PECompact v126b1 v126b2

Hunt Hypothesis

This rule identifies executable files packed with specific PECompact variants, a technique adversaries frequently employ to compress and obfuscate malware payloads to evade static analysis and signature-based detection. Proactively hunting for these packed binaries in Azure Sentinel allows the SOC team to uncover stealthy threats that may be hiding in endpoint memory or storage, ensuring that obfuscated executables are identified before they can execute or propagate within the environment.

YARA Rule

rule PECompact_v126b1_v126b2: PEiD
{
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? 05 0E }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A development team uses UPX (Universal Packer for eXecutables) to compress release binaries for distribution, specifically targeting the v126b1 or v126b2 internal version strings which are common in older UPX builds or specific PECompact forks.
  • Filter/Exclusion: Exclude files located in specific build artifact directories (e.g., C:\Builds\Release\, D:\Artifacts\) or exclude executables with names matching *.exe where the parent folder contains dist, release, or build.
• Scenario: A legacy line-of-business application (e.g., SAP GUI, Oracle Client, or Legacy ERP modules) is installed on application servers and uses PECompact for binary size reduction. These applications are rarely updated, so the packer version remains static.
  • Filter/Exclusion: Exclude known legacy application installation paths (e.g., C:\Program Files\SAP\, C:\Program Files\Oracle\) or exclude processes whose parent process is a known service host (e.g., services.exe or svchost.exe) if the file path matches a whitelist of legacy vendors.
• Scenario: A scheduled maintenance job runs a custom utility script (e.g., cleanup.exe or archive_tool.exe) that was packed with PECompact to reduce disk footprint. This utility is executed by Task Scheduler or cron on a weekly basis.
  • Filter/Exclusion: Exclude files located in C:\Windows\System32\Tasks\ associated binaries or specific utility directories (e.g., C:\AdminTools\, C:\Scripts\) if the file modification date is older than 90 days and the file size is under 5MB.
• Scenario: