There are multiple tools that can pack/encrypt executable files, but each has a different purpose. It's important to understand the difference between them as their encryption techniques are customized for the purpose they serve. Let's go over them:
- Packers: These programs mainly compress executable files, thereby reducing their total size. Since their purpose is compression, they were not created for hiding malicious traits and are not malicious on their own. Therefore, they can't be indicators that the packed file is likely malicious. There are many well-known packers around, and they are used by both benign software and malware families—for example:
-
- UPX: This is an open source packer, and its command-line tool has the ability to unpack the packed file.
- ASPack: This is a commonly used packer which has a free and a premium version. The same company that provides ASPack also provides protectors such as ASProtect.
- ...
