PolyCryptPE214b215JLabSoftwareCreationshsigned

Hunt Hypothesis

This rule identifies the presence of PolyCrypt PE executables associated with JLab Software Creations, a tool often used for encrypting or obfuscing payloads to evade static analysis. Proactively hunting for this signature allows the SOC team to detect low-severity, potentially benign or stealthy utilities that may be leveraged by adversaries to hide malicious code within the Azure environment.

YARA Rule

rule PolyCryptPE214b215JLabSoftwareCreationshsigned
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 6F 6C 79 43 72 79 70 74 20 50 45 20 28 63 29 20 32 30 30 34 2D 32 30 30 35 2C 20 4A 4C 61 62 53 6F 66 74 77 61 72 65 2E 00 50 00 43 00 50 00 45 }

condition:
		$a0
}

Deployment Notes

This YARA rule can be deployed in the following contexts:

• Microsoft Defender for Endpoint — Custom indicators / advanced hunting
• Email Gateway — Attachment scanning
• File Share Monitoring — Periodic scanning of shared drives
• YARA CLI — Manual threat hunting on endpoints

This rule contains 1 string patterns in its detection logic.

• Source Rule

False Positive Guidance

• Scenario: A developer or IT administrator is running a legitimate, signed utility from JLab Software Creations (e.g., a specific installer, updater, or diagnostic tool) that has been packed with the PolyCrypt PE packer to reduce file size or protect intellectual property. The YARA rule matches the specific packer signature and the signer name, triggering an alert despite the file being trusted.

  • Filter/Exclusion: Exclude files where the signer matches “JLab Software Creations” AND the path is within known application directories (e.g., C:\Program Files\JLab\* or C:\ProgramData\JLab\*), provided the file hash is in the approved baseline.

• Scenario: A scheduled maintenance job or a third-party backup/agent service (e.g., Veeam, Commvault, or a custom in-house tool) uses a helper executable signed by JLab Software Creations to perform disk imaging, compression, or encryption tasks. This executable is packed with PolyCrypt, causing the detection to fire during routine maintenance windows.

  • Filter/Exclusion: Exclude alerts where the parent_process is a known service host (e.g., svchost.exe, services.exe, or specific agent binaries like veeam.exe) AND the process_name matches the specific JLab utility name (e.g., jlabutil.exe or compressor.exe).

• Scenario: An endpoint protection agent or a software distribution tool (like SCCM, Intune, or Chocolatey) installs or updates a package that includes a signed, PolyCrypt-packed component from JLab Software Creations. The installation process temporarily extracts or executes the packed binary, triggering the YARA rule during the deployment phase.

  • Filter/Exclusion: Exclude alerts where the process_path contains Temp, `App