PECompactv140v145

Hunt Hypothesis

This rule identifies executable files packed with PECompact, a compression tool frequently used by adversaries to reduce binary size and evade static analysis during initial access or lateral movement. Proactively hunting for these artifacts in Azure Sentinel allows the SOC team to detect potentially obfuscated payloads that may have been executed on endpoints or uploaded to storage, ensuring that stealthy compression techniques do not mask malicious activity.

YARA Rule

rule PECompactv140v145
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB C3 11 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy .NET Framework Installer Execution: The vcruntime140.dll or msvcp140.dll files (part of the Visual C++ Redistributable) are often embedded within installers for legacy enterprise applications (e.g., older versions of Adobe Creative Suite, Oracle Client, or SAP GUI). When these installers run via scheduled tasks or GPO software deployment, the YARA rule may match the embedded PE structure or specific byte patterns associated with the v140/v145 runtime.
  • Filter/Exclusion: Exclude processes where the parent process is msiexec.exe or setup.exe and the file path contains \Redist\ or \VCRedist\. Additionally, exclude files with the specific hash of the known vcruntime140.dll version used in your standard image.
• Visual Studio Build Tools and MSBuild Tasks: Developers and CI/CD agents frequently use Visual Studio Build Tools, which include the v140/v145 toolsets. During compilation or linking, the link.exe or msbuild.exe processes load these DLLs. If the YARA rule scans memory or loaded modules rather than just disk files, this can trigger false positives during active development or automated build pipelines.
  • Filter/Exclusion: Exclude processes originating from C:\Program Files (x86)\Microsoft Visual Studio\ or C:\Program Files\Microsoft Visual Studio\. Also, exclude any process where the command line contains msbuild, link, or cl.exe and the working directory is within a source code repository or build artifact folder.
• Windows Update and Component Cleanup: The Windows Update service (wuauclt.exe or svchost.exe with the WU service) occasionally installs or updates the Visual C++ Redistributable packages