PECompactv155

Hunt Hypothesis

This rule detects the presence of PECompact v1.55, a legacy executable compression tool often used by adversaries to reduce file size and evade basic static analysis during the initial access or execution phases. Proactively hunting for this specific version allows the SOC team to identify potentially obfuscated payloads or older malware variants that may have slipped through modern detection controls in the Azure Sentinel environment.

YARA Rule

rule PECompactv155
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A2 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 9E 80 40 ?? BB 2D 12 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of legacy or third-party installers that utilize the PECompact compression algorithm to reduce binary size, such as older versions of Adobe Acrobat Reader, Java JRE installers, or specific Oracle database client tools.

  • Filter/Exclusion: Exclude files located in standard installation directories (e.g., C:\Program Files\, C:\Program Files (x86)\) or specific known vendor paths (e.g., C:\Program Files\Java\, C:\Program Files\Adobe\). Additionally, exclude processes spawned by known installer executables like msiexec.exe or setup.exe from these specific vendor folders.

• Scenario: Execution of specialized utility tools or SDKs that are distributed in compressed form to minimize download size, such as Git for Windows auxiliary binaries, Node.js native modules, or Python package dependencies (e.g., pip installed packages in site-packages that use PECompact for native extensions).

  • Filter/Exclusion: Exclude files within development and runtime directories such as C:\Program Files\nodejs\node_modules\, C:\Python*\Lib\site-packages\, or C:\Program Files\Git\. Consider excluding files with extensions like .node or .pyd if they reside in these specific library paths.

• Scenario: Execution of custom-compiled internal tools or scripts by the DevOps or Engineering teams that are optimized for size using PECompact, often found in shared network drives or local build artifacts directories (e.g., \\fileserver\builds\, C:\Users\<user>\AppData\Local\Temp\).

  • Filter/Exclusion: Exclude files located in known build artifact directories or temporary folders (C:\Users\*\AppData\Local\Temp\, `C:\Temp\