deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: UPX_v0896_v102_v105_v122_Delphi_stub
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 01 DB 07 8B 1E 83 EE FC 11 DB ED B8 01 ?? ?? ?? 01 DB 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 77 }
        $b = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? C7 87 ?? ?? ?? ?? ?? ?? ?? ?? 57 83 CD FF EB 0E ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule UPX_v0896_v102_v105_v122_Delphi_stub: PEiD
{
    strings:
        $a = { 01 DB 07 8B 1E 83 EE FC 11 DB ED B8 01 ?? ?? ?? 01 DB 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 77 }
        $b = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? C7 87 ?? ?? ?? ?? ?? ?? ?? ?? 57 83 CD FF EB 0E ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Borland_Delphi_30_Hint_WIN_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 83 ?? ?? ?? ?? 0F ?? ?? ?? ?? ?? 80 ?? ?? ?? ?? ?? ?? 74 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Borland_Delphi_30_Hint_WIN_EP: PEiD
{
    strings:
        $a = { A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 83 ?? ?? ?? ?? 0F ?? ?? ?? ?? ?? 80 ?? ?? ?? ?? ?? ?? 74 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MSLRH_v032a_fake_PE_Crypt_102_emadicius_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 05 50 E8 08 00 00 00 EA FF 58 EB 18 EB 01 0F EB 02 CD 20 EB 03 EA CD 20 58 58 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule MSLRH_v032a_fake_PE_Crypt_102_emadicius_h: PEiD
{
    strings:
        $a = { E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 85 C0 73 02 F7 05 50 E8 08 00 00 00 EA FF 58 EB 18 EB 01 0F EB 02 CD 20 EB 03 EA CD 20 58 58 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Safengine_Shielden_v2160
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 1C 00 00 00 53 61 66 65 6E 67 69 6E 65 20 53 68 69 65 6C 64 65 6E 20 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Safengine_Shielden_v2160: PEiD
{
    strings:
        $a = { E8 1C 00 00 00 53 61 66 65 6E 67 69 6E 65 20 53 68 69 65 6C 64 65 6E 20 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_Video_Lan_Client_Anorganix_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_Video_Lan_Client_Anorganix_additional: PEiD
{
    strings:
        $a = { 55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Metrowerks_CodeWarrior_v20_Console_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 55 B8 FF FF FF FF 50 50 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Metrowerks_CodeWarrior_v20_Console_additional: PEiD
{
    strings:
        $a = { 55 89 E5 55 B8 FF FF FF FF 50 50 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_110_Eng_bartxt_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_110_Eng_bartxt_additional: PEiD
{
    strings:
        $a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Thinstall_Virtualization_Suite_30X_Thinstall_Company_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 BA FE FF FF E9 ?? ?? ?? ?? CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA ?? ?? ?? ?? 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 ?? ?? ?? ?? E8 DF 00 00 00 73 1B 55 BD ?? ?? ?? ?? E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule Thinstall_Virtualization_Suite_30X_Thinstall_Company_additional: PEiD
{
    strings:
        $a = { 9C 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 BA FE FF FF E9 ?? ?? ?? ?? CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA ?? ?? ?? ?? 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 ?? ?? ?? ?? E8 DF 00 00 00 73 1B 55 BD ?? ?? ?? ?? E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASPack_101b
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED D2 2A 44 00 B8 CC 2A 44 00 03 C5 2B 85 A5 2E 44 00 89 85 B1 2E 44 00 80 BD 9C 2E 44 00 00 75 15 FE 85 9C 2E 44 00 E8 1D 00 00 00 E8 E4 01 00 00 E8 7A 02 00 00 8B 85 9D 2E 44 00 03 85 B1 2E 44 00 89 44 24 1C 61 FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASPack_101b: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED D2 2A 44 00 B8 CC 2A 44 00 03 C5 2B 85 A5 2E 44 00 89 85 B1 2E 44 00 80 BD 9C 2E 44 00 00 75 15 FE 85 9C 2E 44 00 E8 1D 00 00 00 E8 E4 01 00 00 E8 7A 02 00 00 8B 85 9D 2E 44 00 03 85 B1 2E 44 00 89 44 24 1C 61 FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EP_ExE_Pack_V10_Elite_Coding_Group_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EP_ExE_Pack_V10_Elite_Coding_Group_additional: PEiD
{
    strings:
        $a = { 60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Inno_Setup_Module_v5
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 CC 53 56 57 33 C0 89 45 F0 89 45 DC E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? F3 FF FF E8 ?? F4 FF FF 33 C0 55 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Inno_Setup_Module_v5: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 CC 53 56 57 33 C0 89 45 F0 89 45 DC E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? F3 FF FF E8 ?? F4 FF FF 33 C0 55 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_v039_final_Sign_by_hot_UNP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 }
        $b = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Upack_v039_final_Sign_by_hot_UNP: PEiD
{
    strings:
        $a = { 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 }
        $b = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: UPack_Alt_Stub_Dwing_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 09 00 00 00 C3 F6 00 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPack_Alt_Stub_Dwing_additional: PEiD
{
    strings:
        $a = { 60 E8 09 00 00 00 C3 F6 00 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_v01x_v02x_Dwing
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE 88 01 ?? ?? AD 8B F8 95 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_v01x_v02x_Dwing: PEiD
{
    strings:
        $a = { BE 88 01 ?? ?? AD 8B F8 95 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Windows_Type_1_font_metric_file_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 01 ?? ?? 00 00 43 6F 70 79 72 69 67 68 74 20 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Windows_Type_1_font_metric_file_additional: PEiD
{
    strings:
        $a = { 00 01 ?? ?? 00 00 43 6F 70 79 72 69 67 68 74 20 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SENs_debug_protection
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BB 10 00 E8 22 00 BD FE 0F 28 63 29 53 45 4E E8 09 00 98 93 92 8A 80 20 21 52 CB 48 9D BB 00 00 9C 58 23 C5 50 03 C3 C3 B8 00 00 8C DD 03 DD C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule SENs_debug_protection: PEiD
{
    strings:
        $a = { BB 10 00 E8 22 00 BD FE 0F 28 63 29 53 45 4E E8 09 00 98 93 92 8A 80 20 21 52 CB 48 9D BB 00 00 9C 58 23 C5 50 03 C3 C3 B8 00 00 8C DD 03 DD C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_V540_Silicon_Realms_Toolworks_SignByfly_20080214_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 93 3E 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 B4 1F 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 AF 1D 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 40 1D 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_V540_Silicon_Realms_Toolworks_SignByfly_20080214_additional: PEiD
{
    strings:
        $a = { E8 93 3E 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 B4 1F 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 AF 1D 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 40 1D 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: NsPack_V13_LiuXingPing
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule NsPack_V13_LiuXingPing: PEiD
{
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PROTECT_EXECOM_v50
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 1E 0E 0E 1F 07 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PROTECT_EXECOM_v50: PEiD
{
    strings:
        $a = { 1E 0E 0E 1F 07 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_V029_V031_Dwingnbsp_nbsp_SignByfly_20080321
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE ?? ?? ?? ?? AD 8B F8 95 AD 91 F3 A5 AD ?? ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF ?? ?? ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 24 B1 30 8B 5D 0C 03 D1 FF 16 73 4B 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 20 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 14 FF 56 0C 5B 91 FF 66 3C 07 B0 07 72 02 B0 0A 50 87 5D 10 87 5D 14 89 5D 18 8B D5 03 56 18 FF 56 0C 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D 9C 85 7C 03 00 00 FF 56 04 3C 04 8B D8 72 5F 33 DB D1 E8 13 DB 48 43 91 43 D3 E3 80 F9 05 8D 94 9D 7C 01 00 00 76 2E 80 E9 04 33 C0 8B 55 00 D1 6D 08 8B 12 0F CA 2B 55 04 03 C0 3B 55 08 72 07 8B 55 08 40 01 55 04 FF 56 10 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_V029_V031_Dwingnbsp_nbsp_SignByfly_20080321: PEiD
{
    strings:
        $a = { BE ?? ?? ?? ?? AD 8B F8 95 AD 91 F3 A5 AD ?? ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF ?? ?? ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 24 B1 30 8B 5D 0C 03 D1 FF 16 73 4B 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 20 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 14 FF 56 0C 5B 91 FF 66 3C 07 B0 07 72 02 B0 0A 50 87 5D 10 87 5D 14 89 5D 18 8B D5 03 56 18 FF 56 0C 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D 9C 85 7C 03 00 00 FF 56 04 3C 04 8B D8 72 5F 33 DB D1 E8 13 DB 48 43 91 43 D3 E3 80 F9 05 8D 94 9D 7C 01 00 00 76 2E 80 E9 04 33 C0 8B 55 00 D1 6D 08 8B 12 0F CA 2B 55 04 03 C0 3B 55 08 72 07 8B 55 08 40 01 55 04 FF 56 10 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Fly_Crypter_10_ut1lz_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 F0 53 B8 18 22 44 44 E8 7F F7 FF FF E8 0A F1 FF FF B8 09 00 00 00 E8 5C F1 FF FF 8B D8 85 DB 75 05 E8 85 FD FF FF 83 FB 01 75 05 E8 7B FD FF FF 83 FB 02 75 05 E8 D1 FD FF FF 83 FB 03 75 05 E8 87 FE FF FF 83 FB 04 75 05 E8 5D FD FF FF 83 FB }

Detection condition:
$a at pe.entry_point

Full rule:
rule Fly_Crypter_10_ut1lz_additional: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 F0 53 B8 18 22 44 44 E8 7F F7 FF FF E8 0A F1 FF FF B8 09 00 00 00 E8 5C F1 FF FF 8B D8 85 DB 75 05 E8 85 FD FF FF 83 FB 01 75 05 E8 7B FD FF FF 83 FB 02 75 05 E8 D1 FD FF FF 83 FB 03 75 05 E8 87 FE FF FF 83 FB 04 75 05 E8 5D FD FF FF 83 FB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Copy_Protector_v20_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 2E A2 ?? ?? 53 51 52 1E 06 B4 ?? 1E 0E 1F BA ?? ?? CD 21 1F }

Detection condition:
$a at pe.entry_point

Full rule:
rule Copy_Protector_v20_additional: PEiD
{
    strings:
        $a = { 2E A2 ?? ?? 53 51 52 1E 06 B4 ?? 1E 0E 1F BA ?? ?? CD 21 1F }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: KGB_SFX
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 BE 00 A0 46 00 8D BE 00 70 F9 FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 }

Detection condition:
$a at pe.entry_point

Full rule:
rule KGB_SFX: PEiD
{
    strings:
        $a = { 60 BE 00 A0 46 00 8D BE 00 70 F9 FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MCLOCK_13
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 90 90 FA 29 C0 8E C0 26 C6 06 04 00 00 26 C6 06 05 00 00 26 8C 0E 06 00 26 C6 06 0C 00 00 26 C6 06 0D 00 00 26 8C 0E 0E 00 FB CD 01 8C C8 8E C0 CD 03 29 C0 BC 00 00 50 E9 00 00 BE 00 00 B3 00 B9 21 00 2E 30 1C 46 E2 FA CF }

Detection condition:
$a at pe.entry_point

Full rule:
rule MCLOCK_13: PEiD
{
    strings:
        $a = { 90 90 90 FA 29 C0 8E C0 26 C6 06 04 00 00 26 C6 06 05 00 00 26 8C 0E 06 00 26 C6 06 0C 00 00 26 C6 06 0D 00 00 26 8C 0E 0E 00 FB CD 01 8C C8 8E C0 CD 03 29 C0 BC 00 00 50 E9 00 00 BE 00 00 B3 00 B9 21 00 2E 30 1C 46 E2 FA CF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_v1xx_v2xx
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_v1xx_v2xx: PEiD
{
    strings:
        $a = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Lattice_C_v101
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FA B8 ?? ?? 05 ?? ?? B1 ?? D3 E8 8C CB 03 C3 8E D8 8E D0 26 ?? ?? ?? ?? 2B D8 F7 ?? ?? ?? 75 ?? B1 ?? D3 E3 EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule Lattice_C_v101: PEiD
{
    strings:
        $a = { FA B8 ?? ?? 05 ?? ?? B1 ?? D3 E8 8C CB 03 C3 8E D8 8E D0 26 ?? ?? ?? ?? 2B D8 F7 ?? ?? ?? 75 ?? B1 ?? D3 E3 EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Password_protector_my_SMT_Hint_WIN_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? ?? ?? 5D 8B FD 81 ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 46 80 ?? ?? 74 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Password_protector_my_SMT_Hint_WIN_EP: PEiD
{
    strings:
        $a = { E8 ?? ?? ?? ?? 5D 8B FD 81 ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? 83 ?? ?? 89 ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 46 80 ?? ?? 74 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_v033_v034_Beta_Dwing
Repository: Yara-Rules/rules

Pattern signatures:
$a = { ?? ?? ?? ?? 59 F3 A5 83 C8 FF 8B DF AB 40 AB 40 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_v033_v034_Beta_Dwing: PEiD
{
    strings:
        $a = { ?? ?? ?? ?? 59 F3 A5 83 C8 FF 8B DF AB 40 AB 40 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: hmimys_Protect_v10_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule hmimys_Protect_v10_additional: PEiD
{
    strings:
        $a = { 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PE_Diminisher_V01_Teraphy_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 53 51 52 56 57 55 E8 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PE_Diminisher_V01_Teraphy_additional: PEiD
{
    strings:
        $a = { 53 51 52 56 57 55 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: DIET_v144_v145f_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { F9 9C EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule DIET_v144_v145f_additional: PEiD
{
    strings:
        $a = { F9 9C EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_v182_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 E0 C1 40 00 68 74 81 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_v182_additional: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 E0 C1 40 00 68 74 81 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: yodas_Protector_v1032_dllocx_Ashkbiz_Danehkar_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC }
        $b = { 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule yodas_Protector_v1032_dllocx_Ashkbiz_Danehkar_h: PEiD
{
    strings:
        $a = { ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC }
        $b = { 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 BF A4 42 00 81 E9 8E 74 42 00 8B D5 81 C2 8E 74 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 63 29 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}