"value" : "yoda-protector" ,
"expanded" : "Yoda's Protector"
} ,
{
"value" : "zprotect" ,
"expanded" : "ZProtect"
}
]
}
]
}