FreePascal 104 Win32 DLL Berczi Gabor Pierre Muller Peter Vreman

Hunt Hypothesis

This hypothesis targets the presence of FreePascal-compiled Win32 DLLs, which adversaries may leverage for lightweight, obfuscated payload delivery or process injection due to the language’s ability to generate compact native code. Proactively hunting for these specific binary signatures in Azure Sentinel helps identify low-fidelity implants that might evade standard AV detection, ensuring early discovery of potential staging or lateral movement components within the environment.

YARA Rule

rule FreePascal_104_Win32_DLL_Berczi_Gabor_Pierre_Muller_Peter_Vreman: PEiD
{
    strings:
        $a = { C6 05 ?? ?? ?? ?? 00 55 89 E5 53 56 57 8B 7D 08 89 3D ?? ?? ?? ?? 8B 7D 0C 89 3D ?? ?? ?? ?? 8B 7D 10 89 3D ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F 5E 5B 5D C2 0C 00 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A legacy internal application (e.g., InventoryManager.exe) is built using the FreePascal 104 compiler and distributed via Group Policy or a software deployment tool (like SCCM/MECM) to user workstations. The binary contains the specific compiler signature strings, triggering the YARA rule during a full disk scan or when the process is loaded into memory.

  • Filter/Exclusion: Exclude files located in standard application installation directories (e.g., C:\Program Files\InternalApps\InventoryManager\) or exclude the specific executable name (InventoryManager.exe) if the path is consistent across the fleet.

• Scenario: An IT administrator is performing a manual debug or performance analysis of a custom-built utility written in FreePascal. They use a tool like Process Explorer or Sysinternals Suite to inspect the DLL (utils.dll) in their local C:\Users\Admin\Downloads\ or C:\Temp\ folder, causing the YARA scan to flag the file due to its location and signature.

  • Filter/Exclusion: Exclude files in user-specific temporary or download directories (e.g., C:\Users\*\Downloads\, C:\Users\*\AppData\Local\Temp\) if the parent process is a known administrative tool (e.g., procexp.exe, sysinternals).

• Scenario: A scheduled maintenance job runs a custom script or executable (e.g., DataCleaner.exe) developed in FreePascal to archive old logs. The executable is stored in a shared network drive (\\fileserver\apps\maintenance\) and executed by a service account, triggering the detection because the file path is non-standard and the binary matches the compiler signature.

  • Filter/Exclusion: Exclude files located in known shared application directories (e.g., \\fileserver\apps\)