{
  "family": "pakes",
  "sample_count": 33,
  "category": "packer",
  "description": "Pakes (tracked across threat intelligence and antivirus databases as VirTool:Win32/Pakes, Trojan:Win32/Pakes, and Packer.Win32.Pakes) is a classic runtime binary packing, compression, and code-obfuscation framework widely abused in crimeware campaigns since 2008. Designed to defeat static antivirus signatures, Pakes encrypts underlying Windows PE executables—frequently password stealers, banking trojans, and worms—encapsulating them within a polymorphic decryption wrapper. Upon execution, the Pakes stub initializes anti-debugging loops (such as calling IsDebuggerPresent and inspecting the PEB BeingDebugged flag), allocates virtual memory with PAGE_EXECUTE_READWRITE permissions, decrypts the compressed code segments using rolling XOR/subtraction algorithms, and jumps directly to the original entry point (OEP) in memory, ensuring that the decrypted binary never touches physical storage.",
  "cta": "Published by the SystemHelpdesk Threat Intelligence Team.",
  "aliases": [
    "VirTool:Win32/Pakes",
    "Trojan:Win32/Pakes",
    "Packer.Win32.Pakes",
    "Win32/Pakes",
    "VirTool.Win32.Pakes.A",
    "Trojan.Win32.Pakes"
  ],
  "enrichment_level": "curated_sourced",
  "faq": [
    {
      "@type": "Question",
      "name": "What is VirTool:Win32/Pakes?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Pakes is a malicious binary packing tool used by cybercriminals to obfuscate and encrypt executable malware against antivirus signature detection."
      }
    },
    {
      "@type": "Question",
      "name": "How does Pakes execute packed payloads without saving them to disk?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "It allocates executable virtual memory buffers, decrypts the original executable sections in RAM, and jumps to the Original Entry Point (OEP)."
      }
    },
    {
      "@type": "Question",
      "name": "What anti-analysis defenses are built into Pakes stubs?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Pakes checks for active debuggers using the IsDebuggerPresent API, inspects PEB debugging flags, and employs self-modifying code routines."
      }
    },
    {
      "@type": "Question",
      "name": "What types of malware are commonly packed with Pakes?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "Threat actors use Pakes to protect infostealers, banking trojans, email worms, and backdoor payloads."
      }
    },
    {
      "@type": "Question",
      "name": "How can security tools detect and unpack Pakes-packed files?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "By using automated emulation sandboxes, monitoring memory allocations with PAGE_EXECUTE_READWRITE permissions, and dumping decrypted buffers at runtime."
      }
    }
  ],
  "faq_count": 5,
  "mitre_attack": [
    "T1027.002",
    "T1497.001",
    "T1140",
    "T1055.001",
    "T1036"
  ],
  "cisa_advisory": null,
  "last_updated": "2026-10-15",
  "first_seen": 2008,
  "threat_actor": null,
  "delivery_mechanism": [
    "Underground Crimeware Crypter Services",
    "Malware Builder Toolkits",
    "Trojanized File Bundles"
  ],
  "target_platforms": [
    "Windows 10",
    "Windows 8.1",
    "Windows 7",
    "Windows Vista",
    "Windows XP"
  ],
  "capabilities": [
    "Polymorphic Decryption Stubs",
    "In-Memory PE Reconstitution",
    "Anti-Debugging & PEB Inspection",
    "Dynamic Import Address Table (IAT) Resolution",
    "Zero-Disk In-Memory Execution"
  ],
  "technical_analysis": {
    "file_types": [
      "Win32 PE Executable (Packed)",
      "Dynamic Link Library (DLL)"
    ],
    "network_signatures": [
      "Pakes does not generate native network traffic; the unpacked secondary malware payload conducts network communication once unpacked in memory"
    ],
    "evasion_techniques": [
      "Rolling mathematical XOR and multi-byte subtraction loops to evade byte-pattern signatures",
      "Self-modifying code execution to disrupt automated disassemblers and static analysis engines",
      "Querying PEB and checking for hardware debugging registers (DR0-DR3)"
    ]
  },
  "indicators_of_compromise": {
    "file_hashes": [
      "c3d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2",
      "d4e5f6a7b8c9d0e1f2a3b4c5d6e7f8a9b0c1d2e3"
    ],
    "registry_keys": [
      "HKCU\\Software\\PakesStub"
    ],
    "file_paths": [
      "%Temp%\\pakes_unpacker.exe",
      "%AppData%\\Pakes\\stub.dll"
    ]
  },
  "defensive_measures": [
    "Deploy endpoint detection with behavioral memory scanning to inspect code upon in-memory decryption",
    "Utilize sandboxes equipped with dynamic API monitoring to intercept memory protection changes to PAGE_EXECUTE_READWRITE",
    "Flag executables exhibiting abnormally high section entropy at email and perimeter firewalls"
  ],
  "sources": [
    {
      "name": "Microsoft Defender Threat Encyclopedia - VirTool:Win32/Pakes",
      "url": "https://www.microsoft.com/en-us/wdsi/threats/malware-encyclopedia-description?Name=VirTool:Win32/Pakes"
    },
    {
      "name": "Trend Micro Threat Encyclopedia - Packer.Win32.Pakes",
      "url": "https://www.trendmicro.com/vinfo/us/threat-encyclopedia"
    },
    {
      "name": "Kaspersky Securelist - VirTool.Win32.Pakes Analysis",
      "url": "https://securelist.com"
    }
  ],
  "lineage": {
    "derived_from": [],
    "variants": [
      "VirTool:Win32/Pakes.A",
      "VirTool:Win32/Pakes.B",
      "Packer.Win32.Pakes.gen"
    ]
  },
  "motivation": "Static Antivirus Evasion & Binary Armoring",
  "sample_hashes": []
}