Attacks and malware
What is Packer?
A tool that compresses or encrypts an executable and unpacks it at runtime, often used to hide malware from scanners and analysts.
A packer compresses or encrypts an executable and adds a small stub that restores the original code in memory when the program runs. Legitimate software sometimes uses packers to reduce size or protect intellectual property.
Malware authors use them so that static scanners see only the stub and encrypted data. Signs of packing include high entropy, few readable strings and unusual section names. Analysts unpack samples by running them in a controlled environment or with dedicated tools.