misp-taxonomies/runtime-packer/machinetag.json

{
  "namespace": "runtime-packer",
  "description": "Runtime or software packer used to combine compressed or encrypted data with the decompression or decryption code. This code can add additional obfuscations mechanisms including polymorphic-packer or other obfuscation techniques. This taxonomy lists all the known or official packer used for legitimate use or for packing malicious binaries.",
  "version": 1,
  "predicates": [
    {
      "value": "portable-executable",
      "expanded": "Portable Executable (PE)"
    },
    {
      "value": "dex",
      "expanded": "Dalvik Executable (DEX)"
    },
    {
      "value": "elf",
      "expanded": "Executable Linkable Format (ELF)"
    },
    {
      "value": "mach-o",
      "expanded": "Mach-object (Mach-O)"
    },
    {
      "value": "cli-assembly",
      "expanded": "CLI assembly"
    }
  ],
  "values": [
    {
      "predicate": "portable-executable",
      "entry": [
        {
          "value": ".netshrink",
          "expanded": ".netshrink"
        },
        {
          "value": "alienyze",
          "expanded": "Alienyze"
        },
        {
          "value": "apack",
          "expanded": "aPack"
        },
        {
          "value": "apk-protect",
          "expanded": "APK Protect"
        },
        {
          "value": "armadillo",
          "expanded": "Armadillo"
        },
        {
          "value": "aspack",
          "expanded": "ASPack"
        },
        {
          "value": "aspr-asprotect",
          "expanded": "ASPR (ASProtect)"
        },
        {
          "value": "autoit",
          "expanded": "AutoIT"
        },
        {
          "value": "bero",
          "expanded": "BeRo EXE Packer"
        },
        {
          "value": "boxedapp-packer",
          "expanded": "BoxedApp Packer"
        },
        {
          "value": "cexe",
          "expanded": "CExe"
        },
        {
          "value": "code-virtualizer",
          "expanded": "Code Virtualizer"
        },
        {
          "value": "dexguard",
          "expanded": "DexGuard"
        },
        {
          "value": "dexprotector",
          "expanded": "DexProtector"
        },
        {
          "value": "dotbundle",
          "expanded": "dotBundle"
        },
        {
          "value": "enigma-protector",
          "expanded": "Enigma Protector"
        },
        {
          "value": "exe-bundle",
          "expanded": "EXE Bundle"
        },
        {
          "value": "exe-stealth",
          "expanded": "EXE Stealth"
        },
        {
          "value": "expressor",
          "expanded": "eXPressor"
        },
        {
          "value": "fsg",
          "expanded": "FSG"
        },
        {
          "value": "gzexe",
          "expanded": "GzExe"
        },
        {
          "value": "kkrunchy",
          "expanded": "Kkrunchy"
        },
        {
          "value": "liapp",
          "expanded": "LIAPP"
        },
        {
          "value": "mew",
          "expanded": "MEW"
        },
        {
          "value": "mpress",
          "expanded": "MPRESS"
        },
        {
          "value": "nspack",
          "expanded": "NSPack"
        },
        {
          "value": "obsidium",
          "expanded": "Obsidium"
        },
        {
          "value": "pecompact",
          "expanded": "PECompact"
        },
        {
          "value": "pelock",
          "expanded": "PELock"
        },
        {
          "value": "peshield",
          "expanded": "PEShield"
        },
        {
          "value": "pespin",
          "expanded": "PESpin"
        },
        {
          "value": "petite",
          "expanded": "PEtite"
        },
        {
          "value": "rlpack-basic",
          "expanded": "RLPack Basic"
        },
        {
          "value": "smart-packer-pro",
          "expanded": "Smart Packer Pro"
        },
        {
          "value": "themida",
          "expanded": "Themida"
        },
        {
          "value": "upack",
          "expanded": "UPack"
        },
        {
          "value": "upx",
          "expanded": "UPX"
        },
        {
          "value": "vmprotect",
          "expanded": "VMProtect"
        },
        {
          "value": "xcomp-xpack",
          "expanded": "XComp/XPack"
        },
        {
          "value": "yoda-crypter",
          "expanded": "Yoda's Crypter"
        },
        {
          "value": "yoda-protector",
          "expanded": "Yoda's Protector"
        },
        {
          "value": "zprotect",
          "expanded": "ZProtect"
        }
      ]
    }
  ]
}