PECompactv0971v0976

Hunt Hypothesis

This rule identifies executable files compressed using the PECompact packer, a technique often employed by adversaries to reduce binary size and evade static analysis during initial access or payload delivery. Proactively hunting for these packed binaries in Azure Sentinel allows the SOC team to detect potentially obfuscated malware or trojans that may be executing on endpoints or stored in cloud storage before they trigger more complex behavioral alerts.

YARA Rule

rule PECompactv0971v0976
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 C3 9C 60 E8 5D 55 5B 81 ED 8B 85 01 85 66 C7 85 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of legacy Windows Installer service components or older versions of Microsoft Office (e.g., Office 2003/2007) during automated patching cycles or application deployments. These binaries are often packed with PECompact to reduce file size, triggering the YARA signature for versions 0.971 and 0.976.

  • Filter/Exclusion: Exclude files located in C:\Program Files\Microsoft Office\ or C:\Windows\Installer\ where the parent process is msiexec.exe or setup.exe. Additionally, exclude if the file path matches *.msi or *.cab archives being extracted by standard deployment tools like SCCM or PDQ Deploy.

• Scenario: Running older versions of Adobe Acrobat Reader or Acrobat Pro (specifically versions 9.x through 11.x) on endpoints where the application was installed via a legacy installer that used PECompact compression. This is common in environments with mixed OS versions or specific vertical market applications that bundle older PDF viewers.

  • Filter/Exclusion: Exclude if the executable name is AcroRd32.exe or Acrobat.exe and the version string indicates a major version less than 12.0.0. Alternatively, exclude if the file path resides in C:\Program Files (x86)\Adobe\Acrobat Reader DC\ or similar legacy Adobe directories, provided the digital signature is valid and issued by Adobe Systems Incorporated.

• Scenario: Execution of specific legacy Java Runtime Environment (JRE) versions (e.g., JRE 6 or 7) or older versions of Oracle WebLogic Server components that were compiled with PECompact. These are often found in backend application servers or kiosk terminals running specialized line-of-business software that has not been updated to modern, uncompressed binaries.

  ---