UPX v0896 v102 v105 v122 Delphi stub additional

Hunt Hypothesis

This hypothesis targets the presence of UPX-packed executables utilizing specific Delphi stubs, a common obfuscation technique employed by adversaries to compress malware and evade signature-based detection. Proactively hunting for these artifacts in Azure Sentinel helps identify potentially compromised workloads or uploaded binaries that may be hiding malicious logic within standard application frameworks.

YARA Rule

rule UPX_v0896_v102_v105_v122_Delphi_stub_additional: PEiD
{
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? C7 87 ?? ?? ?? ?? ?? ?? ?? ?? 57 83 CD FF EB 0E ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B }
    condition:
        $a at pe.entry_point

}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Delphi-based Internal Utility Deployment: A legacy internal inventory or reporting tool written in Delphi is compiled with UPX to reduce file size for distribution via a package manager (e.g., SCCM or Ansible). The binary is copied to the C:\Program Files\InternalTools\ directory on multiple endpoints.

  • Filter/Exclusion: Exclude files located in C:\Program Files\ or C:\Program Files (x86)\ where the parent folder name matches known internal application directories (e.g., *Inventory*, *ReportGen*) and the file size is under 5MB.

• Scheduled Maintenance Job with UPX-Compressed Script: A PowerShell or Batch script that performs nightly database log rotation is wrapped in a small Delphi stub (using UPX) to execute the underlying command silently. This stub is stored in C:\Windows\System32\Tasks\ or C:\Scripts\Maintenance\ and runs via Task Scheduler.

  • Filter/Exclusion: Exclude files in C:\Scripts\ or C:\Windows\System32\Tasks\ that are smaller than 100KB and have a last modified date older than 30 days, indicating a stable, pre-deployed maintenance script.

• Third-Party Delphi Application Update: An enterprise application (e.g., a specialized CAD or financial tool) built with Delphi is updated via its auto-updater. The updater downloads a new executable that is UPX-compressed to save bandwidth, placing it in the application’s install directory (e.g., C:\Program Files\VendorApp\bin\) before replacing the old binary.

  • Filter/Exclusion: Exclude files in C:\Program Files\ or C:\Program Files (x86)\ that are signed by a known vendor certificate