misp-taxonomies/runtime-packer/machinetag.json

{
  "namespace": "runtime-packer",
  "description": "Runtime or software packer used to combine compressed or encrypted data with the decompression or decryption code. This code can add additional obfuscations mechanisms including polymorphic-packer or other obfuscation techniques. This taxonomy lists all the known or official packer used for legitimate use or for packing malicious binaries.",
  "version": 2,
  "predicates": [
    {
      "value": "pe",
      "expanded": "Portable Executable (PE)"
    },
    {
      "value": "dex",
      "expanded": "Dalvik Executable (DEX)"
    },
    {
      "value": "elf",
      "expanded": "Executable Linkable Format (ELF)"
    },
    {
      "value": "macho",
      "expanded": "Mach-object (Mach-O)"
    },
    {
      "value": "cli-assembly",
      "expanded": "CLI assembly"
    }
  ],
  "values": [
    {
      "predicate": "dex",
      "entry": [
        {
          "value": "apk-protect",
          "expanded": "APK Protect"
        },
        {
          "value": "dexguard",
          "expanded": "DexGuard"
        },
        {
          "value": "dexprotector",
          "expanded": "DexProtector"
        }
      ]
    },
    {
      "predicate": "elf",
      "entry": [
        {
          "value": "bzexe",
          "expanded": "BzExe"
        },
        {
          "value": "ezuri",
          "expanded": "Ezuri"
        },
        {
          "value": "gzexe",
          "expanded": "GzExe"
        },
        {
          "value": "midgetpack",
          "expanded": "MidgetPack"
        },
        {
          "value": "pakkero",
          "expanded": "Pakkero"
        },
        {
          "value": "papaw",
          "expanded": "Papaw"
        },
        {
          "value": "shiva",
          "expanded": "Shiva"
        },
        {
          "value": "upx",
          "expanded": "UPX"
        }
      ]
    },
    {
      "predicate": "macho",
      "entry": [
        {
          "value": "eleckey",
          "expanded": "ElecKey"
        },
        {
          "value": "muncho",
          "expanded": "Muncho"
        },
        {
          "value": "mpress",
          "expanded": "MPRESS"
        },
        {
          "value": "upx",
          "expanded": "UPX"
        }
      ]
    },
    {
      "predicate": "pe",
      "entry": [
        {
          "value": ".netshrink",
          "expanded": ".netshrink"
        },
        {
          "value": "acprotect",
          "expanded": "ACProtect"
        },
        {
          "value": "alienyze",
          "expanded": "Alienyze"
        },
        {
          "value": "apack",
          "expanded": "aPack"
        },
        {
          "value": "armadillo",
          "expanded": "Armadillo"
        },
        {
          "value": "aspack",
          "expanded": "ASPack"
        },
        {
          "value": "asprotect",
          "expanded": "ASProtect"
        },
        {
          "value": "autoit",
          "expanded": "AutoIT"
        },
        {
          "value": "axprotector",
          "expanded": "AxProtector"
        },
        {
          "value": "bero",
          "expanded": "BeRo EXE Packer"
        },
        {
          "value": "boxedapp-packer",
          "expanded": "BoxedApp Packer"
        },
        {
          "value": "cexe",
          "expanded": "CExe"
        },
        {
          "value": "code-virtualizer",
          "expanded": "Code Virtualizer"
        },
        {
          "value": "confuserex",
          "expanded": "ConfuserEx"
        },
        {
          "value": "dotbundle",
          "expanded": "dotBundle"
        },
        {
          "value": "dragon-armor",
          "expanded": "Dragon Armor"
        },
        {
          "value": "eleckey",
          "expanded": "ElecKey"
        },
        {
          "value": "enigma-protector",
          "expanded": "Enigma Protector"
        },
        {
          "value": "enigma-virtual-box",
          "expanded": "Enigma Virtual Box"
        },
        {
          "value": "exe-bundle",
          "expanded": "EXE Bundle"
        },
        {
          "value": "exe-stealth",
          "expanded": "EXE Stealth"
        },
        {
          "value": "exe32pack",
          "expanded": "EXE32Pack"
        },
        {
          "value": "expressor",
          "expanded": "eXPressor"
        },
        {
          "value": "fsg",
          "expanded": "FSG"
        },
        {
          "value": "hxor-packer",
          "expanded": "hXOR Packer"
        },
        {
          "value": "jdpack",
          "expanded": "JDPack"
        },
        {
          "value": "kkrunchy",
          "expanded": "Kkrunchy"
        },
        {
          "value": "liapp",
          "expanded": "LIAPP"
        },
        {
          "value": "mew",
          "expanded": "MEW"
        },
        {
          "value": "molebox",
          "expanded": "MoleBox"
        },
        {
          "value": "morphine",
          "expanded": "Morphine"
        },
        {
          "value": "mpress",
          "expanded": "MPRESS"
        },
        {
          "value": "neolite",
          "expanded": "Neolite"
        },
        {
          "value": "netcrypt",
          "expanded": "NetCrypt"
        },
        {
          "value": "nspack",
          "expanded": "NSPack"
        },
        {
          "value": "obsidium",
          "expanded": "Obsidium"
        },
        {
          "value": "packman",
          "expanded": "Packman"
        },
        {
          "value": "pecompact",
          "expanded": "PECompact"
        },
        {
          "value": "pelock",
          "expanded": "PELock"
        },
        {
          "value": "pepacker",
          "expanded": "PE Packer"
        },
        {
          "value": "peshield",
          "expanded": "PEShield"
        },
        {
          "value": "pespin",
          "expanded": "PESpin"
        },
        {
          "value": "petite",
          "expanded": "PEtite"
        },
        {
          "value": "procrypt",
          "expanded": "ProCrypt"
        },
        {
          "value": "rlpack-basic",
          "expanded": "RLPack Basic"
        },
        {
          "value": "smart-packer-pro",
          "expanded": "Smart Packer Pro"
        },
        {
          "value": "squishy",
          "expanded": "Squishy"
        },
        {
          "value": "telock",
          "expanded": "Telock"
        },
        {
          "value": "themida",
          "expanded": "Themida"
        },
        {
          "value": "thinstall",
          "expanded": "Thinstall"
        },
        {
          "value": "upack",
          "expanded": "UPack"
        },
        {
          "value": "upx",
          "expanded": "UPX"
        },
        {
          "value": "vmprotect",
          "expanded": "VMProtect"
        },
        {
          "value": "xcomp-xpack",
          "expanded": "XComp/XPack"
        },
        {
          "value": "yoda-crypter",
          "expanded": "Yoda's Crypter"
        },
        {
          "value": "yoda-protector",
          "expanded": "Yoda's Protector"
        },
        {
          "value": "zprotect",
          "expanded": "ZProtect"
        }
      ]
    }
  ]
}