misp-taxonomies/runtime-packer/machinetag.json

203 lines
4.5 KiB
JSON

{
"namespace": "runtime-packer",
"description": "Runtime or software packer used to combine compressed or encrypted data with the decompression or decryption code. This code can add additional obfuscations mechanisms including polymorphic-packer or other obfuscation techniques. This taxonomy lists all the known or official packer used for legitimate use or for packing malicious binaries.",
"version": 1,
"predicates": [
{
"value": "portable-executable",
"expanded": "Portable Executable (PE)"
},
{
"value": "dex",
"expanded": "Dalvik Executable (DEX)"
},
{
"value": "elf",
"expanded": "Executable Linkable Format (ELF)"
},
{
"value": "mach-o",
"expanded": "Mach-object (Mach-O)"
},
{
"value": "cli-assembly",
"expanded": "CLI assembly"
}
],
"values": [
{
"predicate": "portable-executable",
"entry": [
{
"value": ".netshrink",
"expanded": ".netshrink"
},
{
"value": "alienyze",
"expanded": "Alienyze"
},
{
"value": "apack",
"expanded": "aPack"
},
{
"value": "apk-protect",
"expanded": "APK Protect"
},
{
"value": "armadillo",
"expanded": "Armadillo"
},
{
"value": "aspack",
"expanded": "ASPack"
},
{
"value": "aspr-asprotect",
"expanded": "ASPR (ASProtect)"
},
{
"value": "autoit",
"expanded": "AutoIT"
},
{
"value": "bero",
"expanded": "BeRo EXE Packer"
},
{
"value": "boxedapp-packer",
"expanded": "BoxedApp Packer"
},
{
"value": "cexe",
"expanded": "CExe"
},
{
"value": "code-virtualizer",
"expanded": "Code Virtualizer"
},
{
"value": "dexguard",
"expanded": "DexGuard"
},
{
"value": "dexprotector",
"expanded": "DexProtector"
},
{
"value": "dotbundle",
"expanded": "dotBundle"
},
{
"value": "enigma-protector",
"expanded": "Enigma Protector"
},
{
"value": "exe-bundle",
"expanded": "EXE Bundle"
},
{
"value": "exe-stealth",
"expanded": "EXE Stealth"
},
{
"value": "expressor",
"expanded": "eXPressor"
},
{
"value": "fsg",
"expanded": "FSG"
},
{
"value": "gzexe",
"expanded": "GzExe"
},
{
"value": "kkrunchy",
"expanded": "Kkrunchy"
},
{
"value": "liapp",
"expanded": "LIAPP"
},
{
"value": "mew",
"expanded": "MEW"
},
{
"value": "mpress",
"expanded": "MPRESS"
},
{
"value": "nspack",
"expanded": "NSPack"
},
{
"value": "obsidium",
"expanded": "Obsidium"
},
{
"value": "pecompact",
"expanded": "PECompact"
},
{
"value": "pelock",
"expanded": "PELock"
},
{
"value": "peshield",
"expanded": "PEShield"
},
{
"value": "pespin",
"expanded": "PESpin"
},
{
"value": "petite",
"expanded": "PEtite"
},
{
"value": "rlpack-basic",
"expanded": "RLPack Basic"
},
{
"value": "smart-packer-pro",
"expanded": "Smart Packer Pro"
},
{
"value": "themida",
"expanded": "Themida"
},
{
"value": "upack",
"expanded": "UPack"
},
{
"value": "upx",
"expanded": "UPX"
},
{
"value": "vmprotect",
"expanded": "VMProtect"
},
{
"value": "xcomp-xpack",
"expanded": "XComp/XPack"
},
{
"value": "yoda-crypter",
"expanded": "Yoda's Crypter"
},
{
"value": "yoda-protector",
"expanded": "Yoda's Protector"
},
{
"value": "zprotect",
"expanded": "ZProtect"
}
]
}
]
}