Susp Packer Pkr MSTI Junk GDI Obfuscation

Tim Peck@timpeck

•updated Jan 12, 2026•1•1•31

Detects pkr_mtsi packer samples based on their characteristic use of junk GDI API calls for obfuscation. The rule looks for PE files that import an excessive number of GDI32.dll functions and contain repeated calls to CreateSolidBrush with random color values.