> For the complete documentation index, see [llms.txt](https://wiki.zacheller.dev/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://wiki.zacheller.dev/exploit-dev-analysis/static-analysis/packed-and-obfuscated-malware.md).

# Packed and Obfuscated Malware

### Obfuscated and Packed Malware

* Obfuscated programs are ones whose execution the malware author has attempted to hide.
* Packed programs are a subset of obfuscated programs in which the malicious program is compressed and cannot be analyzed.

### Packing Files

* The code is compressed, like in Zip file
* This makes the strings and instructions unreadable
* All you'll see is the wrapper – small code that unpacks the file when it is run

![](/files/-MF8-h9-vd_GCjbf2gEA)

![Detecting Packers with PEiD](/files/-MF8-jUR_ffdmmXjEyNm)