Feature selection: A data perspective dl.acm.org

VMAttack: Deobfuscating virtualization-based packed binaries dl.acm.org

(August 2017)

Metadata recovery from obfuscated programs using machine learning dl.acm.org

(December 2016)

Symbolic execution of obfuscated code dl.acm.org

(October 2015) :star:

Information theoretic method for classification of packed and encoded files dl.acm.org

(September 2015)

Packer classifier based on PE header information dl.acm.org

(April 2015)

Malware obfuscation through evolutionary packers dl.acm.org

(July 2015)

Binary-code obfuscations in prevalent packer tools dl.acm.org

(October 2013)

SPADE: Signature based packer detection dl.acm.org

(August 2012)

Detection of packed malware dl.acm.org

(August 2012)

ESCAPE: Entropy score analysis of packed executable dl.acm.org

(October 2012)

Replacement attacks against VM-protected applications dl.acm.org

(September 2012)

On the (im)possibility of obfuscating programs (2) dl.acm.org

(April 2012)

Deobfuscation of virtualization-obfuscated software: A semantics-based approach dl.acm.org

(October 2011)

A comparative assessment of malware classification using binary texture analysis and dynamic analysis dl.acm.org

(September 2011)

Malware images: Visualization and automatic classification dl.acm.org

(July 2011)

Thwarting real-time dynamic unpacking dl.acm.org

(January 2011)

WYSINWYX: What you see is not what you execute dl.acm.org

(August 2010)

Ether: Malware analysis via hardware virtualization extensions dl.acm.org

(October 2008)

Renovo dl.acm.org

Detection tool built on top of TEMU (dynamic analysis component of BitBlaze) based on the execution of newly-generated code and monitoring memory writes after the program starts.

Renovo: A hidden code extractor for packed executables dl.acm.org

(November 2007)

How to use t-SNE effectively distill.pub

Building a malware mutation tool dial.uclouvain.be

(June 2024)

Adversarial learning on static detection techniques for executable packing dial.uclouvain.be

(June 2023) :star:

Building a smart and automated tool for packed malware detections using machine learning dial.uclouvain.be

(June 2020)

Adversarial tool for breaking static detection of executable packing dial.uclouvain.be

(August 2024) :star:

Experimental toolkit for studying executable packing - Analysis of the state-of-the-art packing detection techniques dial.uclouvain.be

(June 2022) :star:

Unsupervised clustering machine learning on packed executable dial.uclouvain.be

(June 2022) :star:

DexProtector dexprotector.com

Multi-layered RASP solution that secures your Android and iOS apps against static and dynamic analysis, illegal use and tampering.

Clustering algorithms developers.google.com

GHF Protector delphibasics.info

Executable packer / protector based on open source engines Morphine and AHPack.

ExeFog delphibasics.info

Simple Win32 PE files packer.

AHPack delphibasics.info

PE and PE+ file packer.

Defacto2 defacto2.net

ExeScan defacto2.net

Executable file analyzer which detects the most famous EXE/COM Protectors, Packers, Converters and compilers.

Defacto2 Analyzers Archive defacto2.net

Collection of 60 binary files analysers for MS-DOS and Windows32 from the 1990s and the 2000s.

ChkEXE defacto2.net

Identifies almost any EXE/COM packer, crypter or protector.

COM2EXE defacto2.net

Free tool for converting COM files to EXE format.

XPack defacto2.net

EXE/COM/SYS executable file compressor.

XORER defacto2.net

COM file XOR-based encrypter.

XorCopy defacto2.net

COM file XOR-based encrypter.

XE defacto2.net

PE32 image file packer and rebuilder.

WWPack defacto2.net

Squeezes EXE files, compresses relocation tables, optimizes headers, protects EXE files from hacking.

UPX-Scrambler defacto2.net

Scrambler for files packed with UPX (up to 1.06) so that they cannot be unpacked with the '-d' option.

TRAP defacto2.net

EXE and COM files encrypter and protector.

Scorpion defacto2.net

EXE and COM file encrypter and protector.

RUCC defacto2.net

ROSE Ultra COM Compressor ; COM and EXE compression utility based on 624.

RSCC defacto2.net

ROSE Super COM Crypt ; polymorph cryptor for files greater than 300-400B and smaller than 60kB.

PKlite defacto2.net

Easy-to-use file compression program for compressing DOS and Windows executable files.

Mess defacto2.net

This tool does the same as HackStop, with the exception that it is freeware for non-commercial use.