CrunchPE v30xx

Hunt Hypothesis

This rule detects the presence of CrunchPE, a popular PE file editor often used by adversaries to modify executable headers, strip debug information, or alter entry points to evade static analysis and signature-based detection. Proactively hunting for this tool in Azure Sentinel is critical because its use typically indicates an adversary is preparing or refining a payload for execution, allowing the SOC to identify suspicious binaries before they are deployed or executed on endpoints.

YARA Rule

rule CrunchPE_v30xx: PEiD
{
    strings:
        $a = { EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? FF 74 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses Cruncher (the GUI for CrunchPE) to strip debug information or compress resources in a custom .NET assembly or native C++ binary before deploying it to a staging environment. The YARA rule matches the specific version string or structural artifacts left by the v30xx series of the tool.

  • Filter/Exclusion: Exclude files located in specific development directories (e.g., C:\Dev\Projects\, D:\Builds\) or exclude processes where the parent is devenv.exe (Visual Studio) or dotnet.exe and the file extension is .dll or .exe within a known project folder.

• Scenario: An IT administrator uses CrunchPE via command line in a scheduled task to optimize the size of a large installer package (e.g., setup.exe) to reduce bandwidth usage during mass deployment via SCCM or Intune. The tool is executed from a network share or admin toolkit folder.

  • Filter/Exclusion: Exclude executions where the parent process is cmd.exe or powershell.exe and the working directory is a known admin toolkit path (e.g., C:\AdminTools\, \\fileserver\public\it\tools\), or exclude if the target file path contains keywords like \installer\, \setup\, or \deploy\.

• Scenario: A security engineer or malware analyst uses CrunchPE in a sandbox or isolated analysis environment to unpack or compress a sample for deeper static analysis. The tool is run from a dedicated analysis folder, often alongside other tools like PE-sieve or Detect It Easy.

  • Filter/Exclusion: Exclude files located in known analysis or sandbox directories (e.g., C:\Sandbox\, `D:\Analysis