PECompactv110b4

Hunt Hypothesis

This rule detects the presence of PECompact-compressed executables, a technique often used by adversaries to reduce file size and evade basic static analysis during initial access or payload delivery. Proactively hunting for these artifacts in Azure Sentinel allows the SOC team to identify potentially obfuscated binaries on endpoints before they execute, reducing the risk of undetected malware deployment in the environment.

YARA Rule

rule PECompactv110b4
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 44 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of legacy or third-party application installers that use PECompact for binary compression to reduce download size.

  • Example: Installing older versions of Adobe Acrobat Reader, Java JRE, or specific hardware drivers (e.g., Realtek Audio, Intel Chipset) where the installer executable is packed.
  • Filter/Exclusion: Exclude files located in standard installer directories (e.g., C:\Program Files\Installers\, C:\Temp\, C:\Users\<User>\Downloads\) or specific known-good hash values for common installer binaries.

• Scenario: Running development tools or build systems that utilize PECompact to optimize output binaries for release or testing.

  • Example: Developers executing dotnet publish or msbuild tasks that invoke custom post-build scripts using PECompact, or running unit test suites where test executables are compressed to speed up loading.
  • Filter/Exclusion: Exclude processes spawned by development IDEs (e.g., devenv.exe, code.exe, idea64.exe) or build tools (msbuild.exe, dotnet.exe, npm.exe) when the parent process is in the development toolchain.

• Scenario: Execution of portable or green software applications that are intentionally packed to remain self-contained and small in size.

  • Example: Running portable versions of utilities like 7-Zip, WinRAR, or lightweight media players (e.g., MPC-HC) stored in a shared network drive or user profile folder, where the executable is PECompact-packed.
  • Filter/Exclusion: Exclude executables with specific known extensions (.exe) in designated “portable apps” directories (e.g., C:\PortableApps\, D:\Tools\) or whitelist specific file paths for commonly used portable utilities.