PEiDBundlev100v101BoBBobSoft

Hunt Hypothesis

This rule identifies the presence of PEiD version 10.0 or 10.1, a popular PE file editor often used by adversaries to modify executable headers or strip metadata to evade static analysis. Proactively hunting for these specific tool versions helps the SOC team detect potential pre-execution preparation or post-compromise tooling that may indicate an adversary is actively manipulating binaries to obscure their footprint.

YARA Rule

rule PEiDBundlev100v101BoBBobSoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 ?? 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Legitimate software installation using a self-extracting archive (SFX) created with 7-Zip or WinRAR, where the embedded PE header matches the specific version strings or byte patterns targeted by the rule.
  • Filter/Exclusion: Exclude files located in standard installer directories (e.g., C:\Program Files\Installers\, C:\Temp\) or match against known benign hashes of common installer tools like 7zS.sfx or rar.sfx.
• Scenario: Development or QA teams running automated build scripts that package Java JARs or .NET assemblies into a single executable using tools like launch4j or jpackage, which may embed specific version markers or bundle structures that trigger the YARA pattern.
  • Filter/Exclusion: Exclude processes or files originating from known build agents or CI/CD service accounts (e.g., jenkins, azure-pipelines, github-actions) and filter by parent process names like java.exe, dotnet.exe, or msbuild.exe.
• Scenario: Enterprise endpoint management agents (such as SCCM, Intune, or Jamf) pushing updates or deploying new software versions, where the update payload is a bundled PE executable that temporarily resides in the system temp folder before extraction.
  • Filter/Exclusion: Exclude files with paths containing C:\Windows\Installer\, C:\ProgramData\Microsoft\..., or C:\Users\[User]\AppData\Local\Temp\ if the parent process is a known endpoint management service (e.g., ccmexec.exe, msiexec.exe, jamfdaemon).
• Scenario: Legacy line-of-business applications or internal tools that use a custom bundler to combine multiple DLLs and executables into a single installer, often retaining specific version strings or