PeCompact2 253 276 BitSum Technologies

Hunt Hypothesis

This YARA rule identifies Windows executables compressed with the PECompact2 packer, a technique frequently employed by adversaries to obfuscate malware binaries and evade static analysis. Proactively hunting for these packed files in Azure Sentinel helps detect low-severity threats that may be using compression to hide their payload or establish a foothold before executing more complex post-exploitation actions.

YARA Rule

rule PeCompact2_253_276_BitSum_Technologies: PEiD
{
    strings:
        $a = { B8 ?? ?? ?? ?? 55 53 51 57 56 52 8D 98 C9 11 00 10 8B 53 18 52 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 5A 8B F8 50 52 8B 33 8B 43 20 03 C2 8B 08 89 4B 20 8B 43 1C 03 C2 8B 08 89 4B 1C 03 F2 8B 4B 0C 03 CA 8D 43 1C 50 57 56 FF }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via SCCM/Intune: When deploying older, unmanaged Windows applications (e.g., legacy ERP clients or specialized industrial HMI software) that were compressed using BitSum Technologies’ PECompact to reduce installer size, the YARA rule may match the compressed executable in the staging folder or after installation.
  • Filter/Exclusion: Exclude paths under C:\Program Files\ or C:\Windows\Installer\ where the file name matches known legacy application binaries, or exclude files with a specific ProductVersion metadata tag if the YARA rule allows metadata matching.
• Third-Party Antivirus/EDR Self-Optimization: Some security vendors (e.g., older versions of Kaspersky, ESET, or Bitdefender) use PECompact to compress their own update binaries or helper tools to minimize disk footprint and network transfer time during agent updates.
  • Filter/Exclusion: Exclude processes or files located in the vendor-specific security folder (e.g., C:\Program Files\Kaspersky Lab\, C:\Program Files\ESET\) where the parent process is the vendor’s update service (e.g., klnagent.exe, esetsvc.exe).
• Scheduled Maintenance Jobs for Compressed Tools: IT teams often store utility scripts or small diagnostic tools (e.g., diskclean.exe, logrotate.exe wrappers) in compressed form to save space on C: drives, which are then executed by Task Scheduler during nightly maintenance windows.
  • Filter/Exclusion: Exclude executions where the parent process is Task Scheduler (taskschd.msc or svchost.exe with the Task Scheduler service) and the file path resides in a dedicated maintenance folder like C:\Scripts\Maintenance\ or C:\Tools\.
• **Java/JRE Native Library Compression