PECompactv122

Hunt Hypothesis

This rule detects the presence of PECompact v1.22, a legacy executable compressor often used by threat actors to reduce file size and evade basic static analysis. Proactively hunting for this signature helps identify potentially obfuscated or aged malware artifacts that may have been overlooked by standard behavioral detections in the Azure Sentinel environment.

YARA Rule

rule PECompactv122
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 ?? 70 40 ?? 90 90 01 85 9E 70 40 ?? BB F3 08 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or build engineer compiles a C/C++ application using the PECompact tool (version 1.22) to reduce the binary size for deployment, resulting in a legitimate executable file on the file system that matches the YARA signature.
  • Filter/Exclusion: Exclude files located in specific build directories (e.g., C:\Builds\, C:\CI\Artifacts\) or exclude files with a specific hash if the build process is deterministic. Alternatively, allowlist the parent process pecompact.exe if the detection is triggered on the tool itself rather than the output.
• Scenario: An IT administrator installs a legacy third-party utility or driver that was packed with PECompact v1.22 to optimize installation size, and the installer drops the packed binary into C:\Program Files\ or C:\Windows\System32\.
  • Filter/Exclusion: Allowlist known vendor installation directories (e.g., C:\Program Files\VendorName\) or exclude files modified within a specific time window following a known software deployment event (e.g., via SCCM or Intune).
• Scenario: A scheduled maintenance job runs a custom script that uses pecompact to compress log rotation scripts or small utility binaries before moving them to an archive folder, causing the YARA rule to trigger on the compressed artifacts.
  • Filter/Exclusion: Exclude files in designated archive or maintenance folders (e.g., C:\Maintenance\Archives\, C:\Logs\Compressed\) or filter based on the file extension if the compressed files are renamed (e.g., .pc or .zip containers, though PECompact usually retains .exe).
• Scenario: A security team performs a red team exercise or internal testing where they intentionally create a test executable packed with PECompact v