deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: beria_v007_public_WIP_symbiont_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0 }
        $b = { 83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0 3B F5 74 37 8B 46 0C 3B C5 8B 3D 04 30 ?? ?? 89 2E 89 6E 04 89 6E 08 74 06 50 FF D7 89 6E 0C 8B 46 10 3B C5 74 06 50 FF D7 89 6E 10 8B 46 14 3B C5 74 0A 50 FF D7 89 6E 14 EB 02 33 F6 6A 10 55 89 35 A4 40 ?? ?? FF D3 8B F0 3B F5 74 09 E8 08 12 00 00 8B C6 EB 02 33 C0 8B 48 08 8B 51 04 8B 09 8B 35 30 30 ?? ?? A3 D4 43 ?? ?? 8B 00 03 D0 52 03 C8 51 FF D6 8B 3D 24 30 ?? ?? 50 FF D7 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule beria_v007_public_WIP_symbiont_h: PEiD
{
    strings:
        $a = { 83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0 }
        $b = { 83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0 3B F5 74 37 8B 46 0C 3B C5 8B 3D 04 30 ?? ?? 89 2E 89 6E 04 89 6E 08 74 06 50 FF D7 89 6E 0C 8B 46 10 3B C5 74 06 50 FF D7 89 6E 10 8B 46 14 3B C5 74 0A 50 FF D7 89 6E 14 EB 02 33 F6 6A 10 55 89 35 A4 40 ?? ?? FF D3 8B F0 3B F5 74 09 E8 08 12 00 00 8B C6 EB 02 33 C0 8B 48 08 8B 51 04 8B 09 8B 35 30 30 ?? ?? A3 D4 43 ?? ?? 8B 00 03 D0 52 03 C8 51 FF D6 8B 3D 24 30 ?? ?? 50 FF D7 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Dev_Cpp_v4
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 83 EC 08 83 C4 F4 6A ?? A1 ?? ?? ?? 00 FF D0 E8 ?? FF FF FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule Dev_Cpp_v4: PEiD
{
    strings:
        $a = { 55 89 E5 83 EC 08 83 C4 F4 6A ?? A1 ?? ?? ?? 00 FF D0 E8 ?? FF FF FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Dev_Cpp_v5
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 83 EC 14 6A ?? FF 15 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Dev_Cpp_v5: PEiD
{
    strings:
        $a = { 55 89 E5 83 EC 14 6A ?? FF 15 ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: from_NORMAN_Anti_Virus_Utilites_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? 5B 52 45 2F 4E 44 44 53 5D 0D 0A }

Detection condition:
$a at pe.entry_point

Full rule:
rule from_NORMAN_Anti_Virus_Utilites_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E8 ?? ?? 5B 52 45 2F 4E 44 44 53 5D 0D 0A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RCC_II386_v051_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FA BC ?? ?? FE ?? ?? 0E 1F 3E ?? ?? ?? ?? ?? 3E ?? ?? ?? ?? ?? B8 ?? ?? CD 21 06 53 B8 ?? ?? CD 21 06 53 8B D5 8C C8 8E D8 B8 ?? ?? CD 21 8B D5 B8 ?? ?? CD 21 CD 01 9C }

Detection condition:
$a at pe.entry_point

Full rule:
rule RCC_II386_v051_Hint_DOS_EP: PEiD
{
    strings:
        $a = { FA BC ?? ?? FE ?? ?? 0E 1F 3E ?? ?? ?? ?? ?? 3E ?? ?? ?? ?? ?? B8 ?? ?? CD 21 06 53 B8 ?? ?? CD 21 06 53 8B D5 8C C8 8E D8 B8 ?? ?? CD 21 8B D5 B8 ?? ?? CD 21 CD 01 9C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Caterpillar1575_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB ?? 06 1E 8C C0 0E 1F 0E 07 A3 ?? ?? 8C D0 A3 ?? ?? B0 ?? E6 20 FC ?? C0 8E D8 ?? F6 BF ?? ?? B9 ?? ?? F2 A4 1E 17 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Caterpillar1575_Hint_DOS_EP: PEiD
{
    strings:
        $a = { EB ?? 06 1E 8C C0 0E 1F 0E 07 A3 ?? ?? 8C D0 A3 ?? ?? B0 ?? E6 20 FC ?? C0 8E D8 ?? F6 BF ?? ?? B9 ?? ?? F2 A4 1E 17 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_02_Gleam_100
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_02_Gleam_100: PEiD
{
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FMC_Faust_Module_music_file
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 46 4D 43 21 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FMC_Faust_Module_music_file: PEiD
{
    strings:
        $a = { 46 4D 43 21 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: TaiShanXiangYu_LockSoft_DLL_V10_zlocksoft_SignByfly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED E3 00 42 00 8B D5 81 C2 32 01 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 AF 28 42 00 81 E9 DD 01 42 00 8B D5 81 C2 DD 01 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 78 20 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC }

Detection condition:
$a at pe.entry_point

Full rule:
rule TaiShanXiangYu_LockSoft_DLL_V10_zlocksoft_SignByfly: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED E3 00 42 00 8B D5 81 C2 32 01 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 AF 28 42 00 81 E9 DD 01 42 00 8B D5 81 C2 DD 01 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 78 20 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_VBOX_43_MTE_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_VBOX_43_MTE_Anorganix: PEiD
{
    strings:
        $a = { 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_v120_Eng_dulekxt_Microsoft_Visual_Cpp_60_70_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA 73 8B CF 81 C2 96 44 EB 04 EB 02 CD 20 88 16 E8 02 00 00 00 44 A2 59 46 E8 01 00 00 00 AD 59 4B 80 C1 13 83 FB 00 75 B2 F7 D9 96 8F 80 4D 0C 4C 91 50 1C 0C 50 8A ?? ?? ?? 50 E9 34 16 50 4C 4C 0E 7E 9B 49 C6 32 02 3E 7E 7B 5E 8C C5 6B 50 3F 0E 0F 38 C8 95 18 D1 65 11 2C B8 87 28 C3 4C 0B 3C AC D9 2D 15 4E 8F 1C 40 4F 28 98 3E 10 C1 45 DB 8F 06 3F EC 48 61 4C 50 50 81 DF C3 20 34 84 10 10 0C 1F 68 DC FF 24 8C 4D 29 F5 1D 2C BF 74 CF F0 24 C0 08 2E 0C 0C 10 51 0C 91 10 10 81 16 D0 54 4B D7 42 C3 54 CB C9 4E }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_v120_Eng_dulekxt_Microsoft_Visual_Cpp_60_70_additional: PEiD
{
    strings:
        $a = { EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA 73 8B CF 81 C2 96 44 EB 04 EB 02 CD 20 88 16 E8 02 00 00 00 44 A2 59 46 E8 01 00 00 00 AD 59 4B 80 C1 13 83 FB 00 75 B2 F7 D9 96 8F 80 4D 0C 4C 91 50 1C 0C 50 8A ?? ?? ?? 50 E9 34 16 50 4C 4C 0E 7E 9B 49 C6 32 02 3E 7E 7B 5E 8C C5 6B 50 3F 0E 0F 38 C8 95 18 D1 65 11 2C B8 87 28 C3 4C 0B 3C AC D9 2D 15 4E 8F 1C 40 4F 28 98 3E 10 C1 45 DB 8F 06 3F EC 48 61 4C 50 50 81 DF C3 20 34 84 10 10 0C 1F 68 DC FF 24 8C 4D 29 F5 1D 2C BF 74 CF F0 24 C0 08 2E 0C 0C 10 51 0C 91 10 10 81 16 D0 54 4B D7 42 C3 54 CB C9 4E }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: XPack_167_COM
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 53 00 FF FD FF FB FF F9 FF BC 03 00 8B E5 4C 4C C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule XPack_167_COM: PEiD
{
    strings:
        $a = { E9 53 00 FF FD FF FB FF F9 FF BC 03 00 8B E5 4C 4C C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: DBPE_v210
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 01 E8 79 E0 7A 01 75 83 C4 04 9D EB 01 75 68 5F 20 40 ?? E8 B0 EF FF FF 72 03 73 01 75 BE }

Detection condition:
$a at pe.entry_point

Full rule:
rule DBPE_v210: PEiD
{
    strings:
        $a = { 9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 01 E8 79 E0 7A 01 75 83 C4 04 9D EB 01 75 68 5F 20 40 ?? E8 B0 EF FF FF 72 03 73 01 75 BE }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Macromedia_Windows_Flash_ProjectorPlayer_v40_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 EC 44 56 FF 15 24 41 43 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C }

Detection condition:
$a at pe.entry_point

Full rule:
rule Macromedia_Windows_Flash_ProjectorPlayer_v40_additional: PEiD
{
    strings:
        $a = { 83 EC 44 56 FF 15 24 41 43 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MrHDKiller_ProtectioN_v12_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? 48 51 44 2E ?? ?? ?? 2D ?? ?? 8B D8 05 ?? ?? 8B F0 BF ?? ?? B9 ?? ?? ?? F3 A4 8B CB D1 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MrHDKiller_ProtectioN_v12_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? 48 51 44 2E ?? ?? ?? 2D ?? ?? 8B D8 05 ?? ?? 8B F0 BF ?? ?? B9 ?? ?? ?? F3 A4 8B CB D1 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_v220b1
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 30 12 41 00 68 A4 A5 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_v220b1: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 30 12 41 00 68 A4 A5 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Shrinker_v34_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 3D B4 ?? ?? ?? ?? 55 8B EC 56 57 75 6B 68 00 01 00 00 E8 ?? 0B 00 00 83 C4 04 8B 75 08 A3 B4 ?? ?? ?? 85 F6 74 23 83 7D 0C 03 77 1D 68 FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule Shrinker_v34_additional: PEiD
{
    strings:
        $a = { 83 3D B4 ?? ?? ?? ?? 55 8B EC 56 57 75 6B 68 00 01 00 00 E8 ?? 0B 00 00 83 C4 04 8B 75 08 A3 B4 ?? ?? ?? 85 F6 74 23 83 7D 0C 03 77 1D 68 FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPXHiT_v001_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 94 BC ?? ?? ?? 00 B9 ?? 00 00 00 80 34 0C ?? E2 FA 94 FF E0 61 }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPXHiT_v001_additional: PEiD
{
    strings:
        $a = { 94 BC ?? ?? ?? 00 B9 ?? 00 00 00 80 34 0C ?? E2 FA 94 FF E0 61 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SLR_OPTLINK_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 }

Detection condition:
$a at pe.entry_point

Full rule:
rule SLR_OPTLINK_additional: PEiD
{
    strings:
        $a = { 4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AsCrypt_v01_SToRM_needs_to_be_added_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 C6 14 8B 55 FC E9 ?? FF FF FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule AsCrypt_v01_SToRM_needs_to_be_added_additional: PEiD
{
    strings:
        $a = { 83 C6 14 8B 55 FC E9 ?? FF FF FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CRYPTCOM_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? BE 00 01 56 B9 ?? ?? C7 ?? ?? ?? C6 ?? ?? ?? 81 ?? ?? ?? 46 46 E2 ?? 31 F6 31 C9 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CRYPTCOM_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? BE 00 01 56 B9 ?? ?? C7 ?? ?? ?? C6 ?? ?? ?? 81 ?? ?? ?? 46 46 E2 ?? 31 F6 31 C9 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Borland_Delphi_3_Portions_Copyright_c_198396_Borland
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 36 20 42 6F 72 6C 61 6E 64 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Borland_Delphi_3_Portions_Copyright_c_198396_Borland: PEiD
{
    strings:
        $a = { 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 36 20 42 6F 72 6C 61 6E 64 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Petite_v22_wwwun4seencompetite_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 00 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Petite_v22_wwwun4seencompetite_additional: PEiD
{
    strings:
        $a = { B8 00 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_v110_Eng_dulekxt_Microsoft_Visual_Cpp_50_60
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 33 D2 0F BE D2 EB 01 C7 EB 01 D8 8D 05 80 ?? ?? ?? EB 02 CD 20 EB 01 F8 BE F4 00 00 00 EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Cpp_50_60: PEiD
{
    strings:
        $a = { 33 D2 0F BE D2 EB 01 C7 EB 01 D8 8D 05 80 ?? ?? ?? EB 02 CD 20 EB 01 F8 BE F4 00 00 00 EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Mh757_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? B8 ?? ?? CD 21 3C 07 75 ?? FB B8 ?? ?? CD 21 8C C8 48 8E C0 26 ?? ?? ?? ?? ?? 74 ?? B4 ?? BB ?? ?? CD 21 81 ?? ?? ?? 72 ?? B4 ?? CD 21 72 ?? 48 8E C0 FA }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Mh757_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? B8 ?? ?? CD 21 3C 07 75 ?? FB B8 ?? ?? CD 21 8C C8 48 8E C0 26 ?? ?? ?? ?? ?? 74 ?? B4 ?? BB ?? ?? CD 21 81 ?? ?? ?? 72 ?? B4 ?? CD 21 72 ?? 48 8E C0 FA }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Fish_Pe_Packer_V103_V10X_hellfish_20090119
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 21 00 00 00 EB 18 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 5E 56 8B 56 1C 89 F3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Fish_Pe_Packer_V103_V10X_hellfish_20090119: PEiD
{
    strings:
        $a = { 60 E8 21 00 00 00 EB 18 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 5E 56 8B 56 1C 89 F3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: TurboBAT_v310_50_Patched
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 90 90 90 90 90 90 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ?? ?? 24 ?? 3A C4 90 90 }

Detection condition:
$a at pe.entry_point

Full rule:
rule TurboBAT_v310_50_Patched: PEiD
{
    strings:
        $a = { 90 90 90 90 90 90 90 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ?? ?? 24 ?? 3A C4 90 90 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Cryptic_20_Tughack
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 00 00 40 00 BB ?? ?? ?? 00 B9 00 10 00 00 BA ?? ?? ?? 00 03 D8 03 C8 03 D1 3B CA 74 06 80 31 ?? 41 EB F6 FF E3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Cryptic_20_Tughack: PEiD
{
    strings:
        $a = { B8 00 00 40 00 BB ?? ?? ?? 00 B9 00 10 00 00 BA ?? ?? ?? 00 03 D8 03 C8 03 D1 3B CA 74 06 80 31 ?? 41 EB F6 FF E3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: XCompXPack_V09X_JoKo_20080218
Repository: Yara-Rules/rules

Pattern signatures:
$a = { AC 84 C0 74 03 AA EB F8 E8 0B 00 00 00 20 6E 6F 74 20 66 6F 75 6E 64 00 5E AC AA 84 C0 75 FA 6A 00 57 52 6A 00 E8 06 00 00 00 45 72 72 6F 72 00 5E AC AA 84 C0 75 FA E8 0B 00 00 00 55 53 45 52 33 32 2E 44 4C 4C 00 FF 55 2C E8 0C 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 50 FF 55 28 FF D0 83 C4 7C 48 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule XCompXPack_V09X_JoKo_20080218: PEiD
{
    strings:
        $a = { AC 84 C0 74 03 AA EB F8 E8 0B 00 00 00 20 6E 6F 74 20 66 6F 75 6E 64 00 5E AC AA 84 C0 75 FA 6A 00 57 52 6A 00 E8 06 00 00 00 45 72 72 6F 72 00 5E AC AA 84 C0 75 FA E8 0B 00 00 00 55 53 45 52 33 32 2E 44 4C 4C 00 FF 55 2C E8 0C 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 50 FF 55 28 FF D0 83 C4 7C 48 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Crunch_4_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Crunch_4_additional: PEiD
{
    strings:
        $a = { EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: unknown_by_RAO
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B C4 2D A6 02 24 00 8B F8 57 B9 53 00 BE 14 01 F3 A5 FD C3 97 4F 4F B9 00 00 03 F1 D1 E9 F3 A5 FC E8 91 00 8D 75 02 BF 00 01 3C A4 E8 80 00 72 FA E8 77 00 AC 93 B7 FF 73 65 E8 72 00 D0 D7 E8 6D 00 72 12 B6 02 E8 66 00 72 09 E8 61 00 D0 D7 }

Detection condition:
$a at pe.entry_point

Full rule:
rule unknown_by_RAO: PEiD
{
    strings:
        $a = { 8B C4 2D A6 02 24 00 8B F8 57 B9 53 00 BE 14 01 F3 A5 FD C3 97 4F 4F B9 00 00 03 F1 D1 E9 F3 A5 FC E8 91 00 8D 75 02 BF 00 01 3C A4 E8 80 00 72 FA E8 77 00 AC 93 B7 FF 73 65 E8 72 00 D0 D7 E8 6D 00 72 12 B6 02 E8 66 00 72 09 E8 61 00 D0 D7 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PCrypt_350_COM
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 43 52 59 50 54 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PCrypt_350_COM: PEiD
{
    strings:
        $a = { 50 43 52 59 50 54 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_v110_Eng_bartxt_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B6 00 56 8B F7 2B F0 F3 A4 5E EB 97 33 C9 41 FF D3 13 C9 FF D3 72 F8 C3 02 D2 75 05 8A 16 46 12 D2 C3 5B 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 58 FF FF FF 5F BB ?? ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 89 06 AD 85 C0 75 D9 8B EC C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00 88 01 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_v110_Eng_bartxt_additional: PEiD
{
    strings:
        $a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B6 00 56 8B F7 2B F0 F3 A4 5E EB 97 33 C9 41 FF D3 13 C9 FF D3 72 F8 C3 02 D2 75 05 8A 16 46 12 D2 C3 5B 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 58 FF FF FF 5F BB ?? ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 89 06 AD 85 C0 75 D9 8B EC C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00 88 01 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RCryptor_V20_Private_Vaskanbsp_nbsp_SignByfly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? ?? ?? ?? F7 D1 83 F1 FF E8 00 00 00 00 F7 D1 83 F1 FF C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RCryptor_V20_Private_Vaskanbsp_nbsp_SignByfly: PEiD
{
    strings:
        $a = { F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? ?? ?? ?? F7 D1 83 F1 FF E8 00 00 00 00 F7 D1 83 F1 FF C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: tElock_V099_10_Private_tE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule tElock_V099_10_Private_tE: PEiD
{
    strings:
        $a = { E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Obsidium_V1363_Obsidium_Software_20080730
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? E8 ?? 00 00 00 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 26 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 33 C0 EB 02 ?? ?? 64 FF 30 EB 01 ?? 64 89 20 EB 01 ?? EB 02 ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 ?? 00 00 00 EB 03 ?? ?? ?? E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsidium_V1363_Obsidium_Software_20080730: PEiD
{
    strings:
        $a = { EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? E8 ?? 00 00 00 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 26 EB 03 ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 33 C0 EB 02 ?? ?? 64 FF 30 EB 01 ?? 64 89 20 EB 01 ?? EB 02 ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 04 ?? ?? ?? ?? E9 ?? 00 00 00 EB 03 ?? ?? ?? E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Sonik_Youth_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8A 16 02 00 8A 07 32 C2 88 07 43 FE C2 81 FB }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Sonik_Youth_additional: PEiD
{
    strings:
        $a = { 8A 16 02 00 8A 07 32 C2 88 07 43 FE C2 81 FB }
    condition:
        $a at pe.entry_point

}