PellesC290300400DLLX86CRTLIB

Hunt Hypothesis

This YARA rule identifies the presence of the Pelles C 2.90.3004 32-bit C runtime library, which may indicate the use of a specific compiler for building custom malware or backdoors. Proactively hunting for this artifact helps the SOC team detect potential low-level code execution or development tooling that adversaries might leverage to create stealthy payloads within the Azure environment.

YARA Rule

rule PellesC290300400DLLX86CRTLIB
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 53 56 57 8B 5D 0C 8B 75 10 BF 01 00 00 00 85 DB 75 10 83 3D [4] 00 75 07 31 C0 E9 [4] 83 FB 01 74 05 83 FB 02 75 ?? 85 FF 74 }

condition:
		$a0 at pe.entry_point
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Legacy C/C++ Application Deployment via Group Policy

  • Scenario: An IT administrator deploys a legacy internal tool (e.g., LegacyReportGen.exe) that was compiled with the Pelles C compiler. The application package includes the pellescrt.dll (or similar CRT library) in the same directory as the executable. When Group Policy pushes this to user machines, the YARA rule triggers on the DLL file during the copy/execution phase.
  • Filter/Exclusion: Exclude files located in specific application directories (e.g., C:\Program Files\InternalTools\LegacyReportGen\) or exclude the DLL if it is co-located with the main executable and the process name matches a known legacy application hash or name.

• Development Environment Build Artifacts

  • Scenario: Developers working on C/C++ projects using the Pelles C IDE build their applications in a local workspace (e.g., C:\Users\dev1\Projects\MyApp\bin\). The build process generates the CRT library DLL alongside the compiled binary. Security agents scanning the developer’s local drive or the shared build server pick up these artifacts.
  • Filter/Exclusion: Exclude paths under standard developer workspace directories (e.g., C:\Users\*\Projects\, C:\dev\, D:\builds\) or exclude files if the parent process is a known compiler/IDE (e.g., pellesc.exe, msbuild.exe, cmake.exe).

• Scheduled Maintenance Job for Data Processing

  • Scenario: A scheduled task runs every night at 02:00 AM to process large CSV files using a custom C-based utility (DataCleaner.exe) compiled with Pelles C. The utility depends on the Pelles CRT DLL, which is loaded into memory or accessed from a