PEiDBundlev102v103BoBBobSoft

Hunt Hypothesis

This hypothesis targets the execution of known BobSoft bundler variants, which adversaries may leverage to install unwanted software or establish a foothold on endpoints. Proactively hunting for these specific PE file signatures in Azure Sentinel allows the SOC to identify low-severity, potentially unwanted applications that could serve as initial access vectors or indicators of compromised user machines.

YARA Rule

rule PEiDBundlev102v103BoBBobSoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 [3] 2E [3] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or IT admin uses 7-Zip or WinRAR to extract a large software bundle (e.g., Adobe Creative Cloud or Microsoft Office) that contains multiple executable files packed into a single container. The YARA rule may match the specific header structures or section names of the bundled executables within the archive.
  • Filter/Exclusion: Exclude processes where the parent process is 7z.exe, WinRAR.exe, or explorer.exe performing an extraction operation, or filter by file extensions like .7z, .rar, or .zip if the rule targets the container file itself.
• Scenario: An automated scheduled task (e.g., Microsoft\Windows\InstallService\ScanForUpdates) or a Group Policy Object (GPO) deployment pushes a software installer (such as VMware Tools or Citrix Receiver) that uses a self-extracting archive format. The installer temporarily creates a temporary directory with bundled PE files that match the PEiDBundle signature.
  • Filter/Exclusion: Exclude events where the file path resides in C:\Windows\Temp, C:\Users\Public\Downloads, or C:\ProgramData\ and the parent process is msiexec.exe, setup.exe, or wuaclt.exe.
• Scenario: A Java-based application (e.g., Eclipse IDE, IntelliJ, or Tomcat) uses a JAR file or WAR file that contains native libraries (.dll or .so files) packed in a way that mimics the PEiDBundle structure. The YARA rule may falsely identify the embedded PE headers within the Java archive.
  • Filter/Exclusion: Exclude file paths ending in .jar, .war, or `.