From 6d2ad30f7d0e747b3aa70440e61bd4735775fd64 Mon Sep 17 00:00:00 2001 From: dhondta Date: Sat, 30 Sep 2023 08:36:24 +0200 Subject: [PATCH 1/4] Improved runtime-packers --- runtime-packer/machinetag.json | 476 +++++++++++++++++++-------------- 1 file changed, 274 insertions(+), 202 deletions(-) diff --git a/runtime-packer/machinetag.json b/runtime-packer/machinetag.json index f8e91d6..8df5dd2 100644 --- a/runtime-packer/machinetag.json +++ b/runtime-packer/machinetag.json @@ -1,202 +1,274 @@ -{ - "namespace": "runtime-packer", - "description": "Runtime or software packer used to combine compressed or encrypted data with the decompression or decryption code. This code can add additional obfuscations mechanisms including polymorphic-packer or other obfuscation techniques. This taxonomy lists all the known or official packer used for legitimate use or for packing malicious binaries.", - "version": 1, - "predicates": [ - { - "value": "portable-executable", - "expanded": "Portable Executable (PE)" - }, - { - "value": "dex", - "expanded": "Dalvik Executable (DEX)" - }, - { - "value": "elf", - "expanded": "Executable Linkable Format (ELF)" - }, - { - "value": "mach-o", - "expanded": "Mach-object (Mach-O)" - }, - { - "value": "cli-assembly", - "expanded": "CLI assembly" - } - ], - "values": [ - { - "predicate": "portable-executable", - "entry": [ - { - "value": ".netshrink", - "expanded": ".netshrink" - }, - { - "value": "alienyze", - "expanded": "Alienyze" - }, - { - "value": "apack", - "expanded": "aPack" - }, - { - "value": "apk-protect", - "expanded": "APK Protect" - }, - { - "value": "armadillo", - "expanded": "Armadillo" - }, - { - "value": "aspack", - "expanded": "ASPack" - }, - { - "value": "aspr-asprotect", - "expanded": "ASPR (ASProtect)" - }, - { - "value": "autoit", - "expanded": "AutoIT" - }, - { - "value": "bero", - "expanded": "BeRo EXE Packer" - }, - { - "value": "boxedapp-packer", - "expanded": "BoxedApp Packer" - }, - { - "value": "cexe", - "expanded": "CExe" - }, - { - "value": "code-virtualizer", - "expanded": "Code Virtualizer" - }, - { - "value": "dexguard", - "expanded": "DexGuard" - }, - { - "value": "dexprotector", - "expanded": "DexProtector" - }, - { - "value": "dotbundle", - "expanded": "dotBundle" - }, - { - "value": "enigma-protector", - "expanded": "Enigma Protector" - }, - { - "value": "exe-bundle", - "expanded": "EXE Bundle" - }, - { - "value": "exe-stealth", - "expanded": "EXE Stealth" - }, - { - "value": "expressor", - "expanded": "eXPressor" - }, - { - "value": "fsg", - "expanded": "FSG" - }, - { - "value": "gzexe", - "expanded": "GzExe" - }, - { - "value": "kkrunchy", - "expanded": "Kkrunchy" - }, - { - "value": "liapp", - "expanded": "LIAPP" - }, - { - "value": "mew", - "expanded": "MEW" - }, - { - "value": "mpress", - "expanded": "MPRESS" - }, - { - "value": "nspack", - "expanded": "NSPack" - }, - { - "value": "obsidium", - "expanded": "Obsidium" - }, - { - "value": "pecompact", - "expanded": "PECompact" - }, - { - "value": "pelock", - "expanded": "PELock" - }, - { - "value": "peshield", - "expanded": "PEShield" - }, - { - "value": "pespin", - "expanded": "PESpin" - }, - { - "value": "petite", - "expanded": "PEtite" - }, - { - "value": "rlpack-basic", - "expanded": "RLPack Basic" - }, - { - "value": "smart-packer-pro", - "expanded": "Smart Packer Pro" - }, - { - "value": "themida", - "expanded": "Themida" - }, - { - "value": "upack", - "expanded": "UPack" - }, - { - "value": "upx", - "expanded": "UPX" - }, - { - "value": "vmprotect", - "expanded": "VMProtect" - }, - { - "value": "xcomp-xpack", - "expanded": "XComp/XPack" - }, - { - "value": "yoda-crypter", - "expanded": "Yoda's Crypter" - }, - { - "value": "yoda-protector", - "expanded": "Yoda's Protector" - }, - { - "value": "zprotect", - "expanded": "ZProtect" - } - ] - } - ] -} +{ + "namespace": "runtime-packer", + "description": "Runtime or software packer used to combine compressed or encrypted data with the decompression or decryption code. This code can add additional obfuscations mechanisms including polymorphic-packer or other obfuscation techniques. This taxonomy lists all the known or official packer used for legitimate use or for packing malicious binaries.", + "version": 1, + "predicates": [ + { + "value": "pe", + "expanded": "Portable Executable (PE)" + }, + { + "value": "dex", + "expanded": "Dalvik Executable (DEX)" + }, + { + "value": "elf", + "expanded": "Executable Linkable Format (ELF)" + }, + { + "value": "mach-o", + "expanded": "Mach-object (Mach-O)" + }, + { + "value": "cli-assembly", + "expanded": "CLI assembly" + } + ], + "values": [ + { + "predicate": "portable-executable", + "entry": [ + { + "value": ".netshrink", + "expanded": ".netshrink" + }, + { + "value": "acprotect", + "expanded": "ACProtect" + }, + { + "value": "alienyze", + "expanded": "Alienyze" + }, + { + "value": "apack", + "expanded": "aPack" + }, + { + "value": "apk-protect", + "expanded": "APK Protect" + }, + { + "value": "armadillo", + "expanded": "Armadillo" + }, + { + "value": "aspack", + "expanded": "ASPack" + }, + { + "value": "asprotect", + "expanded": "ASProtect" + }, + { + "value": "autoit", + "expanded": "AutoIT" + }, + { + "value": "bero", + "expanded": "BeRo EXE Packer" + }, + { + "value": "boxedapp-packer", + "expanded": "BoxedApp Packer" + }, + { + "value": "cexe", + "expanded": "CExe" + }, + { + "value": "code-virtualizer", + "expanded": "Code Virtualizer" + }, + { + "value": "dexguard", + "expanded": "DexGuard" + }, + { + "value": "dexprotector", + "expanded": "DexProtector" + }, + { + "value": "dotbundle", + "expanded": "dotBundle" + }, + { + "value": "enigma-protector", + "expanded": "Enigma Protector" + }, + { + "value": "enigma-virtual-box", + "expanded": "Enigma Virtual Box" + }, + { + "value": "exe-bundle", + "expanded": "EXE Bundle" + }, + { + "value": "exe-stealth", + "expanded": "EXE Stealth" + }, + { + "value": "exe32pack", + "expanded": "EXE32Pack" + }, + { + "value": "expressor", + "expanded": "eXPressor" + }, + { + "value": "fsg", + "expanded": "FSG" + }, + { + "value": "gzexe", + "expanded": "GzExe" + }, + { + "value": "hxor-packer", + "expanded": "hXOR Packer" + }, + { + "value": "jdpack", + "expanded": "JDPack" + }, + { + "value": "kkrunchy", + "expanded": "Kkrunchy" + }, + { + "value": "liapp", + "expanded": "LIAPP" + }, + { + "value": "mew", + "expanded": "MEW" + }, + { + "value": "midgetpack", + "expanded": "MidgetPack" + }, + { + "value": "molebox", + "expanded": "MoleBox" + }, + { + "value": "morphine", + "expanded": "Morphine" + }, + { + "value": "mpress", + "expanded": "MPRESS" + }, + { + "value": "muncho", + "expanded": "Muncho" + }, + { + "value": "neolite", + "expanded": "Neolite" + }, + { + "value": "netcrypt", + "expanded": "NetCrypt" + }, + { + "value": "nspack", + "expanded": "NSPack" + }, + { + "value": "obsidium", + "expanded": "Obsidium" + }, + { + "value": "packman", + "expanded": "Packman" + }, + { + "value": "pakkero", + "expanded": "Pakkero" + }, + { + "value": "pecompact", + "expanded": "PECompact" + }, + { + "value": "pelock", + "expanded": "PELock" + }, + { + "value": "pepacker", + "expanded": "PE Packer" + }, + { + "value": "peshield", + "expanded": "PEShield" + }, + { + "value": "pespin", + "expanded": "PESpin" + }, + { + "value": "petite", + "expanded": "PEtite" + }, + { + "value": "rlpack-basic", + "expanded": "RLPack Basic" + }, + { + "value": "shiva", + "expanded": "Shiva" + }, + { + "value": "smart-packer-pro", + "expanded": "Smart Packer Pro" + }, + { + "value": "squishy", + "expanded": "Squishy" + }, + { + "value": "telock", + "expanded": "Telock" + }, + { + "value": "themida", + "expanded": "Themida" + }, + { + "value": "thinstall", + "expanded": "Thinstall" + }, + { + "value": "upack", + "expanded": "UPack" + }, + { + "value": "upx", + "expanded": "UPX" + }, + { + "value": "vmprotect", + "expanded": "VMProtect" + }, + { + "value": "xcomp-xpack", + "expanded": "XComp/XPack" + }, + { + "value": "yoda-crypter", + "expanded": "Yoda's Crypter" + }, + { + "value": "yoda-protector", + "expanded": "Yoda's Protector" + }, + { + "value": "zprotect", + "expanded": "ZProtect" + } + ] + } + ] +} From 95bcc0cc5fa0cb1f54a746dd3d28d073755e28c2 Mon Sep 17 00:00:00 2001 From: dhondta Date: Sat, 30 Sep 2023 08:56:23 +0200 Subject: [PATCH 2/4] Improved runtime-packers (2) --- runtime-packer/machinetag.json | 127 ++++++++++++++++++++++++--------- 1 file changed, 95 insertions(+), 32 deletions(-) diff --git a/runtime-packer/machinetag.json b/runtime-packer/machinetag.json index 8df5dd2..87175d1 100644 --- a/runtime-packer/machinetag.json +++ b/runtime-packer/machinetag.json @@ -16,7 +16,7 @@ "expanded": "Executable Linkable Format (ELF)" }, { - "value": "mach-o", + "value": "macho", "expanded": "Mach-object (Mach-O)" }, { @@ -26,7 +26,82 @@ ], "values": [ { - "predicate": "portable-executable", + "predicate": "dex", + "entry": [ + { + "value": "apk-protect", + "expanded": "APK Protect" + }, + { + "value": "dexguard", + "expanded": "DexGuard" + }, + { + "value": "dexprotector", + "expanded": "DexProtector" + } + ] + }, + { + "predicate": "elf", + "entry": [ + { + "value": "bzexe", + "expanded": "BzExe" + }, + { + "value": "ezuri", + "expanded": "Ezuri" + }, + { + "value": "gzexe", + "expanded": "GzExe" + }, + { + "value": "midgetpack", + "expanded": "MidgetPack" + }, + { + "value": "pakkero", + "expanded": "Pakkero" + }, + { + "value": "papaw", + "expanded": "Papaw" + }, + { + "value": "shiva", + "expanded": "Shiva" + }, + { + "value": "upx", + "expanded": "UPX" + } + ] + }, + { + "predicate": "macho", + "entry": [ + { + "value": "eleckey", + "expanded": "ElecKey" + }, + { + "value": "muncho", + "expanded": "Muncho" + }, + { + "value": "mpress", + "expanded": "MPRESS" + }, + { + "value": "upx", + "expanded": "UPX" + } + ] + }, + { + "predicate": "pe", "entry": [ { "value": ".netshrink", @@ -44,10 +119,6 @@ "value": "apack", "expanded": "aPack" }, - { - "value": "apk-protect", - "expanded": "APK Protect" - }, { "value": "armadillo", "expanded": "Armadillo" @@ -64,6 +135,10 @@ "value": "autoit", "expanded": "AutoIT" }, + { + "value": "axprotector", + "expanded": "AxProtector" + }, { "value": "bero", "expanded": "BeRo EXE Packer" @@ -81,17 +156,21 @@ "expanded": "Code Virtualizer" }, { - "value": "dexguard", - "expanded": "DexGuard" - }, - { - "value": "dexprotector", - "expanded": "DexProtector" + "value": "confuserex", + "expanded": "ConfuserEx" }, { "value": "dotbundle", "expanded": "dotBundle" }, + { + "value": "dragon-armor", + "expanded": "Dragon Armor" + }, + { + "value": "eleckey", + "expanded": "ElecKey" + }, { "value": "enigma-protector", "expanded": "Enigma Protector" @@ -120,10 +199,6 @@ "value": "fsg", "expanded": "FSG" }, - { - "value": "gzexe", - "expanded": "GzExe" - }, { "value": "hxor-packer", "expanded": "hXOR Packer" @@ -144,10 +219,6 @@ "value": "mew", "expanded": "MEW" }, - { - "value": "midgetpack", - "expanded": "MidgetPack" - }, { "value": "molebox", "expanded": "MoleBox" @@ -160,10 +231,6 @@ "value": "mpress", "expanded": "MPRESS" }, - { - "value": "muncho", - "expanded": "Muncho" - }, { "value": "neolite", "expanded": "Neolite" @@ -184,10 +251,6 @@ "value": "packman", "expanded": "Packman" }, - { - "value": "pakkero", - "expanded": "Pakkero" - }, { "value": "pecompact", "expanded": "PECompact" @@ -213,12 +276,12 @@ "expanded": "PEtite" }, { - "value": "rlpack-basic", - "expanded": "RLPack Basic" + "value": "procrypt", + "expanded": "ProCrypt" }, { - "value": "shiva", - "expanded": "Shiva" + "value": "rlpack-basic", + "expanded": "RLPack Basic" }, { "value": "smart-packer-pro", From 97aba06ca5efc1d0e7dfc05309f5e7e7da99860d Mon Sep 17 00:00:00 2001 From: dhondta Date: Sat, 30 Sep 2023 08:57:22 +0200 Subject: [PATCH 3/4] Updated runtime-packer version --- runtime-packer/machinetag.json | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/runtime-packer/machinetag.json b/runtime-packer/machinetag.json index 87175d1..99df869 100644 --- a/runtime-packer/machinetag.json +++ b/runtime-packer/machinetag.json @@ -1,7 +1,7 @@ { "namespace": "runtime-packer", "description": "Runtime or software packer used to combine compressed or encrypted data with the decompression or decryption code. This code can add additional obfuscations mechanisms including polymorphic-packer or other obfuscation techniques. This taxonomy lists all the known or official packer used for legitimate use or for packing malicious binaries.", - "version": 1, + "version": 2, "predicates": [ { "value": "pe", From cb2132f32ff75dcb18143bbdfd25aac067b4887c Mon Sep 17 00:00:00 2001 From: dhondta Date: Sat, 30 Sep 2023 09:59:32 +0200 Subject: [PATCH 4/4] jq'ed machinetag.json --- runtime-packer/machinetag.json | 674 ++++++++++++++++----------------- 1 file changed, 337 insertions(+), 337 deletions(-) diff --git a/runtime-packer/machinetag.json b/runtime-packer/machinetag.json index 99df869..4ac69a0 100644 --- a/runtime-packer/machinetag.json +++ b/runtime-packer/machinetag.json @@ -1,337 +1,337 @@ -{ - "namespace": "runtime-packer", - "description": "Runtime or software packer used to combine compressed or encrypted data with the decompression or decryption code. This code can add additional obfuscations mechanisms including polymorphic-packer or other obfuscation techniques. This taxonomy lists all the known or official packer used for legitimate use or for packing malicious binaries.", - "version": 2, - "predicates": [ - { - "value": "pe", - "expanded": "Portable Executable (PE)" - }, - { - "value": "dex", - "expanded": "Dalvik Executable (DEX)" - }, - { - "value": "elf", - "expanded": "Executable Linkable Format (ELF)" - }, - { - "value": "macho", - "expanded": "Mach-object (Mach-O)" - }, - { - "value": "cli-assembly", - "expanded": "CLI assembly" - } - ], - "values": [ - { - "predicate": "dex", - "entry": [ - { - "value": "apk-protect", - "expanded": "APK Protect" - }, - { - "value": "dexguard", - "expanded": "DexGuard" - }, - { - "value": "dexprotector", - "expanded": "DexProtector" - } - ] - }, - { - "predicate": "elf", - "entry": [ - { - "value": "bzexe", - "expanded": "BzExe" - }, - { - "value": "ezuri", - "expanded": "Ezuri" - }, - { - "value": "gzexe", - "expanded": "GzExe" - }, - { - "value": "midgetpack", - "expanded": "MidgetPack" - }, - { - "value": "pakkero", - "expanded": "Pakkero" - }, - { - "value": "papaw", - "expanded": "Papaw" - }, - { - "value": "shiva", - "expanded": "Shiva" - }, - { - "value": "upx", - "expanded": "UPX" - } - ] - }, - { - "predicate": "macho", - "entry": [ - { - "value": "eleckey", - "expanded": "ElecKey" - }, - { - "value": "muncho", - "expanded": "Muncho" - }, - { - "value": "mpress", - "expanded": "MPRESS" - }, - { - "value": "upx", - "expanded": "UPX" - } - ] - }, - { - "predicate": "pe", - "entry": [ - { - "value": ".netshrink", - "expanded": ".netshrink" - }, - { - "value": "acprotect", - "expanded": "ACProtect" - }, - { - "value": "alienyze", - "expanded": "Alienyze" - }, - { - "value": "apack", - "expanded": "aPack" - }, - { - "value": "armadillo", - "expanded": "Armadillo" - }, - { - "value": "aspack", - "expanded": "ASPack" - }, - { - "value": "asprotect", - "expanded": "ASProtect" - }, - { - "value": "autoit", - "expanded": "AutoIT" - }, - { - "value": "axprotector", - "expanded": "AxProtector" - }, - { - "value": "bero", - "expanded": "BeRo EXE Packer" - }, - { - "value": "boxedapp-packer", - "expanded": "BoxedApp Packer" - }, - { - "value": "cexe", - "expanded": "CExe" - }, - { - "value": "code-virtualizer", - "expanded": "Code Virtualizer" - }, - { - "value": "confuserex", - "expanded": "ConfuserEx" - }, - { - "value": "dotbundle", - "expanded": "dotBundle" - }, - { - "value": "dragon-armor", - "expanded": "Dragon Armor" - }, - { - "value": "eleckey", - "expanded": "ElecKey" - }, - { - "value": "enigma-protector", - "expanded": "Enigma Protector" - }, - { - "value": "enigma-virtual-box", - "expanded": "Enigma Virtual Box" - }, - { - "value": "exe-bundle", - "expanded": "EXE Bundle" - }, - { - "value": "exe-stealth", - "expanded": "EXE Stealth" - }, - { - "value": "exe32pack", - "expanded": "EXE32Pack" - }, - { - "value": "expressor", - "expanded": "eXPressor" - }, - { - "value": "fsg", - "expanded": "FSG" - }, - { - "value": "hxor-packer", - "expanded": "hXOR Packer" - }, - { - "value": "jdpack", - "expanded": "JDPack" - }, - { - "value": "kkrunchy", - "expanded": "Kkrunchy" - }, - { - "value": "liapp", - "expanded": "LIAPP" - }, - { - "value": "mew", - "expanded": "MEW" - }, - { - "value": "molebox", - "expanded": "MoleBox" - }, - { - "value": "morphine", - "expanded": "Morphine" - }, - { - "value": "mpress", - "expanded": "MPRESS" - }, - { - "value": "neolite", - "expanded": "Neolite" - }, - { - "value": "netcrypt", - "expanded": "NetCrypt" - }, - { - "value": "nspack", - "expanded": "NSPack" - }, - { - "value": "obsidium", - "expanded": "Obsidium" - }, - { - "value": "packman", - "expanded": "Packman" - }, - { - "value": "pecompact", - "expanded": "PECompact" - }, - { - "value": "pelock", - "expanded": "PELock" - }, - { - "value": "pepacker", - "expanded": "PE Packer" - }, - { - "value": "peshield", - "expanded": "PEShield" - }, - { - "value": "pespin", - "expanded": "PESpin" - }, - { - "value": "petite", - "expanded": "PEtite" - }, - { - "value": "procrypt", - "expanded": "ProCrypt" - }, - { - "value": "rlpack-basic", - "expanded": "RLPack Basic" - }, - { - "value": "smart-packer-pro", - "expanded": "Smart Packer Pro" - }, - { - "value": "squishy", - "expanded": "Squishy" - }, - { - "value": "telock", - "expanded": "Telock" - }, - { - "value": "themida", - "expanded": "Themida" - }, - { - "value": "thinstall", - "expanded": "Thinstall" - }, - { - "value": "upack", - "expanded": "UPack" - }, - { - "value": "upx", - "expanded": "UPX" - }, - { - "value": "vmprotect", - "expanded": "VMProtect" - }, - { - "value": "xcomp-xpack", - "expanded": "XComp/XPack" - }, - { - "value": "yoda-crypter", - "expanded": "Yoda's Crypter" - }, - { - "value": "yoda-protector", - "expanded": "Yoda's Protector" - }, - { - "value": "zprotect", - "expanded": "ZProtect" - } - ] - } - ] -} +{ + "namespace": "runtime-packer", + "description": "Runtime or software packer used to combine compressed or encrypted data with the decompression or decryption code. This code can add additional obfuscations mechanisms including polymorphic-packer or other obfuscation techniques. This taxonomy lists all the known or official packer used for legitimate use or for packing malicious binaries.", + "version": 2, + "predicates": [ + { + "value": "pe", + "expanded": "Portable Executable (PE)" + }, + { + "value": "dex", + "expanded": "Dalvik Executable (DEX)" + }, + { + "value": "elf", + "expanded": "Executable Linkable Format (ELF)" + }, + { + "value": "macho", + "expanded": "Mach-object (Mach-O)" + }, + { + "value": "cli-assembly", + "expanded": "CLI assembly" + } + ], + "values": [ + { + "predicate": "dex", + "entry": [ + { + "value": "apk-protect", + "expanded": "APK Protect" + }, + { + "value": "dexguard", + "expanded": "DexGuard" + }, + { + "value": "dexprotector", + "expanded": "DexProtector" + } + ] + }, + { + "predicate": "elf", + "entry": [ + { + "value": "bzexe", + "expanded": "BzExe" + }, + { + "value": "ezuri", + "expanded": "Ezuri" + }, + { + "value": "gzexe", + "expanded": "GzExe" + }, + { + "value": "midgetpack", + "expanded": "MidgetPack" + }, + { + "value": "pakkero", + "expanded": "Pakkero" + }, + { + "value": "papaw", + "expanded": "Papaw" + }, + { + "value": "shiva", + "expanded": "Shiva" + }, + { + "value": "upx", + "expanded": "UPX" + } + ] + }, + { + "predicate": "macho", + "entry": [ + { + "value": "eleckey", + "expanded": "ElecKey" + }, + { + "value": "muncho", + "expanded": "Muncho" + }, + { + "value": "mpress", + "expanded": "MPRESS" + }, + { + "value": "upx", + "expanded": "UPX" + } + ] + }, + { + "predicate": "pe", + "entry": [ + { + "value": ".netshrink", + "expanded": ".netshrink" + }, + { + "value": "acprotect", + "expanded": "ACProtect" + }, + { + "value": "alienyze", + "expanded": "Alienyze" + }, + { + "value": "apack", + "expanded": "aPack" + }, + { + "value": "armadillo", + "expanded": "Armadillo" + }, + { + "value": "aspack", + "expanded": "ASPack" + }, + { + "value": "asprotect", + "expanded": "ASProtect" + }, + { + "value": "autoit", + "expanded": "AutoIT" + }, + { + "value": "axprotector", + "expanded": "AxProtector" + }, + { + "value": "bero", + "expanded": "BeRo EXE Packer" + }, + { + "value": "boxedapp-packer", + "expanded": "BoxedApp Packer" + }, + { + "value": "cexe", + "expanded": "CExe" + }, + { + "value": "code-virtualizer", + "expanded": "Code Virtualizer" + }, + { + "value": "confuserex", + "expanded": "ConfuserEx" + }, + { + "value": "dotbundle", + "expanded": "dotBundle" + }, + { + "value": "dragon-armor", + "expanded": "Dragon Armor" + }, + { + "value": "eleckey", + "expanded": "ElecKey" + }, + { + "value": "enigma-protector", + "expanded": "Enigma Protector" + }, + { + "value": "enigma-virtual-box", + "expanded": "Enigma Virtual Box" + }, + { + "value": "exe-bundle", + "expanded": "EXE Bundle" + }, + { + "value": "exe-stealth", + "expanded": "EXE Stealth" + }, + { + "value": "exe32pack", + "expanded": "EXE32Pack" + }, + { + "value": "expressor", + "expanded": "eXPressor" + }, + { + "value": "fsg", + "expanded": "FSG" + }, + { + "value": "hxor-packer", + "expanded": "hXOR Packer" + }, + { + "value": "jdpack", + "expanded": "JDPack" + }, + { + "value": "kkrunchy", + "expanded": "Kkrunchy" + }, + { + "value": "liapp", + "expanded": "LIAPP" + }, + { + "value": "mew", + "expanded": "MEW" + }, + { + "value": "molebox", + "expanded": "MoleBox" + }, + { + "value": "morphine", + "expanded": "Morphine" + }, + { + "value": "mpress", + "expanded": "MPRESS" + }, + { + "value": "neolite", + "expanded": "Neolite" + }, + { + "value": "netcrypt", + "expanded": "NetCrypt" + }, + { + "value": "nspack", + "expanded": "NSPack" + }, + { + "value": "obsidium", + "expanded": "Obsidium" + }, + { + "value": "packman", + "expanded": "Packman" + }, + { + "value": "pecompact", + "expanded": "PECompact" + }, + { + "value": "pelock", + "expanded": "PELock" + }, + { + "value": "pepacker", + "expanded": "PE Packer" + }, + { + "value": "peshield", + "expanded": "PEShield" + }, + { + "value": "pespin", + "expanded": "PESpin" + }, + { + "value": "petite", + "expanded": "PEtite" + }, + { + "value": "procrypt", + "expanded": "ProCrypt" + }, + { + "value": "rlpack-basic", + "expanded": "RLPack Basic" + }, + { + "value": "smart-packer-pro", + "expanded": "Smart Packer Pro" + }, + { + "value": "squishy", + "expanded": "Squishy" + }, + { + "value": "telock", + "expanded": "Telock" + }, + { + "value": "themida", + "expanded": "Themida" + }, + { + "value": "thinstall", + "expanded": "Thinstall" + }, + { + "value": "upack", + "expanded": "UPack" + }, + { + "value": "upx", + "expanded": "UPX" + }, + { + "value": "vmprotect", + "expanded": "VMProtect" + }, + { + "value": "xcomp-xpack", + "expanded": "XComp/XPack" + }, + { + "value": "yoda-crypter", + "expanded": "Yoda's Crypter" + }, + { + "value": "yoda-protector", + "expanded": "Yoda's Protector" + }, + { + "value": "zprotect", + "expanded": "ZProtect" + } + ] + } + ] +}