PseudoSigner01DxPack10Anorganix

Hunt Hypothesis

This rule identifies executable files packed with the Anorganix packer, a technique often employed by threat actors to obscure binary characteristics and evade static analysis. Proactively hunting for these artifacts in Azure Sentinel allows the SOC to detect low-severity, potentially obfuscated payloads that may indicate early-stage reconnaissance or the deployment of custom malware before they trigger more prominent behavioral alerts.

YARA Rule

rule PseudoSigner01DxPack10Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 E9 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer uses UPX (Ultimate Packer for eXecutables) to compress a custom C# or C++ utility before deploying it to a staging environment to reduce artifact size. The compressed binary exhibits the specific byte patterns and entropy characteristics that the PseudoSigner01DxPack10Anorganix rule targets, triggering a false positive on the file system or memory scan.

  • Filter/Exclusion: Exclude files located in specific build artifact directories (e.g., C:\Builds\Artifacts\) or add an exclusion for files with the .upx extension if the organization maintains a whitelist of compressed binaries. Alternatively, exclude processes initiated by the upx.exe tool or known build agents (e.g., AzureDevOpsAgent.exe).

• Scenario: An IT administrator runs 7-Zip or WinRAR to create a self-extracting archive (SFX) containing a large set of configuration files or drivers. The SFX executable is essentially a packed executable that unpacks the archive in memory, often mimicking the structural traits of the “Anorganix” packer signature, especially if the SFX is generated with specific compression algorithms that match the YARA rule’s hex strings.

  • Filter/Exclusion: Exclude processes named 7zS.sfx, WinRAR.exe, or UnRAR.exe when they are executing from standard installation paths (e.g., C:\Program Files\7-Zip\). Ensure the exclusion applies to the parent process creating the SFX or the SFX executable itself if it resides in a trusted application directory.

• Scenario: A legacy Java application or .NET tool is wrapped using JPEX (Java Packer for Executables) or a similar Java-specific packer to create a standalone .exe