An extraction stub is the executable part of a self-extracting (SFX) archive. Its job is to open the package, unpack the bundled files, and often start the intended installer or payload after extraction. Because it is real code, not just a container label, the stub can contain logic for checks, launch order, and post-unpack execution.
In cyber security, the stub matters because attackers can modify it to run malicious code before or instead of the visible files being unpacked. That can hide abuse inside an otherwise normal-looking installer, especially when the extracted contents appear legitimate. Defenders should treat SFX files as active programs: inspect the full binary, analyze the stub’s behavior, and look for in-memory execution, unusual child processes, or suspicious launch commands. A clean extracted folder does not guarantee the wrapper was safe.