PECompactv160v165

Hunt Hypothesis

This rule identifies Windows executables packed with PECompact versions 1.60 or 1.65, a technique adversaries frequently employ to compress malware and evade static analysis tools. Proactively hunting for these specific packer signatures in Azure Sentinel allows the SOC to surface potentially obfuscated binaries in endpoint logs, enabling earlier detection of stealthy threats that may bypass standard heuristic detections.

YARA Rule

rule PECompactv160v165
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 80 40 ?? 87 DD 8B 85 D2 80 40 ?? 01 85 33 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 CE 80 40 ?? BB BB 12 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of legacy or third-party installer packages (e.g., older versions of Adobe Creative Suite, Oracle Java, or specific hardware drivers) that utilize PECompact v1.60/v1.65 for binary compression to reduce download size.
  • Filter/Exclusion: Exclude processes where the parent process is a known installer executable (e.g., msiexec.exe, setup.exe, install.exe) from trusted vendor directories, or filter by file path patterns like C:\Program Files\*\Installers\* or C:\Temp\*\*.
• Scenario: Scheduled maintenance jobs or backup agents (e.g., Veeam, Commvault, or custom PowerShell scripts invoking compressed binaries) that execute PECompact-compressed helper tools during off-hours.
  • Filter/Exclusion: Correlate with scheduled task names containing keywords like “Backup,” “Maintenance,” or “Cleanup,” and exclude if the process is spawned by schtasks.exe or Task Scheduler service (svchost.exe with Schedule argument) and the file resides in a dedicated maintenance directory (e.g., C:\ProgramData\*\Maintenance\*).
• Scenario: Development or QA environments where engineers run locally compiled or downloaded test binaries, debuggers, or performance profiling tools (e.g., Intel VTune, custom C++ test harnesses) that are compressed with PECompact to optimize startup time.
  • Filter/Exclusion: Exclude hosts tagged with “Dev,” “QA,” or “Test” in your CMDB or asset management system, or filter by user groups like DevTeam, QAEngineers, and exclude paths under C:\Users\*\Projects\* or C:\Builds\*.
• Scenario: Legacy line-of-business (LOB) applications or internal tools (e.g., old