PEPaCKv10CCopyright1998byANAKiN

Hunt Hypothesis

This hunt detects the presence of legacy or potentially malicious executables utilizing the specific ANA KiN PEPaCK v10 compression signature, which may indicate the use of outdated packing tools often leveraged by adversaries to obfuscate malware functionality. A proactive search is recommended within Azure Sentinel to identify these artifacts across endpoints and cloud workloads, ensuring that legacy dependencies do not introduce hidden risks or serve as a foothold for advanced persistent threats.

YARA Rule

rule PEPaCKv10CCopyright1998byANAKiN
{
      meta:
		author="malware-lu"
strings:
		$a0 = { C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 0D 0A 20 2D 3D FE 20 50 45 2D 50 41 43 4B 20 76 31 2E 30 20 2D FE 2D 20 28 43 29 20 43 6F 70 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the PEPaCKv10CCopyright1998byANAKiN detection rule, including suggested filters and exclusions:

• Legacy Antivirus or Backup Agent Updates

  • Scenario: Enterprise endpoint protection suites (e.g., Symantec Endpoint Protection, McAfee Total Protection) often utilize legacy compression libraries for their update modules. When the background service (SymCorp.exe or mfeengine.exe) performs a scheduled nightly update or database backup, it may extract or generate temporary files containing the ANAKIN PEPaCK signature, triggering the rule even though no malicious activity is occurring.
  • Filter/Exclusion: Exclude processes matching SymCorp.exe, mfeengine.exe, and Vssvc.exe from detection if they are running under the context of the specific antivirus service account (e.g., NT SERVICE\Symantec).

• Scheduled PDF or Document Generation Jobs

  • Scenario: Business Intelligence tools like Microsoft Power BI Report Server or legacy ERP systems (e.g., SAP NetWeaver) often use embedded libraries to generate monthly compliance reports in PDF format. These libraries frequently rely on the PEPaCK compression standard for embedding fonts and images, causing the rule to fire during scheduled report generation windows (e.g., every Monday at 02:00 AM).
  • Filter/Exclusion: Create a time-based exclusion window (e.g., Mon-Fri, 01:00–04:00) for processes named w3wp.exe running under the application pool identity associated with the reporting server, or exclude file paths containing \Reports\Generated\.

• Software Deployment and Patching Tools

  • Scenario: System administrators using deployment tools like SCCM (Configuration Manager), Ivanti Neurons, or