deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Enigma_Protector_10X_Sukhov_Vladimir
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 83 ?? ?? 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 C4 04 EB 02 ?? ?? 60 E8 24 00 00 00 00 00 ?? EB 02 ?? ?? 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 ?? ?? 89 C4 61 EB 2E ?? ?? ?? ?? ?? ?? ?? EB 01 ?? 31 C0 EB 01 ?? 64 FF 30 EB 01 ?? 64 89 20 EB 02 ?? ?? 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 ?? 58 61 EB 01 }
        $b = { 60 E8 00 00 00 00 5D 83 ?? ?? 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 C4 04 EB 02 ?? ?? 60 E8 24 00 00 00 00 00 ?? EB 02 ?? ?? 8B 44 24 0C 83 80 B8 00 00 00 03 31 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Enigma_Protector_10X_Sukhov_Vladimir: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 83 ?? ?? 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 C4 04 EB 02 ?? ?? 60 E8 24 00 00 00 00 00 ?? EB 02 ?? ?? 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 ?? ?? 89 C4 61 EB 2E ?? ?? ?? ?? ?? ?? ?? EB 01 ?? 31 C0 EB 01 ?? 64 FF 30 EB 01 ?? 64 89 20 EB 02 ?? ?? 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 ?? 58 61 EB 01 }
        $b = { 60 E8 00 00 00 00 5D 83 ?? ?? 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 83 C4 04 EB 02 ?? ?? 60 E8 24 00 00 00 00 00 ?? EB 02 ?? ?? 8B 44 24 0C 83 80 B8 00 00 00 03 31 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: ASPack_v108x_Alexey_Solodovnikov
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 EB 03 5D FF E5 E8 F8 FF FF FF 81 ED 1B 6A 44 00 BB 10 6A 44 00 03 DD 2B 9D 2A }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASPack_v108x_Alexey_Solodovnikov: PEiD
{
    strings:
        $a = { 60 EB 03 5D FF E5 E8 F8 FF FF FF 81 ED 1B 6A 44 00 BB 10 6A 44 00 03 DD 2B 9D 2A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: tElock_099_10_private_tE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule tElock_099_10_private_tE: PEiD
{
    strings:
        $a = { E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_110_Eng_dulekxt_Borland_Delphi_Microsoft_Visual_Cpp_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_110_Eng_dulekxt_Borland_Delphi_Microsoft_Visual_Cpp_additional: PEiD
{
    strings:
        $a = { 2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ACProtect_v135_risco_software_Inc_Anticrack_Software
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 47 65 74 50 72 6F 63 }
        $b = { 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule ACProtect_v135_risco_software_Inc_Anticrack_Software: PEiD
{
    strings:
        $a = { 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 47 65 74 50 72 6F 63 }
        $b = { 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: ActiveMARK_5x_Trymedia_Systems_Inc_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ActiveMARK_5x_Trymedia_Systems_Inc_h: PEiD
{
    strings:
        $a = { 20 2D 2D 4D 50 52 4D 4D 47 56 41 2D 2D 00 75 73 65 72 33 32 2E 64 6C 6C 00 4D 65 73 73 61 67 65 42 6F 78 41 00 54 68 69 73 20 61 70 70 6C 69 63 61 74 69 6F 6E 20 63 61 6E 6E 6F 74 20 72 75 6E 20 77 69 74 68 20 61 6E 20 61 63 74 69 76 65 20 64 65 62 75 67 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: HSC_music_file_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { C8 E2 04 20 }

Detection condition:
$a at pe.entry_point

Full rule:
rule HSC_music_file_Hint_FILE_START: PEiD
{
    strings:
        $a = { C8 E2 04 20 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MoleboxUltraV40X_Teggo_Software_Ltd_20090518
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 E8 0C 00 00 00 5D C3 CC CC CC CC CC E8 85 08 00 00 6A 00 54 6A 00 E8 8E 04 00 00 87 04 24 E8 90 06 00 00 5F 5E 5E 89 EC 5D FF E0 32 06 74 07 32 26 74 03 31 C0 C3 C1 E8 10 83 C6 02 09 C0 75 EB B8 01 00 00 00 C3 31 C0 8B 74 24 10 8B 76 28 66 8B 06 83 C6 02 09 C0 74 09 83 F0 5C 75 02 89 F7 EB ED 89 FE C3 56 57 E8 DA FF FF FF B8 6E 4E 74 54 E8 B5 FF FF FF 09 C0 74 0E B8 64 44 6C 4C E8 A7 FF FF FF 09 C0 74 00 5F 5E C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MoleboxUltraV40X_Teggo_Software_Ltd_20090518: PEiD
{
    strings:
        $a = { 55 89 E5 E8 0C 00 00 00 5D C3 CC CC CC CC CC E8 85 08 00 00 6A 00 54 6A 00 E8 8E 04 00 00 87 04 24 E8 90 06 00 00 5F 5E 5E 89 EC 5D FF E0 32 06 74 07 32 26 74 03 31 C0 C3 C1 E8 10 83 C6 02 09 C0 75 EB B8 01 00 00 00 C3 31 C0 8B 74 24 10 8B 76 28 66 8B 06 83 C6 02 09 C0 74 09 83 F0 5C 75 02 89 F7 EB ED 89 FE C3 56 57 E8 DA FF FF FF B8 6E 4E 74 54 E8 B5 FF FF FF 09 C0 74 0E B8 64 44 6C 4C E8 A7 FF FF FF 09 C0 74 00 5F 5E C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Themida_10xx_18xx_no_compression_Oreans_Technologies_h_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8D 45 80 8B 5D 08 C7 85 7C FF FF FF 00 00 00 00 8B 8D 7C FF FF FF D1 C3 88 18 41 89 8D 7C FF FF FF 81 BD 7C FF FF FF 80 00 00 00 75 E3 C7 85 7C FF FF FF 00 00 00 00 8D BA ?? ?? ?? ?? 8D 75 80 8A 0E BB F4 01 00 00 B8 AB 37 54 78 D3 D0 8A 0F D3 D0 4B 75 F7 0F AF C3 47 46 8B 8D 7C FF FF FF 41 89 8D 7C FF FF FF 81 F9 80 00 00 00 75 D1 61 C9 C2 04 00 55 8B EC 83 C4 F0 8B 75 08 C7 45 FC 00 00 00 00 EB 04 FF 45 FC 46 80 3E 00 75 F7 BA 00 00 00 00 8B 75 08 8B 7D 0C EB 7F C7 45 F8 00 00 00 00 EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule Themida_10xx_18xx_no_compression_Oreans_Technologies_h_additional: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8D 45 80 8B 5D 08 C7 85 7C FF FF FF 00 00 00 00 8B 8D 7C FF FF FF D1 C3 88 18 41 89 8D 7C FF FF FF 81 BD 7C FF FF FF 80 00 00 00 75 E3 C7 85 7C FF FF FF 00 00 00 00 8D BA ?? ?? ?? ?? 8D 75 80 8A 0E BB F4 01 00 00 B8 AB 37 54 78 D3 D0 8A 0F D3 D0 4B 75 F7 0F AF C3 47 46 8B 8D 7C FF FF FF 41 89 8D 7C FF FF FF 81 F9 80 00 00 00 75 D1 61 C9 C2 04 00 55 8B EC 83 C4 F0 8B 75 08 C7 45 FC 00 00 00 00 EB 04 FF 45 FC 46 80 3E 00 75 F7 BA 00 00 00 00 8B 75 08 8B 7D 0C EB 7F C7 45 F8 00 00 00 00 EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SalityQ
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 55 00 00 00 8D BD 00 10 40 00 68 ?? ?? ?? 00 03 3C 24 8B F7 90 68 31 10 40 00 9B DB E3 55 DB 04 24 8B C7 DB 44 24 04 DE C1 DB 1C 24 8B 1C 24 66 AD 51 DB 04 24 90 90 DA 8D 77 10 40 00 DB 1C 24 D1 E1 29 0C 24 33 04 24 D1 E9 66 AB 58 E2 24 57 B8 FC 4F 00 00 29 04 24 C3 8B 2C 24 B9 18 10 00 00 81 ED 06 10 40 00 90 90 90 81 C1 E8 17 00 00 90 EB 91 FF E3 ?? ?? 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule SalityQ: PEiD
{
    strings:
        $a = { 60 E8 55 00 00 00 8D BD 00 10 40 00 68 ?? ?? ?? 00 03 3C 24 8B F7 90 68 31 10 40 00 9B DB E3 55 DB 04 24 8B C7 DB 44 24 04 DE C1 DB 1C 24 8B 1C 24 66 AD 51 DB 04 24 90 90 DA 8D 77 10 40 00 DB 1C 24 D1 E1 29 0C 24 33 04 24 D1 E9 66 AB 58 E2 24 57 B8 FC 4F 00 00 29 04 24 C3 8B 2C 24 B9 18 10 00 00 81 ED 06 10 40 00 90 90 90 81 C1 E8 17 00 00 90 EB 91 FF E3 ?? ?? 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_02_PEX_099
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_02_PEX_099: PEiD
{
    strings:
        $a = { 60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CreateInstall_Stub_vxx_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CreateInstall_Stub_vxx_additional: PEiD
{
    strings:
        $a = { 81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MSLRH_v032a_fake_MSVCpp_70_DLL_Method_3_emadicius_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule MSLRH_v032a_fake_MSVCpp_70_DLL_Method_3_emadicius_h: PEiD
{
    strings:
        $a = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Borland_Delphi_5_Portions_Copyright_c_198399_Borland
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 39 20 42 6F 72 6C 61 6E 64 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Borland_Delphi_5_Portions_Copyright_c_198399_Borland: PEiD
{
    strings:
        $a = { 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 39 20 42 6F 72 6C 61 6E 64 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: LamerStop_v10c_c_Stefan_Esser_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? 05 ?? ?? CD 21 33 C0 8E C0 26 ?? ?? ?? 2E ?? ?? ?? 26 ?? ?? ?? 2E ?? ?? ?? BA ?? ?? FA }

Detection condition:
$a at pe.entry_point

Full rule:
rule LamerStop_v10c_c_Stefan_Esser_additional: PEiD
{
    strings:
        $a = { E8 ?? ?? 05 ?? ?? CD 21 33 C0 8E C0 26 ?? ?? ?? 2E ?? ?? ?? 26 ?? ?? ?? 2E ?? ?? ?? BA ?? ?? FA }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Inbuild_v10_hard
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B9 ?? ?? BB ?? ?? 2E ?? ?? 2E ?? ?? 43 E2 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Inbuild_v10_hard: PEiD
{
    strings:
        $a = { B9 ?? ?? BB ?? ?? 2E ?? ?? 2E ?? ?? 43 E2 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vprotect_V201110304_CoooLie
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B 67 28 8B C0 F6 D5 F7 D7 8B F6 F7 D7 F6 D5 F7 D7 8D 80 E9 FF FF FF 8D AD FF FF FF FF 60 66 F7 D3 66 F7 D3 61 8D AD 01 00 00 00 8D 80 17 00 00 00 F7 D7 66 56 8D 9B F6 FF FF FF 8D 80 F6 FF FF FF 8D 80 0A 00 00 00 8D 9B 0A 00 00 00 66 5E 61 9C 9D 8D 9B EE FF FF FF 57 86 F1 8D BF F5 FF FF FF F7 D6 66 8B D2 F7 D6 8D BF 0B 00 00 00 86 F1 5F 8D 9B 12 00 00 00 66 52 8D 92 E4 FF FF FF 8D 92 1C 00 00 00 66 5A 9D }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vprotect_V201110304_CoooLie: PEiD
{
    strings:
        $a = { 8B 67 28 8B C0 F6 D5 F7 D7 8B F6 F7 D7 F6 D5 F7 D7 8D 80 E9 FF FF FF 8D AD FF FF FF FF 60 66 F7 D3 66 F7 D3 61 8D AD 01 00 00 00 8D 80 17 00 00 00 F7 D7 66 56 8D 9B F6 FF FF FF 8D 80 F6 FF FF FF 8D 80 0A 00 00 00 8D 9B 0A 00 00 00 66 5E 61 9C 9D 8D 9B EE FF FF FF 57 86 F1 8D BF F5 FF FF FF F7 D6 66 8B D2 F7 D6 8D BF 0B 00 00 00 86 F1 5F 8D 9B 12 00 00 00 66 52 8D 92 E4 FF FF FF 8D 92 1C 00 00 00 66 5A 9D }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MS_Run_Time_Library_1990_1992_09_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B4 30 CD 21 3C 02 73 ?? C3 8C DF 8B 36 ?? ?? 2E }

Detection condition:
$a at pe.entry_point

Full rule:
rule MS_Run_Time_Library_1990_1992_09_Hint_DOS_EP: PEiD
{
    strings:
        $a = { B4 30 CD 21 3C 02 73 ?? C3 8C DF 8B 36 ?? ?? 2E }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: VProtector_V11_vcasm_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 1A ED 41 00 B9 EC EB 41 00 50 51 E8 74 00 00 00 E8 51 6A 00 00 58 83 E8 10 B9 B3 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule VProtector_V11_vcasm_additional: PEiD
{
    strings:
        $a = { B8 1A ED 41 00 B9 EC EB 41 00 50 51 E8 74 00 00 00 E8 51 6A 00 00 58 83 E8 10 B9 B3 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: OLE2_Document_WinWord_Excel_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { D0 CF 11 E0 A1 B1 1A E1 }

Detection condition:
$a at pe.entry_point

Full rule:
rule OLE2_Document_WinWord_Excel_Hint_FILE_START: PEiD
{
    strings:
        $a = { D0 CF 11 E0 A1 B1 1A E1 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CrypKey_v5_v6
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? ?? ?? 58 83 E8 05 50 5F 57 8B F7 81 EF ?? ?? ?? ?? 83 C6 39 BA ?? ?? ?? ?? 8B DF B9 0B ?? ?? ?? 8B 06 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CrypKey_v5_v6: PEiD
{
    strings:
        $a = { E8 ?? ?? ?? ?? 58 83 E8 05 50 5F 57 8B F7 81 EF ?? ?? ?? ?? 83 C6 39 BA ?? ?? ?? ?? 8B DF B9 0B ?? ?? ?? 8B 06 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AZProtect_0x0001_AlexZ_aka_AZCRC_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule AZProtect_0x0001_AlexZ_aka_AZCRC_additional: PEiD
{
    strings:
        $a = { EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Sun_Icon_Graphics_format_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 2F 2A 20 46 6F 72 6D 61 74 5F 76 65 72 73 69 6F 6E 3D 31 2C }

Detection condition:
$a at pe.entry_point

Full rule:
rule Sun_Icon_Graphics_format_additional: PEiD
{
    strings:
        $a = { 2F 2A 20 46 6F 72 6D 61 74 5F 76 65 72 73 69 6F 6E 3D 31 2C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_PENinja_131
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_PENinja_131: PEiD
{
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UnoPiX_075_BaGiE_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 07 00 00 00 61 68 ?? ?? 40 00 C3 83 04 24 18 C3 20 83 B8 ED 20 37 EF C6 B9 79 37 9E 61 }

Detection condition:
$a at pe.entry_point

Full rule:
rule UnoPiX_075_BaGiE_additional: PEiD
{
    strings:
        $a = { 60 E8 07 00 00 00 61 68 ?? ?? 40 00 C3 83 04 24 18 C3 20 83 B8 ED 20 37 EF C6 B9 79 37 9E 61 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_Visual_Cpp_60_DLL_Debug_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B 44 24 08 8B 4C 24 10 0B C8 8B 4C 24 0C 75 09 8B 44 24 04 F7 E1 C2 10 00 53 F7 E1 8B D8 8B 44 24 08 F7 64 24 14 03 D8 8B 44 24 08 F7 E1 03 D3 5B C2 10 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_Visual_Cpp_60_DLL_Debug_additional: PEiD
{
    strings:
        $a = { 8B 44 24 08 8B 4C 24 10 0B C8 8B 4C 24 0C 75 09 8B 44 24 04 F7 E1 C2 10 00 53 F7 E1 8B D8 8B 44 24 08 F7 64 24 14 03 D8 8B 44 24 08 F7 E1 03 D3 5B C2 10 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vterminal_V10X_Lei_Peng_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 0E 1F 8C C6 B4 ?? 50 BB ?? ?? CD 21 73 ?? 58 CD 21 72 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vterminal_V10X_Lei_Peng_additional: PEiD
{
    strings:
        $a = { 0E 1F 8C C6 B4 ?? 50 BB ?? ?? CD 21 73 ?? 58 CD 21 72 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_110_Eng_dulekxt_Borland_Delphi_Borland_Cpp
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA }
        $b = { 2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule FSG_110_Eng_dulekxt_Borland_Delphi_Borland_Cpp: PEiD
{
    strings:
        $a = { 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA }
        $b = { 2B C2 E8 02 00 00 00 95 4A 59 8D 3D 52 F1 2A E8 C1 C8 1C BE 2E ?? ?? 18 EB 02 AB A0 03 F7 EB 02 CD 20 68 F4 00 00 00 0B C7 5B 03 CB 8A 06 8A 16 E8 02 00 00 00 8D 46 59 EB 01 A4 02 D3 EB 02 CD 20 02 D3 E8 02 00 00 00 57 AB 58 81 C2 AA 87 AC B9 0F BE C9 80 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Microsoft_Visual_Cpp
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B 44 24 08 83 }
        $b = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Microsoft_Visual_Cpp: PEiD
{
    strings:
        $a = { 8B 44 24 08 83 }
        $b = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}