PECompactv168v184

Hunt Hypothesis

This rule identifies executable files compressed with PECompact versions 168 or 184, a technique often employed by threat actors to reduce binary size and evade static analysis. Proactively hunting for these signatures helps the SOC team uncover potentially obfuscated malware or trojans that may have slipped through initial ingestion controls in the Azure Sentinel environment.

YARA Rule

rule PECompactv168v184
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 87 DD 8B 85 E6 90 40 01 85 33 90 40 66 C7 85 90 40 90 90 01 85 DA 90 40 01 85 DE 90 40 01 85 E2 90 40 BB 7B 11 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via Group Policy

  • Scenario: An administrator deploys a legacy line-of-business application (e.g., older versions of Adobe Acrobat Reader, Java Runtime Environment, or specific banking plugins) that was built using PECompact v1.68 or v1.84 to reduce file size. The binary is copied to the C:\Program Files\ directory on multiple endpoints via GPO, triggering the YARA signature on the executable.
  • Filter/Exclusion: Exclude files located in standard application installation directories (e.g., C:\Program Files\, C:\Program Files (x86)\) if the parent process is a known deployment tool (e.g., gpupdate.exe, mstsc.exe, or specific SCCM agents) or if the file hash matches a known good baseline for that specific application version.

• Scheduled Maintenance Jobs for Third-Party Utilities

  • Scenario: A scheduled task runs a disk cleanup or log rotation utility (e.g., cleanmgr.exe wrapper or a custom script calling a compacted binary like 7z.exe or rar.exe if compiled with PECompact) to archive old logs. The compacted binary is executed from a temp folder or a service directory, matching the PECompact v1.68/1.84 signature.
  • Filter/Exclusion: Exclude executions where the parent process is Task Scheduler (svchost.exe with TasksSched service) or schtasks.exe, and the file path contains keywords like logs, backup, archive, or temp. Additionally, whitelist specific known compacted binaries used in maintenance scripts by their SHA-256 hash.

• Development and Testing Environments

  • Scenario: Developers or QA engineers test a new internal tool or a third-party