ThinstallEmbedded2545Jitit

Hunt Hypothesis

This rule identifies the presence of Thinstall-compressed executables, a technique often used by adversaries to obfuscate malicious payloads and evade static analysis. Proactively hunting for these embedded instances in Azure Sentinel helps detect potentially suspicious or legacy applications that may be hiding unauthorized code within the environment.

YARA Rule

rule ThinstallEmbedded2545Jitit
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 F2 FF FF FF 50 68 [4] 68 40 1B 00 00 E8 42 FF FF FF E9 9D FF FF FF 00 00 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• ThinnInstaller Application Packaging (Delphi/C++ Builder)

  • Scenario: Developers or IT staff use ThinnInstaller (a popular commercial packer for Delphi, C++ Builder, and Borland Kylix applications) to create smaller, faster-loading executables for internal tools or client deployments. The YARA rule likely matches the specific JIT (Just-In-Time) code embedding signature used by ThinnInstaller version 2.5.45.
  • Filter/Exclusion: Exclude processes where the parent process is thinninstaller.exe or thinn.exe, or exclude files located in development directories (e.g., C:\Projects\, C:\Delphi\) that have a digital signature from “Thinn Software” or “Borland” and a file version matching 2.5.45*.

• Legacy Internal Tooling with Embedded JIT

  • Scenario: A long-standing internal business application (e.g., a custom inventory management system or POS terminal app) was built using an older version of ThinnInstaller or a similar packer that shares the same JIT embedding structure. This application is launched via a scheduled task or service on endpoints, triggering the detection on every boot or scheduled run.
  • Filter/Exclusion: Create an allowlist for the specific executable path (e.g., C:\Program Files\InternalTools\InventoryApp\app.exe) if the file hash or digital signature is verified as trusted. Alternatively, exclude if the process is started by a known service name (e.g., InventoryService) or scheduled task ID.

• Third-Party Vendor Applications

  • Scenario: A vendor-supplied application (e.g., a specific driver installer, a hardware utility, or a niche reporting tool) uses ThinnInstaller or a compatible packer for distribution. When IT deploys this