Shrinker32

Hunt Hypothesis

This rule detects the presence of Shrinker32, a 32-bit executable packer often used by adversaries to compress binaries and obscure their code from static analysis tools. Proactively hunting for this indicator in Azure Sentinel allows the SOC team to identify potentially packed malware or trojans that may have been deployed on endpoints, enabling early intervention before the packed payload executes or evades detection.

YARA Rule

rule Shrinker32
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 56 57 75 65 68 00 01 00 00 E8 F1 E6 FF FF 83 C4 04 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: Execution of the Shrinker32.exe binary by third-party application installers or updaters (e.g., Java, Adobe Creative Cloud, or Oracle software) that bundle the shrinker to compress temporary installation files.
  • Filter/Exclusion: Exclude processes where the parent process is a known installer executable (e.g., msiexec.exe, setup.exe, install.exe) and the file path contains standard installation directories like \Program Files\ or \AppData\Local\Temp\.
• Scenario: Automated scheduled tasks or service accounts running maintenance scripts that use Shrinker32 to compress log files or backup data before transfer to a central storage server.
  • Filter/Exclusion: Exclude executions initiated by specific service accounts (e.g., svc_backup, admin_maintenance) or when the command line arguments include standard compression flags (e.g., -c, --compress) and the target path is within designated backup or log directories (e.g., \Logs\, \Backups\).
• Scenario: Development or QA teams using Shrinker32 as part of a build pipeline or CI/CD agent to compress artifacts for deployment to staging environments.
  • Filter/Exclusion: Exclude processes running on specific build agent hosts or within known development directory structures (e.g., \src\, \build\, \artifacts\) and where the parent process is a build tool (e.g., msbuild.exe, gradle.bat, npm.exe).
• Scenario: Legacy line-of-business applications that use Shrinker32 internally to manage their own configuration files or plugin packages during startup or update cycles.
  • Filter/Exclusion: Maintain a whitelist of known legacy application executables (e.g., legacy_app.exe, crm_client.exe) and exclude