PEPACKv10byANAKiN1998

Hunt Hypothesis

This hypothesis targets the presence of PEPACK v10, a PE file packer frequently used by threat actors to compress executables and obscure code from static analysis tools. Proactively hunting for this specific packer signature in Azure Sentinel helps identify potentially malicious or obfuscated binaries that may have been deployed to endpoints, enabling early detection of stealthy malware before it executes or spreads.

YARA Rule

rule PEPACKv10byANAKiN1998
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 74 ?? E9 [4] 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via Group Policy:

  • Scenario: IT administrators deploy older, 32-bit line-of-business applications (e.g., legacy accounting software or specific CAD plugins) that were compiled using PEpack v10 to reduce file size. These executables are pushed to endpoints via Group Policy Software Installation or SCCM, triggering the YARA rule on the C:\Windows\Installer or application install directories.
  • Filter/Exclusion: Exclude files located in standard application installation paths (e.g., C:\Program Files\, C:\Program Files (x86)\) or specific known vendor directories (e.g., C:\Program Files\LegacyApp\). Additionally, exclude files with a valid digital signature from a trusted vendor certificate.

• Scheduled Backup or Archiving Jobs:

  • Scenario: Enterprise backup solutions (e.g., Veeam, Commvault) or custom PowerShell scripts that archive old log files or configuration backups into compressed containers. If the archiving tool uses PEpack v10 for compression or if the rule scans intermediate temporary files created during the backup process in C:\Temp or C:\Users\Public\Documents, it may flag these benign, short-lived artifacts.
  • Filter/Exclusion: Exclude files in temporary directories (C:\Temp, C:\Users\*\AppData\Local\Temp) that are less than 5MB in size and have a creation time within the last 1 hour. Alternatively, exclude files owned by service accounts associated with backup software (e.g., VeeamBackup, CommvaultService).

• Development and Testing Environments:

  • Scenario: Developers or QA engineers on build servers or dev workstations use PEpack v10 to optimize test binaries or create lightweight test executables for performance benchmarking. These files are often generated