Petitev14

Hunt Hypothesis

This rule detects the presence of the Petitev14 YARA signature, which identifies a specific variant of the Petite packer often used by adversaries to compress and obfuscate malicious payloads to evade static analysis. Proactively hunting for this indicator in Azure Sentinel allows the SOC to identify potentially compromised endpoints or files that may be leveraging this packing technique to hide their true nature before execution or lateral movement occurs.

YARA Rule

rule Petitev14
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [4] 66 9C 60 50 8B D8 03 00 68 [4] 6A 00 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legitimate Software Updates via Installers: Many enterprise applications (e.g., Adobe Creative Cloud, Microsoft Office, or Java) use installers that may be packed or compressed in a way that matches the Petitev14 signature, especially if the installer is a self-extracting archive or uses a specific packing algorithm.
  • Filter/Exclusion: Exclude files located in standard installation directories (e.g., C:\Program Files\, C:\Program Files (x86)\) or specific known-good installer executables (e.g., setup.exe, install.exe, uninstall.exe) from specific vendor folders.
• Java Runtime Environment (JRE/JDK) Components: The Java jpackage tool or certain JRE components can produce executables that are packed in a manner similar to the Petite packer, triggering this rule during application builds or runtime updates.
  • Filter/Exclusion: Exclude files with extensions .jar or executables named java.exe, jpackage.exe, or jlink.exe located within the JAVA_HOME directory or standard JDK installation paths.
• Electron-Based Applications: Electron apps (e.g., Slack, Discord, VS Code, or internal corporate tools) bundle Node.js and other dependencies into a single executable. The packaging process can result in a binary structure that matches the Petitev14 YARA rule, particularly in older or custom-built Electron apps.
  • Filter/Exclusion: Exclude executables located in directories containing resources\app\ or resources\app.asar (indicative of Electron apps) or specific known-good Electron app names (e.g., slack.exe, code.exe, discord.exe).
• Custom Internal Tools Built with Go or Rust: Some internal tools compiled with Go or Rust, especially if they use specific