PECompactv125

Hunt Hypothesis

This rule detects the presence of PECompact v1.25, a legacy executable compressor often used by adversaries to obfuscate malicious payloads and evade static analysis. Proactively hunting for this specific version allows the SOC to identify dormant or low-fidelity threats that may have slipped past modern detection layers due to their outdated compression algorithm.

YARA Rule

rule PECompactv125
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? F3 0D }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via Group Policy

  • Scenario: An administrator deploys a legacy line-of-business application (e.g., older versions of SAP GUI, Oracle Client, or Adobe Reader 9) that was compiled using the PECompact 1.25 packer to reduce file size. The binary remains compressed on disk and is executed by multiple users during daily operations.
  • Filter/Exclusion: Exclude files located in specific application directories (e.g., C:\Program Files\SAP\FrontEnd\, C:\Program Files\Oracle\) or whitelist the specific executable name (e.g., sapgui.exe, oci.dll) if the version is known to be legitimate.

• Scheduled Backup or Maintenance Job

  • Scenario: A scheduled task runs a custom maintenance script or utility (e.g., db_backup.exe or log_rotator.exe) that was packed with PECompact to optimize storage on older servers. The job executes every night at 02:00 AM, triggering the YARA rule on the server hosting the database.
  • Filter/Exclusion: Exclude processes initiated by the Task Scheduler service (svchost.exe with specific arguments) or whitelist the specific executable path (e.g., C:\Scripts\Maintenance\db_backup.exe) if the file hash matches a known good baseline.

• Third-Party Monitoring Agent

  • Scenario: A security or performance monitoring agent (e.g., Dynatrace, AppDynamics, or New Relic) installs a small native helper binary that is PECompact-packed to minimize footprint. This binary runs persistently on all monitored endpoints and is signed by the vendor.
  • Filter/Exclusion: Whitelist executables with a valid digital signature from the specific vendor (e.g., `Dyn