Exploring packers

A packer is a tool that packs together the executable file's code, data, and sometimes resources, and contains code for unpacking the program on the fly and executing it:

Figure 1: The process of unpacking a sample

Packers help malware authors hide their malicious code behind this compression layer. This code only gets unpacked and executed once the malware is executed (in runtime mode), which helps malware authors bypass static signature-based detection.