ASPack v107b DLL

Hunt Hypothesis

This hypothesis targets the presence of DLL files packed with ASPack v107b, a technique frequently employed by adversaries to obfuscate malicious payloads and evade static analysis. Proactively hunting for these artifacts in Azure Sentinel allows the SOC team to identify potential malware droppers or injected components early in the kill chain, reducing the dwell time of threats that leverage common packers to hide their intent.

YARA Rule

rule ASPack_v107b_DLL: PEiD
{
    strings:
        $a = { 90 90 90 75 }
        $b = { 60 E8 00 00 00 00 5D ?? ?? ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 2 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy 32-bit Application Deployment via GPO

  • Scenario: IT administrators deploy a legacy 32-bit line-of-business application (e.g., an old inventory management tool or a specific hardware driver) that was compiled in the early 2000s and packed with ASPack v107b to reduce file size. These DLLs are pushed to endpoints via Group Policy Objects (GPO) or SCCM/Intune software distribution.
  • Filter/Exclusion: Create a whitelist for the specific executable path and its associated DLLs (e.g., C:\Program Files (x86)\LegacyApp\bin\*.dll). Verify the digital signature of the parent executable (e.g., LegacyApp.exe) to ensure the DLLs are loaded by a trusted, signed process. Exclude files located in the specific application directory tree if the parent process is on the trusted application list.

• Third-Party SDK or Plugin Installation

  • Scenario: Developers or system administrators install a third-party SDK, such as a specific video codec pack, a legacy Java applet plugin, or a specialized financial reporting plugin, which includes helper DLLs packed with ASPack v107b. These are often installed via MSI packages or silent installers into C:\Program Files or C:\Program Files (x86).
  • Filter/Exclusion: Exclude DLLs located in known SDK or plugin directories (e.g., C:\Program Files\Adobe\, C:\Program Files (x86)\Java\, C:\Program Files\FinancialPlugin\). Cross-reference the DLL’s parent process with a list of known trusted installers or applications (e.g., msiexec.exe, setup.exe from a known vendor). If the DLL is in a standard program directory and the parent process is signed by