PECompactv134v140b1

Hunt Hypothesis

This rule identifies executable files compressed with PECompact versions 1.34 or 1.40, a technique often employed by threat actors to reduce binary size and evade static analysis during initial access or lateral movement. Proactively hunting for these specific compression signatures allows the SOC to uncover dormant or stealthy payloads that may have been dropped into the environment to maintain persistence or facilitate further compromise.

YARA Rule

rule PECompactv134v140b1
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 00 80 ?? 40 90 90 01 85 9E 80 ?? 40 BB F8 10 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via Group Policy: When IT administrators deploy older, unmanaged line-of-business applications (e.g., legacy accounting software or specialized industrial control system clients) that were built using PECompact v1.34 or v1.40 to reduce file size, the executable will match the YARA signature upon execution.

  • Filter/Exclusion: Exclude files located in specific application directories (e.g., C:\Program Files\LegacyApps\) or exclude based on the parent process being gpupdate.exe or mstsc.exe during initial deployment windows.

• Third-Party Utility Execution: Common enterprise utilities that are distributed as compacted executables to minimize download size or disk footprint, such as older versions of 7-Zip (pre-16.x), WinRAR (older builds), or specific vendor-provided diagnostic tools (e.g., Dell Command | Update, HP Support Assistant legacy versions), may trigger this rule if they utilize PECompact for their installer or main executable.

  • Filter/Exclusion: Whitelist specific known-good hashes or file paths for these utilities (e.g., C:\Program Files\7-Zip\7z.exe for versions < 16.00) and ensure the digital signature is valid and matches the expected vendor.

• Scheduled Maintenance Jobs: Scheduled tasks that run maintenance scripts or small utility binaries (e.g., log rotation tools, disk cleanup helpers, or backup verification scripts) that were compiled with PECompact to save space on network shares or local drives. These often run under the SYSTEM or Task Scheduler service account.

  • Filter/Exclusion: Exclude executions where the parent process is svchost.exe (specifically the Task Scheduler service) or taskschd.msi, and the file path resides in standard maintenance directories (e.g., `