GHFProtectorpackonlyGPcH

Hunt Hypothesis

This rule identifies executable files packed with the GHF Protector, a technique often employed by adversaries to obscure code structure and evade static analysis during initial access or payload execution. Proactively hunting for these packed binaries in Azure Sentinel allows the SOC team to detect stealthy malware variants that may slip past signature-based detections and establish a foothold in the environment.

YARA Rule

rule GHFProtectorpackonlyGPcH
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 68 [4] B8 [4] FF 10 68 [4] 50 B8 [4] FF 10 68 00 00 00 00 6A 40 FF D0 89 05 [4] 89 C7 BE [4] 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 61 B9 FC FF FF FF 8B 1C 08 89 99 [4] E2 F5 90 90 BA [4] BE [4] 01 D6 8B 46 0C 85 C0 0F 84 87 00 00 00 01 D0 89 C3 50 B8 [4] FF 10 85 C0 75 08 53 B8 [4] FF 10 89 05 [4] C7 05 [4] 00 00 00 00 BA [4] 8B 06 85 C0 75 03 8B 46 10 01 D0 03 05 [4] 8B 18 8B 7E 10 01 D7 03 3D [4] 85 DB 74 2B F7 C3 00 00 00 80 75 04 01 D3 43 43 81 E3 FF FF FF 0F 53 FF 35 [4] B8 [4] FF 10 89 07 83 05 [4] 04 EB AE 83 C6 14 BA [4] E9 6E FF FF FF 68 [4] B8 [4] FF 10 68 [4] 50 B8 [4] FF 10 8B 15 [4] 52 FF D0 61 BA [4] FF E2 90 C3 }
	$a1 = { 60 68 [4] B8 [4] FF 10 68 [4] 50 B8 [4] FF 10 68 00 00 00 00 6A 40 FF D0 89 05 [4] 89 C7 BE [4] 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 }

condition:
		$a0 at pe.entry_point or $a1
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses 7-Zip or WinRAR to compress a large project folder containing mixed file types (e.g., .js, .css, .json) into a single archive. The resulting archive may exhibit entropy patterns or structural characteristics that match the “packer” signature if the compression algorithm or file layout coincidentally aligns with the YARA rule’s byte patterns.

  • Filter/Exclusion: Exclude files with extensions .zip, .rar, .7z, .tar, .gz, or .bz2 from scanning, or specifically exclude paths under C:\Users\*\Downloads\ or C:\Users\*\Documents\ if the rule is known to trigger on common archive formats.

• Scenario: An IT administrator runs Sysinternals’ 7z.exe or PowerShell’s Compress-Archive cmdlet to bundle log files or configuration backups for offsite storage. If the backup script creates a single large binary blob or uses a non-standard compression method, the file’s header or internal structure might mimic the “GHFProtector” packer signature.

  • Filter/Exclusion: Exclude executable files named 7z.exe, tar.exe, or compress.exe when located in standard system directories like C:\Windows\System32\ or C:\Program Files\, and exclude files created by known backup services (e.g., Veeam, Commvault) by checking the file’s creation timestamp or parent process name.

• Scenario: A security team deploys a signed installer package created with Inno Setup or NSIS for internal software distribution. These installers often embed multiple files and use custom compression or packing techniques that can result in high entropy or specific byte sequences that trigger generic packer detections like `GHFProtector