deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Unknown_UPX_or_File_modifyer
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 02 00 00 00 CD 03 5A 81 C2 86 EA FE FF 81 C2 45 23 01 00 89 D1 81 C1 3C 05 00 00 52 81 2A 33 53 45 12 83 C2 04 39 CA 7E F3 89 CA 8B 42 04 8D 18 29 02 BB 78 56 00 00 83 EA 04 3B 14 24 7D EC C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Unknown_UPX_or_File_modifyer: PEiD
{
    strings:
        $a = { E8 02 00 00 00 CD 03 5A 81 C2 86 EA FE FF 81 C2 45 23 01 00 89 D1 81 C1 3C 05 00 00 52 81 2A 33 53 45 12 83 C2 04 39 CA 7E F3 89 CA 8B 42 04 8D 18 29 02 BB 78 56 00 00 83 EA 04 3B 14 24 7D EC C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CD_Cops_II_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 53 60 BD ?? ?? ?? ?? 8D 45 ?? 8D 5D ?? E8 ?? ?? ?? ?? 8D }

Detection condition:
$a at pe.entry_point

Full rule:
rule CD_Cops_II_additional: PEiD
{
    strings:
        $a = { 53 60 BD ?? ?? ?? ?? 8D 45 ?? 8D 5D ?? E8 ?? ?? ?? ?? 8D }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SDProtector_BasicPro_Edition_110_Randy_Li_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64 }
        $b = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 64 A3 00 00 00 00 83 C4 08 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 59 03 00 00 03 C8 74 B8 75 B6 E8 00 00 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule SDProtector_BasicPro_Edition_110_Randy_Li_h: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64 }
        $b = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64 8F 05 00 00 00 00 64 A3 00 00 00 00 83 C4 08 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 0F 79 0D E8 34 99 47 49 34 33 EF 31 34 52 47 23 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 59 03 00 00 03 C8 74 B8 75 B6 E8 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: HACKSTOP_v113_DarkStop_v10_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FA BD ?? ?? D4 85 4E 32 EB EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule HACKSTOP_v113_DarkStop_v10_Hint_DOS_EP: PEiD
{
    strings:
        $a = { FA BD ?? ?? D4 85 4E 32 EB EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Enigma_Protector_1X_Sukhov_Vladimir_Serge_N_Markin_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 52 65 67 43 6C 6F 73 65 4B 65 79 00 00 00 53 79 73 46 72 65 65 53 74 72 69 6E 67 00 00 00 43 72 65 61 74 65 46 6F 6E 74 41 00 00 00 53 68 65 6C 6C 45 78 65 63 75 74 65 41 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Enigma_Protector_1X_Sukhov_Vladimir_Serge_N_Markin_additional: PEiD
{
    strings:
        $a = { 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 52 65 67 43 6C 6F 73 65 4B 65 79 00 00 00 53 79 73 46 72 65 65 53 74 72 69 6E 67 00 00 00 43 72 65 61 74 65 46 6F 6E 74 41 00 00 00 53 68 65 6C 6C 45 78 65 63 75 74 65 41 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AVHRR_Graphics_format
Repository: Yara-Rules/rules

Pattern signatures:
$a = { D5 C8 00 01 00 03 00 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule AVHRR_Graphics_format: PEiD
{
    strings:
        $a = { D5 C8 00 01 00 03 00 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Zortech_C_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? 2E FF ?? ?? ?? FC 06 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Zortech_C_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E8 ?? ?? 2E FF ?? ?? ?? FC 06 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SimplePack_111_Method_1_bagieTMX
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC }
        $b = { 60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC F3 A5 89 C1 83 E1 03 F3 A4 5F 5E 8B 04 24 89 EA 03 57 0C E8 3F 01 00 00 58 68 00 40 00 00 FF 77 10 50 FF 93 3C 03 00 00 83 C7 28 4E 75 9E BE ?? ?? ?? ?? 09 F6 0F 84 0C 01 00 00 01 EE 8B 4E 0C 09 C9 0F 84 FF 00 00 00 01 E9 89 CF 57 FF 93 30 03 00 00 09 C0 75 3D 6A 04 68 00 10 00 00 68 00 10 00 00 6A 00 FF 93 38 03 00 00 89 C6 8D 83 6F 02 00 00 57 50 56 FF 93 44 03 00 00 6A 10 6A 00 56 6A 00 FF 93 48 03 00 00 89 E5 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule SimplePack_111_Method_1_bagieTMX: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC }
        $b = { 60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC F3 A5 89 C1 83 E1 03 F3 A4 5F 5E 8B 04 24 89 EA 03 57 0C E8 3F 01 00 00 58 68 00 40 00 00 FF 77 10 50 FF 93 3C 03 00 00 83 C7 28 4E 75 9E BE ?? ?? ?? ?? 09 F6 0F 84 0C 01 00 00 01 EE 8B 4E 0C 09 C9 0F 84 FF 00 00 00 01 E9 89 CF 57 FF 93 30 03 00 00 09 C0 75 3D 6A 04 68 00 10 00 00 68 00 10 00 00 6A 00 FF 93 38 03 00 00 89 C6 8D 83 6F 02 00 00 57 50 56 FF 93 44 03 00 00 6A 10 6A 00 56 6A 00 FF 93 48 03 00 00 89 E5 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Microsoft_Visual_Cpp_DLL_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 14 8B CC }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_Visual_Cpp_DLL_additional: PEiD
{
    strings:
        $a = { 66 9C 60 50 8B D8 03 ?? 68 54 BC ?? ?? 6A ?? FF 50 14 8B CC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXE2COM_regular_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 8C CA 81 C3 ?? ?? 3B 16 ?? ?? 76 ?? BA ?? ?? B4 09 CD 21 CD 20 0D }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXE2COM_regular_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 8C CA 81 C3 ?? ?? 3B 16 ?? ?? 76 ?? BA ?? ?? B4 09 CD 21 CD 20 0D }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_01_ASProtect_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_01_ASProtect_Anorganix: PEiD
{
    strings:
        $a = { 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SPEC_b2
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 57 51 53 E8 ?? ?? ?? ?? 5D 8B C5 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 09 89 85 ?? ?? ?? ?? 0F B6 }

Detection condition:
$a at pe.entry_point

Full rule:
rule SPEC_b2: PEiD
{
    strings:
        $a = { 55 57 51 53 E8 ?? ?? ?? ?? 5D 8B C5 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 83 E8 09 89 85 ?? ?? ?? ?? 0F B6 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_02_ASProtect_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_02_ASProtect_Anorganix: PEiD
{
    strings:
        $a = { 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PUNiSHER_V15_Demo_FEUERRADER
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 }
        $b = { 3F 00 00 80 66 20 ?? 00 7E 20 ?? 00 92 20 ?? 00 A4 20 ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule PUNiSHER_V15_Demo_FEUERRADER: PEiD
{
    strings:
        $a = { EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 }
        $b = { 3F 00 00 80 66 20 ?? 00 7E 20 ?? 00 92 20 ?? 00 A4 20 ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: EncryptPE_V22008618_WFS_SignByKuNgBiM
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 ?? ?? ?? 00 E8 52 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 43 72 65 61 74 65 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EncryptPE_V22008618_WFS_SignByKuNgBiM: PEiD
{
    strings:
        $a = { 68 ?? ?? ?? 00 E8 52 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 43 72 65 61 74 65 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SDProtector_BasicPro_Edition_110_Randy_Li_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64 }

Detection condition:
$a at pe.entry_point

Full rule:
rule SDProtector_BasicPro_Edition_110_Randy_Li_additional: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_v110_Eng_dulekxt_Microsoft_Visual_Cpp_60
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Cpp_60: PEiD
{
    strings:
        $a = { 03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Crinkler_V03_V04_Rune_LHStubbe_and_Aske_Simon_Christensen
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 00 00 42 00 31 DB 43 EB 58 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Crinkler_V03_V04_Rune_LHStubbe_and_Aske_Simon_Christensen: PEiD
{
    strings:
        $a = { B8 00 00 42 00 31 DB 43 EB 58 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: yzpack_V11
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 33 C0 8D 48 07 50 E2 FD 8B EC 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 8D 40 7C 8B 40 3C 89 45 04 E8 F3 07 00 00 60 8B 5D 04 8B 73 3C 8B 74 33 78 03 F3 56 8B 76 20 03 F3 33 C9 49 92 41 AD 03 C3 52 33 FF 0F B6 10 38 F2 }

Detection condition:
$a at pe.entry_point

Full rule:
rule yzpack_V11: PEiD
{
    strings:
        $a = { 60 33 C0 8D 48 07 50 E2 FD 8B EC 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 8D 40 7C 8B 40 3C 89 45 04 E8 F3 07 00 00 60 8B 5D 04 8B 73 3C 8B 74 33 78 03 F3 56 8B 76 20 03 F3 33 C9 49 92 41 AD 03 C3 52 33 FF 0F B6 10 38 F2 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_V6X_Minimum_Protection_Silicon_Realms_Toolworks_20081227
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 65 E4 00 8B 75 08 3B 35 ?? ?? ?? ?? 77 22 6A 04 E8 ?? ?? ?? ?? 59 83 65 FC 00 56 E8 ?? ?? ?? ?? 59 89 45 E4 C7 45 FC FE FF FF FF E8 ?? ?? ?? ?? 8B 45 E4 E8 ?? ?? ?? ?? C3 6A 04 E8 ?? ?? ?? ?? 59 C3 55 8B 6C 24 08 83 FD E0 0F 87 9F 00 00 00 53 8B ?? ?? ?? ?? ?? 56 57 33 F6 39 ?? ?? ?? ?? ?? 8B FD 75 18 E8 ?? ?? ?? ?? 6A 1E E8 ?? ?? ?? ?? 68 FF 00 00 00 E8 ?? ?? ?? ?? 59 59 ?? ?? ?? ?? ?? 83 F8 01 75 0E 3B EE 74 04 8B C5 EB 03 33 C0 40 50 EB 1E 83 F8 03 75 0B 55 E8 ?? ?? ?? ?? 3B C6 59 75 17 3B EE 75 03 33 FF 47 83 C7 0F 83 E7 F0 57 56 FF 35 ?? ?? ?? ?? FF D3 8B F0 85 F6 75 26 39 05 ?? ?? ?? ?? 6A 0C 5F 74 0D 55 E8 ?? ?? ?? ?? 85 C0 59 75 81 EB 07 E8 ?? ?? ?? ?? 89 38 E8 ?? ?? ?? ?? 89 38 5F 8B C6 5E 5B 5D C3 55 E8 ?? ?? ?? ?? 59 E8 ?? ?? ?? ?? C7 00 0C 00 00 00 33 C0 5D C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_V6X_Minimum_Protection_Silicon_Realms_Toolworks_20081227: PEiD
{
    strings:
        $a = { E8 ?? ?? ?? ?? E9 ?? ?? ?? ?? 6A 0C 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 65 E4 00 8B 75 08 3B 35 ?? ?? ?? ?? 77 22 6A 04 E8 ?? ?? ?? ?? 59 83 65 FC 00 56 E8 ?? ?? ?? ?? 59 89 45 E4 C7 45 FC FE FF FF FF E8 ?? ?? ?? ?? 8B 45 E4 E8 ?? ?? ?? ?? C3 6A 04 E8 ?? ?? ?? ?? 59 C3 55 8B 6C 24 08 83 FD E0 0F 87 9F 00 00 00 53 8B ?? ?? ?? ?? ?? 56 57 33 F6 39 ?? ?? ?? ?? ?? 8B FD 75 18 E8 ?? ?? ?? ?? 6A 1E E8 ?? ?? ?? ?? 68 FF 00 00 00 E8 ?? ?? ?? ?? 59 59 ?? ?? ?? ?? ?? 83 F8 01 75 0E 3B EE 74 04 8B C5 EB 03 33 C0 40 50 EB 1E 83 F8 03 75 0B 55 E8 ?? ?? ?? ?? 3B C6 59 75 17 3B EE 75 03 33 FF 47 83 C7 0F 83 E7 F0 57 56 FF 35 ?? ?? ?? ?? FF D3 8B F0 85 F6 75 26 39 05 ?? ?? ?? ?? 6A 0C 5F 74 0D 55 E8 ?? ?? ?? ?? 85 C0 59 75 81 EB 07 E8 ?? ?? ?? ?? 89 38 E8 ?? ?? ?? ?? 89 38 5F 8B C6 5E 5B 5D C3 55 E8 ?? ?? ?? ?? 59 E8 ?? ?? ?? ?? C7 00 0C 00 00 00 33 C0 5D C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Nullsoft_Install_System_v20
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 }
        $b = { 83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 68 68 92 40 00 56 FF D3 E8 6A FF FF FF 85 C0 0F 84 59 01 00 00 BE 20 E4 42 00 56 FF 15 68 70 40 00 68 5C 92 40 00 56 E8 B9 28 00 00 57 FF 15 BC 70 40 00 BE 00 40 43 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 40 43 00 22 A3 20 EC 42 00 8B C6 75 0A C6 44 24 13 22 B8 01 40 43 00 8B 3D 18 72 40 00 EB 09 3A 4C 24 13 74 09 50 FF D7 8A 08 84 C9 75 F1 50 FF D7 8B F0 89 74 24 1C EB 05 56 FF D7 8B F0 80 3E 20 74 F6 80 3E 2F 75 44 46 80 3E 53 75 0C 8A 46 0

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Nullsoft_Install_System_v20: PEiD
{
    strings:
        $a = { 83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 }
        $b = { 83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 68 68 92 40 00 56 FF D3 E8 6A FF FF FF 85 C0 0F 84 59 01 00 00 BE 20 E4 42 00 56 FF 15 68 70 40 00 68 5C 92 40 00 56 E8 B9 28 00 00 57 FF 15 BC 70 40 00 BE 00 40 43 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 40 43 00 22 A3 20 EC 42 00 8B C6 75 0A C6 44 24 13 22 B8 01 40 43 00 8B 3D 18 72 40 00 EB 09 3A 4C 24 13 74 09 50 FF D7 8A 08 84 C9 75 F1 50 FF D7 8B F0 89 74 24 1C EB 05 56 FF D7 8B F0 80 3E 20 74 F6 80 3E 2F 75 44 46 80 3E 53 75 0C 8A 46 01 0C 20 3C 20 75 03 83 CD 02 81 3E 4E 43 52 }
        $c = { 83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 68 68 92 40 00 56 FF D5 E8 6A FF FF FF 85 C0 0F 84 57 01 00 00 BE 20 E4 42 00 56 FF 15 68 70 40 00 68 5C 92 40 00 56 E8 9C 28 00 00 57 FF 15 BC 70 40 00 BE 00 40 43 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 40 43 00 22 A3 20 EC 42 00 75 0A C6 44 24 14 22 BE 01 40 43 00 FF 74 24 14 56 E8 8A 23 00 00 50 FF 15 80 71 40 00 8B F8 89 7C 24 18 EB 61 80 F9 20 75 06 40 80 38 20 74 FA 80 38 22 C6 44 24 14 20 75 06 40 C6 44 24 14 22 80 38 2F 75 31 40 80 38 53 75 0E 8A 48 01 80 C9 20 80 F9 20 75 03 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: RECSmall_v102
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8C D8 1E E8 ?? ?? 83 ?? ?? 5D B9 ?? ?? 81 ?? ?? ?? 40 8E D8 2B DB B2 ?? ?? ?? FE C2 43 83 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RECSmall_v102: PEiD
{
    strings:
        $a = { 8C D8 1E E8 ?? ?? 83 ?? ?? 5D B9 ?? ?? 81 ?? ?? ?? 40 8E D8 2B DB B2 ?? ?? ?? FE C2 43 83 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: VProtector_V11_vcasm
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 1A ED 41 00 B9 EC EB 41 00 50 51 E8 74 00 00 00 E8 51 6A 00 00 58 83 E8 10 B9 B3 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule VProtector_V11_vcasm: PEiD
{
    strings:
        $a = { B8 1A ED 41 00 B9 EC EB 41 00 50 51 E8 74 00 00 00 E8 51 6A 00 00 58 83 E8 10 B9 B3 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_PESHiELD_025
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_PESHiELD_025: PEiD
{
    strings:
        $a = { 60 E8 2B 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 CC CC E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_02_CD_Cops_II
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_02_CD_Cops_II: PEiD
{
    strings:
        $a = { 53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPolyx_04_by_delikon
Repository: Yara-Rules/rules

Pattern signatures:
$a = { C3 ?? ?? ?? ?? ?? 83 EC 04 89 }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPolyx_04_by_delikon: PEiD
{
    strings:
        $a = { C3 ?? ?? ?? ?? ?? 83 EC 04 89 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AntiDote_12DLLDemo_SIS_Team_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B }

Detection condition:
$a at pe.entry_point

Full rule:
rule AntiDote_12DLLDemo_SIS_Team_additional: PEiD
{
    strings:
        $a = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 08 32 90 90 90 90 90 90 90 90 90 90 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MPRESS_V101_MATCODE_Softwarenbsp_nbsp_SignByfly_20080730
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 58 05 ?? ?? ?? ?? 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 51 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 8B D6 8B CF E8 56 00 00 00 5E 5A 83 EA 05 2B C9 3B CA 73 26 8B D9 AC 41 24 FE 3C E8 75 F2 43 83 C1 04 AD 0B C0 78 06 3B C2 73 E5 EB 06 03 C3 78 DF 03 C2 2B C3 89 46 FC EB D6 E8 00 00 00 00 5F 81 C7 8D FF FF FF B0 E9 AA B8 B2 02 00 00 AB E8 00 00 00 00 58 05 34 02 00 00 E9 24 02 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MPRESS_V101_MATCODE_Softwarenbsp_nbsp_SignByfly_20080730: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 58 05 ?? ?? ?? ?? 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 51 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 8B D6 8B CF E8 56 00 00 00 5E 5A 83 EA 05 2B C9 3B CA 73 26 8B D9 AC 41 24 FE 3C E8 75 F2 43 83 C1 04 AD 0B C0 78 06 3B C2 73 E5 EB 06 03 C3 78 DF 03 C2 2B C3 89 46 FC EB D6 E8 00 00 00 00 5F 81 C7 8D FF FF FF B0 E9 AA B8 B2 02 00 00 AB E8 00 00 00 00 58 05 34 02 00 00 E9 24 02 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: eXPressor_v14_CGSoftLabs_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC }

Detection condition:
$a at pe.entry_point

Full rule:
rule eXPressor_v14_CGSoftLabs_additional: PEiD
{
    strings:
        $a = { 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RLPack_V118_Dll_aPlib_043_ap0x
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 80 7C 24 08 01 0F 85 5C 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RLPack_V118_Dll_aPlib_043_ap0x: PEiD
{
    strings:
        $a = { 80 7C 24 08 01 0F 85 5C 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 }
    condition:
        $a at pe.entry_point

}