WWPACKv300v301Relocationspack

Hunt Hypothesis

This rule detects the presence of executable files packed with the WWPACK v300 or v301 compressor, a technique often used by adversaries to obscure binary structure and complicate static analysis during initial access or payload execution. Proactively hunting for these specific packers in Azure Sentinel helps identify potentially obfuscated malware that may be evading signature-based detections or hiding in low-severity alerts within the environment.

YARA Rule

rule WWPACKv300v301Relocationspack
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE [2] BA [2] BF [2] B9 [2] 8C CD 8E DD 81 ED [2] 06 06 8B DD 2B DA 8B D3 FC }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy Application Deployment via Group Policy: When deploying older, unmanaged line-of-business applications (e.g., legacy accounting software or specialized engineering tools) that were compiled with the WWPACK 3.00/3.01 packer to reduce file size, the executable files will match the relocation patterns defined in the rule.
  • Filter/Exclusion: Exclude files located in specific application directories (e.g., C:\Program Files\LegacyApp\) or exclude based on known Publisher/Signer certificates if the application is code-signed.
• Scheduled Maintenance Jobs for Third-Party Utilities: Automated maintenance scripts or scheduled tasks (e.g., Task Scheduler jobs running at 2:00 AM) that execute third-party utility binaries (such as disk cleanup tools, log rotators, or backup agents) which were packed with WWPACK to optimize distribution.
  • Filter/Exclusion: Exclude processes spawned by schtasks.exe or Task Scheduler service if the parent process is svchost.exe (specifically the Task Scheduler service) and the target path matches known utility folders (e.g., C:\ProgramData\VendorTools\).
• Installer Staging Directories: During the installation of large enterprise software suites, installers often extract temporary packed executables into staging directories (e.g., C:\Windows\Installer\ or C:\Temp\) to perform registry updates or service registrations. These temporary files may retain the WWPACK signature.
  • Filter/Exclusion: Exclude files residing in standard installer/temporary paths (e.g., C:\Windows\Installer\, C:\Temp\, C:\Users\*\AppData\Local\Temp\) that are less than 24 hours old, or exclude if the parent process is msiexec.exe or setup.exe.