# Supported Unpacking Formats — Spectra Core

> Complete list of 400+ unpacking formats supported by Spectra Core including packers, archives, installers, and self-extracting executables for malware analysis.

# Supported unpacking format list

| Format name | Format category | Associated file extensions |
|----|----|----|
| 32lite | PE32 packer | exe |
| 7z SFX Builder | Self Extracting format | exe |
| 7z SFX Creator | Self Extracting format | exe |
| 7z SFX Maker | Self Extracting format | exe |
| 7ZIP | Archive format | 7z |
| 7ZIPSFX | Self Extracting format | exe |
| A | Archive format | a |
| AbaddonPOS | Point of sale malware | exe |
| ACE | Archive format | ace |
| ActiveMimeMSO | Archive format | mso |
| ActiveX | Embedded object (SWF) | None |
| Actual Installer | Installer format (Windows) | exe |
| Advanced Installer | Installer format (Windows) | exe |
| AdvancedBat2Exe | Self Extracting format | exe |
| AHPack | PE32 packer | exe |
| AlexProtector | PE32 packer | exe |
| AlphaZIP | Self Extracting Format | exe |
| ALZ | Archive format | alz |
| ALZSFX | Self Extracting format | exe |
| Amber | PE32 packer | exe |
| Android (.apk) | Mobile application | apk |
| AnyZip | Self Extracting format | exe |
| Amped | Remote administration tool | exe |
| AppImage | Self Extracting format | AppImage |
| APPX | Mobile application | appx |
| ApocalypseRAT | Remote administration tool | exe |
| AR | Archive format | a, lib, ar |
| ARC | Archive format | arc, ark |
| ARC_IA | Archive format | arc, ark |
| ArcThemAll! | Self Extracting format | exe |
| ArcticRAT | Remote administration tool | exe |
| ARJ | Archive format | arj |
| ARJSFX | Self Extracting format | exe |
| ARSC | Archive format | arsc |
| ArchilessCrypter | PE32 packer | exe |
| ASAR | Archive format | asar |
| ASDPack | PE32 packer | exe |
| asmProtecter | PE32 packer | exe |
| ASPack | PE32 packer | exe |
| AT4RE Protect | PE32 packer | exe |
| AutoIt | PE32 packer | exe |
| AutoHotkey | PE32 packer | exe |
| AverCryptor | PE32 packer | exe |
| AverZIP | Self Extracting format | exe |
| AZProtect | PE32 packer | exe |
| Babylon | Remote administration tool | exe |
| BandanaCrypter | PE32 packer | exe |
| BamBam | PE32 packer | exe |
| BandiZIP | Self Extracting format | exe |
| Beaver | PE32 packer | exe |
| BernhardPOS | PE32 Point of Sale malware | exe |
| BeroExePacker | PE32 packer | exe |
| Bifrost | Remote administration tool | exe |
| BioDox | Remote administration tool | exe |
| BJFNT | PE32 packer | exe |
| BLZ | Archive format | blz |
| BlackNix | Remote administration tool | exe |
| BMP | Image format | bmp |
| BOX (SFX) | Self Extracting format | exe |
| Bozok | Remote administration tool | exe |
| bplist | Document format | bplist |
| BraZIP | Self Extracting format | exe |
| Break Into Pattern | PE32 packer | exe |
| BTRFS | File system format | None |
| BUP | Quarantine format | bup |
| BZIP2 | Archive format | bz2, bzip2 |
| CAB | Archive format | cab |
| CABSFX | Self Extracting format | exe |
| Cargo | Archive format | crate |
| CEXE | PE32 packer | exe |
| Cerber | PE32 ransomware | exe |
| Cerberus | Remote administration tool | exe |
| Certutil | Document format | crt, cert, pem |
| CFBF | File system / Document format | cfb |
| CGBI | Archive format | png |
| CHM | Document format | chm |
| Chainer | PE32 packer | exe |
| CigiCigi | PE32 packer | exe |
| Coffee Free Zip | Self Extracting format | exe |
| Conda | Archive format | conda, tar.bz2 |
| CPIO | Archive format | cpio |
| cpBound | PE32 packer | exe |
| cpBirtual | PE32 packer | exe |
| cpCandy | PE32 packer | exe |
| cpDalek | PE32 packer | exe |
| cpDemonio | PE32 packer | exe |
| cpDibs | PE32 packer | exe |
| cpEllie | PE32 packer | exe |
| cpFlush | PE32 packer | exe |
| cpGlyph | PE32 packer | exe |
| cpInfluenza | PE32 packer | exe |
| cpMiniDuke | PE32 packer | exe |
| cpMovey | PE32 packer | exe |
| cpRebar | PE32 packer | exe |
| CProtector | PE32 packer | exe |
| cpSlesh | PE32 packer | exe |
| cpPoison | PE32 packer | exe |
| cpTibbar | PE32 packer | exe |
| cpTick | PE32 packer | exe |
| cpTinyGiant | PE32 packer | exe |
| cpPittyTiger | PE32 packer | exe |
| cpVicSpy | PE32 packer | exe |
| cramfs | File system / Firmware format | cramfs |
| CruzCrypter | PE32 packer | exe |
| CrypToCrackPEProtector | PE32 packer | exe |
| Cryptonite | PE32 packer | exe |
| CrypTOX | PE32 packer | exe |
| CryptX | PE32 packer | exe |
| CRTF | Archive format | rtf |
| CxMacro | Macro format | None |
| CyberGate | Remote administration tool | exe |
| DaemonCrypt | PE32 packer | exe |
| DalKrypt | PE32 packer | exe |
| DarkComet | Remote administration tool | exe |
| DarkRAT | Remote administration tool | exe |
| DEB | Archive format | deb, udeb |
| DeeperRAT | Remote administration tool | exe |
| DEF | PE32 packer | exe |
| depack | PE32 packer | exe |
| dxPack | PE32 packer | exe |
| DEX | Executable format | dex |
| DexCrypt | PE32 packer | exe |
| DICOM | Archive format | dicom, dcm, dic |
| dlInfluenza | PE32 downloader | exe |
| dlThunder | PE32 downloader | exe |
| dlUpatreA | PE32 downloader | exe |
| dlUpatreB | PE32 downloader | exe |
| dlUpatreC | PE32 downloader | exe |
| dlUpatreD | PE32 downloader | exe |
| DMG | Disk image format | dmg |
| DNARemoteAdmin | Remote administration tool | exe |
| Docker | Container | tar, tar.gz, tgz |
| doSWF | Multimedia format | swf |
| DreamShield | Installer format (Windows) | exe |
| DRPM | Archive format | drpm |
| DSAPrivateKey | Document format | der, key, pem |
| EFI | Disk partition format | none |
| EGG | Archive format | egg |
| ELF | Executable format | elf, o, so |
| EPPack | PE32 packer | exe |
| Executable Zip Creator | Self Extracting format | exe |
| ExeCrypter | PE32 packer | exe |
| exeFog | PE32 packer | exe |
| ExeSax | PE32 packer | exe |
| ExeStealth | PE32 packer | exe |
| ExeZip | Self Extracting format | exe |
| EXIF | Image metadata format | None |
| Explz | Self Extracting format | exe |
| Ext | File system format | None |
| ExtraBasicMacro | Macro format | None |
| Escargot | PE32 packer | exe |
| ExpressZip | Self Extracting format | exe |
| EZip | PE32 packer | exe |
| EZSfx | Self Extracting format | exe |
| GPT | Disk partition format | none |
| FAT | File system format | None |
| FileArchiver | Self Extracting format | exe |
| FilePackager | Self Extracting format | exe |
| FilZip | Self Extracting format | exe |
| FluxRAT | Remote administration tool | exe |
| FrameworkPOS | Point of sale malware | exe |
| FreeExtractor | Self Extracting format | exe |
| FSG | PE32 packer | exe |
| FSZipExtractor | Self Extracting format | exe |
| GEM | Archive format | gem |
| GGUF | Document format | gguf |
| GhostRAT | Remote administration tool | exe |
| GIF | Image format | gif |
| GIXProtector | PE32 packer | exe |
| Goat PE Mutilator | PE32 packer | exe |
| Google Chrome (.crx) | Web application | crx |
| GraphicBootingRAT | Remote administration tool | exe |
| GZIP | Archive format | gz |
| HDF5 | Document format | h5, hdf5, he5 |
| HFSP | File system format | None |
| HFSX | File system format | None |
| HidePE | PE32 packer | exe |
| hmimysPacker | PE32 packer | exe |
| HoundStealer | Keylogger | exe |
| HQX | Email format | hqx |
| HTA | Document format | hta |
| HTAEdit | Self Extracting format | exe |
| HTML | Document format | html, htm, xhtml, xht |
| HTTP | Network format | None |
| ICEOWS | Self Extracting format | exe |
| ID Executable Password | PE32 packer | exe |
| ImSecureRAT | Remote administration tool | exe |
| IndetectablesRAT | Remote administration tool | exe |
| InnoSetup | Installer format (Windows) | exe |
| Install Anywhere | Installer format (Windows) | exe |
| InstallBuilder | Installer format (Windows) | exe |
| InstallShield | Installer format (Windows) | exe |
| InternetShortcut | Document format | url |
| InTuneWin | Archive format | intunewin |
| iOS (.ipa) | Mobile application | ipa |
| iOS Firmware (.iosfw) | File system / Firmware format | iosfw |
| IQY | Document format | iqy |
| ISCab | Archive format | cab, hdr |
| ISO | Disk image format | iso |
| iStealer | Keylogger | exe |
| IZArc | Self Extracting format | exe |
| JAR | Archive format | jar, j |
| jffs2 | File system / Document format | jffs2 |
| jdpack | PE32 Packer | exe |
| Kaniko | Archive format | tar |
| KasperskyKLQ | Quarantine format | klq |
| KatrinaPOS | Point of sale malware | exe |
| JPEG | Image format | jpeg, jpg, jpe, jif |
| kbysPacker | PE32 packer | exe |
| KGB Archiver | Self Extracting format | exe |
| KiCryptor | PE32 packer | exe |
| KSASeed | PE32 packer | exe |
| LameCrypt | PE32 packer | exe |
| LCCrypto | PE32 packer | exe |
| LHA | Archive format | lha, lzh |
| LIB | Archive format | lib |
| LibreOffice | Document format | odt |
| LNK | Document format | lnk |
| LostDoor | Remote administration tool | exe |
| LulzCrypt | PE32 packer | exe |
| LusyPOS | Point of sale malware | exe |
| LVM | Disk partition format | none |
| LZ4 | Archive format | lz4 |
| LZH | Archive format | lzh |
| LZIP | Archive format | lz |
| LZMA | Archive format | lzma |
| LZOP | Archive format | lzo |
| LXD | Container | tar, tar.gz, tar.xz, tgz |
| Mach-O | Executable format | o, dylib, bundle |
| MakeZexe | Self Extracting format | exe |
| MakeZIP | Self Extracting format | exe |
| MAR | Archive format | mar |
| MarCrypt | PE32 packer | exe |
| MaskPE | PE32 packer | exe |
| MBR | Disk partition format | none |
| Metro application (.appx) | Archive format | appx |
| MEW | PE32 packer | exe |
| MEW5 | PE32 packer | exe |
| Microsoft NT Backup | Archive format | None |
| Microsoft Quarantine | Archive format | None |
| Microsoft Office | Document format | doc, docm, docx, dot, dotm, dotx, xla, xlam, xls, xlsb, xlsm, xlsx, xlt, xltm, xltx, xlw, pot, potm, potx, ppam, pps, ppsm, ppsx, ppt, pptm, pptx, one, msg |
| Microsoft OPC | Archive format | opkg |
| Microsoft Windows Icon | Image format | ico |
| Microsoft Windows Cursor | Image format | cur |
| MIME | Email format | mime, eml |
| MinkeCrypt | PE32 packer | exe |
| mkfPacker | PE32 packer | exe |
| MosesRAT | Remote administration tool | exe |
| Mozilla FireFox (.xpi) | Web application | xpi |
| mPack | PE32 packer | exe |
| mPress | PE32/PE32+/.net packer | exe |
| MrDark | PE32 packer | exe |
| MrUndetectable | PE32 packer | exe |
| MSI | Installer format (Windows) | msi, msp |
| MSIX | Installer format (Windows) | msix |
| MuckiProtector | PE32 packer | exe |
| MuZip | Self Extracting format | exe |
| MZCrypt | PE32 packer | exe |
| Nakedpack | PE32 packer | exe |
| Neolite | PE32 packer | exe |
| NewZipSE | Self Extracting format | exe |
| nPack | PE32 packer | exe |
| NSIS | Installer format (Windows) | exe |
| nSPack | PE32/PE32+/.net packer | exe |
| NTFS | File system format | None |
| NME | PE32 packer | exe |
| NPM | Archive format | tgz |
| NuGet | Archive format | nupkg |
| NumPyNPY | Document format | npy |
| NumPyNPZ | Archive format | npz |
| NWCC | PE32 packer | exe |
| OCI | Container | tar |
| OLE | Archive format | ole |
| OpenPGP Private Key | Document format | pgp |
| OpenSSH SSH Private Key | Document format | pem |
| OpenOffice | Document format | sxw, stw, sxc, sxd, std, sxi, sti, sxm, sxg |
| Opera (.oex) | Web application | oex |
| OVA | Disk image format | ovf, ova |
| PackMan | PE32 packer | exe |
| PackMaster | PE32 packer | exe |
| PAK | Archive format | pak |
| PandoraRAT | Remote administration tool | exe |
| PCAP (http, smtp) | Archive format | pcap |
| PDF | Document format | pdf |
| PE | Executable format | exe, dll, cpl, efi, ocx, scr, sys |
| PE .Net | Executable format | exe, dll |
| PE .Net Resources | Archive format | resources |
| PeaZip | Self Extracting format | exe |
| PEBundle | PE32 packer | exe |
| PECompact | PE32 packer | exe |
| peCloak | PE32 packer | exe |
| PEDiminisher | PE32 packer | exe |
| PEMangle | PE32 packer | exe |
| PENinja | PE32 packer | exe |
| PEPack | PE32 packer | exe |
| PEPasswordProtector | PE32 packer | exe |
| Perplex PE Protector | PE32 packer | exe |
| PEShield | PE32 packer | exe |
| PEX | PE32 packer | exe |
| PEZip | PE32 packer | exe |
| PoisonIvy | Remote administration tool | exe |
| Pickle | Document format | pkl |
| PicoZIP | Self Extracting format | exe |
| PingvinCrypt | PE32 packer | exe |
| PKCS#8 | Document format | p8 |
| PKCS#12 | Document format | p12, pfx |
| pklav | PE32 packer | exe |
| PNG | Image format | png |
| PokeCrypt | PE32 packer | exe |
| PowerArchiver | Self Extracting format | exe |
| PrivatePersonalPacker | PE32 packer | exe |
| Punisher | Remote administration tool | exe |
| PuppetMasterRAT | Remote administration tool | exe |
| Py2ExeInstaller | Installer format | exe |
| PyInstaller | Installer format | exe |
| PYZ | Archive format | pyz |
| QCOW | Disk image format | qcow, qcow2 |
| QuickPack | PE32 packer | exe |
| QuickZip | Self Extracting format | exe |
| RAR | Archive format | rar |
| RARSFX | Self Extracting format | exe |
| RCryptor | PE32 packer | exe |
| Remcos | Remote administration tool | exe |
| RLPack | PE32 packer | exe |
| RPM | Archive format | rpm, spec |
| RPX | PE32 packer (.net) | exe |
| RSAPrivateKey | Document format | der, key, pem |
| RTF | Document format | rtf |
| Russian Cryptor | PE32 packer | exe |
| SawCrypter | PE32 packer | exe |
| sePACK | PE32 packer | exe |
| SettingContent | Document format | xml |
| SFX Compiler | Self Extracting format | exe |
| SFX Edit | Self Extracting format | exe |
| SFX Exe Creator | Self Extracting format | exe |
| SFX Factory | Self Extracting format | exe |
| SFX Maker | Self Extracting format | exe |
| ShrinkWrap | PE32 packer | exe |
| SimplePack | PE32 packer | exe |
| SimplyZIPSE | Self Extracting format | exe |
| SixxPack | PE32 packer (.net) | exe |
| SLVC0deProtector | PE32 packer | exe |
| Smart SFX | Self Extracting format | exe |
| Smart SFX Pro | Self Extracting format | exe |
| SmokesCrypt | PE32 packer | exe |
| SMTP | Network format | None |
| SPEC | PE32 packer | exe |
| SpiderBinder | PE32 packer | exe |
| SPLayer | PE32 packer | exe |
| SpyNet | Remote administration tool | exe |
| sqlite3 | Database format | db, sqlite |
| squashfs | File system / Document format | sfs |
| Squeez | Self Extracting format | exe |
| SQX | Archive format | sqx |
| Stone PE Packer | PE32 packer | exe |
| SuperCrypt | PE32 packer | exe |
| SWF | Multimedia format | swf |
| SylaRAT | Remote administration tool | exe |
| SYLK | Document format | slk |
| SymantecQBD | Quarantine format | qbd |
| SymantecVBN | Quarantine format | vbn |
| SZDD | Archive format | regex like .??\_ (e.g. .ex\_, .dl\_) |
| TAR | Archive format | tar |
| The Best Cryptor | PE32 packer | exe |
| TIFF | Archive format | tif |
| TinyLoader | Remote administration tool | exe |
| TinyPOS | PE32 Point of Sale malware | exe |
| TUGZip | Self Extracting format | exe |
| TurboSFX | Self Extracting format | exe |
| UDF | Disk image format | udf |
| UFS2 | File system format | None |
| UltimateZip | Self Extracting format | exe |
| UndergroundCrypter | PE32 packer | exe |
| UPX | PE32 packer | exe |
| UPXLock | PE32 packer | exe |
| UPXMutanter | PE32 packer | exe |
| UUE | Email format | uue, uu |
| URLX | Document format | urlx |
| VanguardRAT | Remote administration tool | exe |
| VBA | Office macro | vba |
| VBE | Script format | vbe, jse |
| VBS2Exe | Self Extracting format | exe |
| VBSEdit | Self Extracting format | exe |
| Vcrypt | PE32 packer | exe |
| VDI | Disk image format | vdi |
| VHD | Disk image format | vhd |
| VHDX | Disk image format | vhdx |
| VPacker | PE32 packer | exe |
| VicSpy | Keylogger | exe |
| VirogenCrypt | PE32 packer | exe |
| VMDK | Disk image format | vmdk |
| VMWR | Archive format | none |
| VSIX | Archive format | vsix |
| vSkimmerPOS | Point of sale malware | exe |
| WARC | Archive format | warc |
| WhitellCrypt | PE32 packer | exe |
| WHL | Archive format | whl |
| WindOfCrypt | PE32 packer | exe |
| WIM | Disk image format | wim, swm |
| Windows Phone (.xap) | Mobile application | xap |
| WinKript | PE32 packer | exe |
| WinUPack | PE32 packer | exe |
| WinVice | Self Extracting format | exe |
| Wise | Installer format (Windows) | exe |
| WiX Toolset | Installer format (Windows) | exe |
| x509Certificate | Document format | cer, crt, der, pem |
| XAR | Archive format | xar |
| xComp | PE32 packer | exe |
| XFS | File system format | None |
| Xena | Remote administration tool | exe |
| xNeat | Self Extracting format | exe |
| xPack | PE32 packer | exe |
| XtremeRAT | RemoteAdministration tool | exe |
| xxpack | PE32 packer | exe |
| XZ | Archive format | xz |
| y0da Crypt | PE32 packer | exe |
| y0da Protect | PE32 packer | exe |
| yaffs | File system / Document format | yaffs, yaffs2 |
| YENC | Email format | ync |
| Z | Archive format | z |
| ZFS | File system format | None |
| ZIP | Archive format | zip |
| Zip2SFX | Self Extracting format | exe |
| ZipCentral | Self Extracting format | exe |
| ZipFusion | Self Extracting format | exe |
| ZipGenius | Self Extracting format | exe |
| ZipItFast | Self Extracting format | exe |
| Zippo | Self Extracting format | exe |
| ZIPSFX | Self Extracting format | exe |
| ZipThis | Self Extracting format | exe |
| ZipX | Self Extracting format | exe |
| ZOO | Archive format | zoo |
| ZSTD | Archive format | zstd |

## Additional supported formats (aliases)

|                          |              |
|--------------------------|--------------|
| ArexX                    | PokeCrypt    |
| DarkAvengard Crypter     | PokeCrypt    |
| fEaRzCrypter             | PokeCrypt    |
| MoruKcreWCrypter Private | PokeCrypt    |
| Open Source Crypter      | PokeCrypt    |
| 12311134                 | BamBam       |
| DragonArmour             | BamBam       |
| BCPack                   | VPacker      |
| TRG Crypter              | PEZip        |
| UPX \$hit                | UPXMutanter  |
| VBOWatch Protector       | YodaCrypt    |
| Jay Jay UPX Protector    | UPX          |
| JSE                      | VBE          |
| Mortal Team Crypter      | WhitellCrypt |
| GreameRAT                | CyberGate    |
| DalethRAT                | PandoraRAT   |
| SchwarzeSonne            | PandoraRAT   |
| SpyGate                  | Punisher     |
| VirusRAT                 | Punisher     |
| SplitterRAT              | Punisher     |
| PELOCKnt                 | BJFnt        |
