Code Obfuscation vs Packing

Malware authors use these techniques to evade static analysis and signature-based antivirus detection.

Code Obfuscation

Obfuscation transforms the source code or binary into a format that is functionally identical but extremely difficult for humans (or static analysis tools) to understand.

Techniques include:

• String encryption (e.g., XORing API names so they don't appear in strings output).
• Dead code insertion (adding junk instructions).
• Control flow flattening (turning logical if/else blocks into complex state machines).

Packing

A packer is a program that compresses or encrypts the entire original executable. It appends a small "stub" (unpacking routine) to the file.

When the packed file is executed, the OS runs the stub. The stub decrypts the original executable into memory, resolves imports, and then transfers execution to the original entry point.

Because the original code is encrypted on disk, static analysis is impossible without unpacking it first.

Detection

Packing is often detected by calculating the file's Entropy. High entropy indicates compression or encryption. Obfuscation is harder to detect statically and often requires dynamic analysis (sandboxing).