Mess 107 EXE

Hunt Hypothesis

This rule identifies executable files matching the YARA signature for “Mess 107,” which may indicate the presence of a specific malware variant or a known malicious payload dropped during an intrusion. Proactively hunting for this signature in Azure Sentinel allows the SOC team to detect low-severity threats that might otherwise evade standard behavioral detections, ensuring early identification of compromised endpoints before they progress to lateral movement or data exfiltration.

YARA Rule

rule Mess_107_EXE: PEiD
{
    strings:
        $a = { 4D 45 53 53 B9 FF FF 83 C4 04 F3 26 AC E3 46 EB 50 0D 0A 0D 0A 53 74 6F 6E 65 68 65 61 64 27 73 20 4D 45 53 53 20 76 31 2E 30 37 20 FE 20 52 65 67 67 65 64 20 74 6F 20 }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or DevOps engineer runs a custom build script or installer that uses a lightweight, unsigned, or minimally packed executable (e.g., a Go binary, a Rust tool, or a custom C# console app) to perform local configuration tasks or data migration. These binaries often lack standard digital signatures or have unusual section headers, triggering YARA patterns for “messy” or non-standard EXE structures.

  • Filter/Exclusion: Exclude executables located in specific development directories (e.g., C:\Dev\, C:\Projects\, or user-specific AppData\Local\Temp\ if the process is initiated by a known build agent) and allowlist specific file hashes or names of known internal tools (e.g., build-helper.exe, config-migrator.exe).

• Scenario: An administrator uses a third-party utility like 7-Zip, WinRAR, or Ninite to install or update software. Some of these tools, or the temporary installers they spawn, may be compiled with specific packers or have non-standard resource sections that match the “Mess 107” YARA signature, especially if the installer is a self-extracting archive or a custom-built wrapper.

  • Filter/Exclusion: Exclude processes spawned by known installer parent processes (e.g., 7zG.exe, WinRAR.exe, ninite.exe) and allowlist executables in standard installation paths (e.g., C:\Program Files\, C:\Program Files (x86)\) that are digitally signed by trusted vendors (e.g., Igor Pavlov, Ninite, or the specific software publisher).

• Scenario: A scheduled task runs a maintenance script that invokes a small, unsigned helper executable (e.g., a PowerShell-to-EXE compiled script or a Python py2exe/`