packed or repacked malware is malware that has been modified using a runtime compression (or encryption) program...

runtime compression programs compress an executable file and prepend or *append a stub to the file containing the code to decompress it at runtime...

malware authors (or even just people deploying malware) use this functionality as a cheap and easy way to turn a known piece of malware into something 'new' that no one has ever seen before and that known-malware scanners can't detect... this is one of the many possible ways to implement the transformation function of server-side polymorphism...

although the malware is transformed in a manner similar to how conventional polymorphic viruses transformed themselves, the generic solution that worked so well for polymorphism doesn't necessarily work as well for packed malware because the size of todays malware combined with the potential to chain multiple packing transformations together make the amount of work necessary to emulate the full unpacking operation much more expensive and time consuming in comparison... that said, dynamic translation promises speed improvements over conventional emulation so that generic unpacking may still be workable...
http://anti-virus-rants.blogspot.be/2008/06/what-is-packed-m...

--------------------------------------------------
Note added at 3 hrs (2016-12-13 21:29:56 GMT)
--------------------------------------------------

Packed malicious programs (malware) pose a sig-
nificant problem in malware analysis, detection, and
forensics. Such programs consist of a decompression
or decryption routine that extracts the garbled payload
from memory and then executes it. We use the term
packed and its variations to refer to malware whose pay-
load is either compressed or encrypted. This unpacking
routine can be invoked once, in which case the whole
payload is extracted to memory in a single step, or mul-
tiple times, when parts of the payload are extracted to
memory at different times. For a security analyst, this
means that the program has to be executed in a con-
tained yet accurate environment before an analysis of
the payload can be performed. For a malware detector,
this means that the scanning for malicious code has to
be postponed until after the start of execution, i.e., when
the program has unpacked its payload.
OmniUnpack: Fast, Generic, and Safe Unpacking of Malware
https://wiki.smu.edu.sg/flyer/images/2/26/OmniUnpack.pdf