{
  "family": "packedent",
  "sample_count": 43,
  "category": "packer",
  "description": "Packedent (tracked across threat intelligence feeds and antivirus telemetry as VirTool:Win32/Packedent, Packer:Win32/Packedent, and Trojan.Win32.Packedent) is a malicious binary packing, high-entropy compression, and armor utility active since 2016. Authors of crimeware tools, infostealers, and ransomware utilize Packedent to obscure native Portable Executable (PE) binaries and bypass endpoint signature matching. Packedent introduces high-entropy sections containing compressed and encrypted payload data, paired with a polymorphic decryption stub that executes at runtime. Before unpacking the embedded payload into memory, Packedent conducts deep environmental and timing checks (such as PEB BeingDebugged evaluation, GetTickCount/RDTSC delta verification, and querying virtual machine registry artifacts) to detect sandbox and hypervisor environments, terminating execution if analysis indicators are identified.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "VirTool:Win32/Packedent",
    "Packer:Win32/Packedent",
    "Trojan.Win32.Packedent",
    "Win32/Packedent",
    "VirTool.Win32.Packedent.A"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is VirTool:Win32/Packedent?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Packedent is a malicious binary packer and crypter designed to encrypt and conceal executable payloads to evade static security signatures."
      }
    },
    {
      "@type": "Question",
      "name": "How does Packedent identify virtualized analysis environments?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It performs timing checks with the RDTSC instruction, inspects PEB debugging flags, and checks for virtual hardware registry entries associated with VMware and VirtualBox."
      }
    },
    {
      "@type": "Question",
      "name": "How does Packedent unpack payloads in memory?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "The runtime stub decrypts compressed code segments in allocated virtual memory buffers, dynamically resolves necessary Win32 APIs, and pivots execution into the unpacked code."
      }
    },
    {
      "@type": "Question",
      "name": "Why do threat actors use high-entropy packers like Packedent?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "High-entropy encryption scrambles distinct binary patterns and opcodes, preventing traditional antivirus engines from matching known file signatures."
      }
    },
    {
      "@type": "Question",
      "name": "How can security tools detect Packedent binaries?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "By applying Shannon entropy analysis on PE sections, executing suspicious files in automated emulators, and monitoring for in-memory unpacking behavior."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1027.002",
    "T1497.001",
    "T1140",
    "T1036",
    "T1055.001"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2016,
  "threat_actor": null,
  "delivery_mechanism": [
    "Underground Malware Packaging Services",
    "Crypter Distribution Channels",
    "Third-Party Trojan Bundles"
  ],
  "target_platforms": [
    "Windows 11",
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Server 2019"
  ],
  "capabilities": [
    "High-Entropy Payload Compression",
    "Polymorphic Decryption Stubs",
    "Anti-Sandbox Timing Checks",
    "PEB BeingDebugged Inspection",
    "Reflective In-Memory Code Execution"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (High Entropy)",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Packedent functions strictly as a packaging and packing stub; packed payloads execute their own independent network routines upon memory unpacking"
    ],
    "evasion_techniques": [
      "High entropy section encryption (Shannon entropy > 7.5) concealing executable code",
      "RDTSC timing loops to detect hypervisor instruction single-stepping",
      "Dynamic API resolution avoiding static PE import table artifacts"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "c3d4e5f67890123456789abcdef0123456789abc",
      "d4e5f67890123456789abcdef0123456789abcd0"
    ],
    "registry_keys": [
      "HKCU\\Software\\PackedentRuntime"
    ],
    "file_paths": [
      "%Temp%\\pked_stub.exe",
      "%AppData%\\Packedent\\unpacker.dll"
    ]
  },
  "defensive_measures": [
    "Deploy endpoint security systems with behavioral memory scanning to inspect code upon runtime unpacking",
    "Implement high-entropy executable flagging at email and web gateways",
    "Utilize sandboxes that emulate hardware timing and mask hypervisor artifacts"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - VirTool:Win32/Packedent",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=VirTool:Win32/Packedent"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Packer.Win32.Packedent",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "VirTool:Win32/Packedent.A",
      "Packer:Win32/Packedent.B"
    ]
  },
  "motivation": "Static Evasion & Binary Armoring for Cybercrime Operations",
  "sample_hashes": []
}