This rule detects the presence of the CrunchPE tool, a lightweight PE file editor often used by adversaries to modify executable headers, remove signatures, or alter entry points to facilitate stealthy execution or persistence. Proactively hunting for this tool in Azure Sentinel helps identify potential post-exploitation activities where attackers are manipulating binaries to evade static analysis or prepare for further lateral movement within the environment.
rule CrunchPE: Packer PEiD
{
meta:
author="malware-lu"
note="Added extra checks"
strings:
$a0 = { 55 E8 [4] 5D 83 ED 06 8B C5 55 60 89 AD [4] 2B 85 }
$b = { EB 10 [16] 55 E8 [4] 5D 81 ED 18 [3] 8B C5 55 60 9C 2B 85 E9 06 [2] 89 85 E1 06 [2] FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 03 00 00 89 85 D9 41 00 00 68 EC 49 7B 79 33 C0 50 E8 11 03 00 00 89 85 D1 41 00 00 E8 67 05 00 00 E9 56 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 5B 8B C2 C1 C0 10 66 8B C1 5A 59 C3 68 03 02 00 00 E8 80 04 00 00 0F 82 A8 02 00 00 96 8B 44 24 04 0F C8 8B D0 25 0F 0F 0F 0F 33 D0 C1 C0 08 0B C2 8B D0 25 33 33 33 33 33 D0 C1 C0 04 0B C2 8B D0 25 55 55 55 55 33 D0 C1 C0 02 0B C2 }
condition:
for any of ($*) : ( $ at pe.entry_point )
}This YARA rule can be deployed in the following contexts:
This rule contains 2 string patterns in its detection logic.
Legitimate PE Repair/Recovery Tools: Administrators or support staff may use tools like PEFix, FixPE, or specific vendor utilities (e.g., dotnet repair tools, VS_Repair) to fix corrupted executable headers or restore missing sections in development binaries.
devenv.exe, code.exe, idea64.exe) or specific repair utilities (e.g., PEFix.exe, fixpe.exe) and the target file is located in a development directory (e.g., C:\dev\, C:\projects\).Software Bundlers and Installers: Many enterprise software installers (e.g., 7-Zip SFX archives, Inno Setup executables, or NSIS installers) embed or unpack PE files during installation. Some lightweight installers or portable app launchers may manipulate PE structures in memory or temporary directories to strip version info or adjust subsystems for portability.
msiexec.exe, 7z.exe, inno_setup.exe, setup.exe) and the working directory is a temporary path (e.g., C:\Temp\, C:\Users\<user>\AppData\Local\Temp\).Antivirus/EDR Self-Healing or Quarantine Operations: Security tools like CrowdStrike Falcon, Microsoft Defender, or Trellix may temporarily modify PE headers (e.g., adding/removing sections, adjusting checksums) when scanning, quarantining, or restoring files from quarantine. This can trigger YARA rules that look for specific PE anomalies or embedded sections.