PackMyPayload | A PoC that packages payloads into output containers to evade Mark-of-the-Web flag & demonstrate risk

PackMyPayload is a Python library. PackMyPayload has no bugs, it has no vulnerabilities, it has build file available, it has a Permissive License and it has low support. You can download it from GitHub.

[Jump to supported formats] This tool takes a file or directory on input and embeds them into an output file acting as an archive/container. It can serve purpose for a Proof-of-Concept presenting emerging risk of container file formats with embedded malware, as well as helper for professional Red Team Operators to sharpen their Initial Access maneuvers. Currently Threat Actors are known to smuggle their malware archived in various container file formats, to name a few: - 7zip - zip - ISO - IMG. They do that to get their payloads pass file content scanners, but more importantly to avoid having Mark-Of-The-Web flag on their files. There’re various motives on why adversaries don’t want MOTW on their files: Protected View in Microsoft Office was always among them. Should they provide container file to their victims, a foundation for disabling VBA macros in Internet-originated Office documents might be bypassed.