Shrinkerv32

Hunt Hypothesis

This hypothesis targets the presence of Shrinker v32, a 32-bit executable packer often used by adversaries to compress and obfuscate malware payloads, thereby evading static analysis and signature-based detection. Proactively hunting for this indicator in Azure Sentinel allows the SOC team to identify potentially compromised hosts or staged artifacts that may be leveraging packing techniques to hide their true functionality before execution.

YARA Rule

rule Shrinkerv32
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 3D [5] 55 8B EC 56 57 75 65 68 00 01 [2] E8 ?? E6 FF FF 83 C4 04 8B 75 08 A3 [4] 85 F6 74 1D 68 FF }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via Group Policy: Administrators often deploy older, 32-bit line-of-business applications (e.g., legacy ERP clients, specialized CAD tools) that were originally distributed using UPX or similar shrinkers to reduce file size for network transfer. These executables retain the UPX! magic bytes or specific header patterns that YARA rules targeting “Shrinker” signatures will match.

  • Filter/Exclusion: Exclude paths under C:\Program Files (x86)\[LegacyAppVendor] or specific known application directories like C:\Program Files (x86)\Adobe\Acrobat 7.0 if the rule targets older versions. Alternatively, whitelist specific file names known to be UPX-packed in your inventory.

• Third-Party Installer Staging Folders: Many enterprise software installers (e.g., Oracle, SAP, or older Java JRE packages) use shrinkers to compress temporary payload files during installation. If the YARA rule scans memory or disk during the installation window, it may flag the temporary .tmp or .cab files in %TEMP% or C:\Windows\Installer that contain packed code sections.

  • Filter/Exclusion: Exclude files located in C:\Windows\Installer\, C:\Windows\Temp\, or %LOCALAPPDATA%\Temp\ if the rule is designed to catch persistent executables rather than transient installer payloads.

• Antivirus/EDR Self-Extraction: Security products like Symantec Endpoint Protection, CrowdStrike Falcon, or Carbon Black often use packed or compressed modules for their self-extraction or update components. The YARA rule may match the packed state of these security binaries before they are unpacked in memory, leading to a false positive on the security tool itself.

  • Filter/Exclusion: Whitelist known security product paths