PKR_MTSI Packer Detection

Daniel Jeremiah@daniyyell

•updated Jan 13, 2026•2•0•25

This rule detects the pkr_mtsi packer. It identifies memory allocation patterns (VirtualAlloc/ZwAllocateVirtualMemory), payload reconstruction from 8-byte chunks, LoadLibraryA resolution or DLL name finding loops, excessive payload write operations (>1000), GDI junk code calls (CreateSolidBrush), unpack routines for ASCII to wide string conversion, anti-debugging techniques (IsDebuggerPresent infinite loop traps), and hashing algorithms (Mul257 with signed add). It specifically targets PE files with more than 15 GDI32 imports and characteristic payload loading patterns.