← Back to SOC feed Coverage →

PseudoSigner02BorlandC1999Anorganix

yara LOW Yara-Rules
community
This rule was pulled from an open-source repository and enriched with AI. Validate in a test environment before deploying to production.
View original rule at Yara-Rules →
Retrieved: 2026-08-21T23:00:00Z · Confidence: medium

Hunt Hypothesis

This detection identifies potentially malicious executables utilizing a specific Borland C++ 1999 code signing certificate pattern often associated with the Anorganix pseudo-signer, which may indicate an adversary leveraging legacy or compromised signing infrastructure to evade trust-based controls. A proactive hunt is essential in Azure Sentinel to uncover stealthy threats that exploit this specific signature anomaly, as adversaries increasingly use such historical or less scrutinized certificates to establish legitimacy for malicious payloads within the environment.

YARA Rule

rule PseudoSigner02BorlandC1999Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 A1 [4] A3 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

This rule contains 1 string patterns in its detection logic.

False Positive Guidance

Here are 5 specific false positive scenarios for the PseudoSigner02BorlandC1999Anorganix detection rule, along with targeted filters and exclusions:

Original source: https://github.com/Yara-Rules/rules/blob/main/packers/packer.yar