WWPACKv305c4Unextractable

Hunt Hypothesis

This detection identifies potentially malicious or obfuscated executables that utilize the WinRAR (WWPACK) compression format with unextractable characteristics, which often indicates an adversary attempting to hide payload content from static analysis tools. A SOC team should proactively hunt for this behavior in Azure Sentinel because such anomalies frequently signal advanced evasion tactics where attackers embed hidden code within compressed archives to bypass initial security scans and delay detection until runtime execution.

YARA Rule

rule WWPACKv305c4Unextractable
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 03 05 00 1B B8 [2] 8C CA 03 D0 8C C9 81 C1 [2] 51 B9 [2] 51 06 06 B1 ?? 51 8C D3 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

Here are 4 specific false positive scenarios for the WWPACKv305c4Unextractable rule, along with suggested filters and exclusions:

• Scenario: Microsoft Defender Antivirus Update Service (UsoSvc)

  • Context: The Windows Update service frequently downloads large .cab or .msu update packages. Due to the specific compression method used by Microsoft for these cumulative updates, the YARA rule often fails to extract the internal structure, flagging them as “unextractable” even though they are legitimate system files.
  • Filter/Exclusion: Exclude processes where ProcessName = "usocoreworker.exe" and CommandLine contains /update. Alternatively, add a path exclusion for C:\Windows\SoftwareDistribution\Download\*.

• Scenario: Scheduled SQL Server Backup Jobs (SQL Agent)

  • Context: Enterprise environments often run nightly backup jobs using tools like Veeam or native T-SQL scripts that generate large .bak files. These binary backup archives utilize proprietary compression headers that the WWPACK rule cannot parse, triggering an alert every time a backup job completes.
  • Filter/Exclusion: Create a filter excluding events where ProcessName = "sqlservr.exe" or ProcessName = "vssvc.exe" and the file extension matches .bak. Ensure this applies to scheduled tasks running under the NT SERVICE\SQLAgent account.

• Scenario: Adobe Acrobat Pro Document Conversion

  • Context: In administrative workflows, users frequently use Adobe Acrobat Pro to convert large PDF portfolios or merge multiple documents into a single archive. The internal structure of these complex PDFs (containing embedded fonts and images) often exceeds the extraction depth limit of the WWPACK rule, causing false positives during file save operations.
  • Filter/Exclusion: Exclude processes where `