deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: VIRUS_I_WormBagle
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 6A 00 E8 95 01 00 00 E8 9F E6 FF FF 83 3D 03 50 40 00 00 75 14 68 C8 AF 00 00 E8 01 E1 FF FF 05 88 13 00 00 A3 03 50 40 00 68 5C 57 40 00 68 F6 30 40 00 FF 35 03 50 40 00 E8 B0 EA FF FF E8 3A FC FF FF 83 3D 54 57 40 00 00 74 05 E8 F3 FA FF FF 68 E8 03 00 }
        $b = { 6A 00 E8 95 01 00 00 E8 9F E6 FF FF 83 3D 03 50 40 00 00 75 14 68 C8 AF 00 00 E8 01 E1 FF FF 05 88 13 00 00 A3 03 50 40 00 68 5C 57 40 00 68 F6 30 40 00 FF 35 03 50 40 00 E8 B0 EA FF FF E8 3A FC FF FF 83 3D 54 57 40 00 00 74 05 E8 F3 FA FF FF 68 E8 03 00 00 E8 B1 00 00 00 EB F4 CC FF 25 A4 40 40 00 FF 25 B8 40 40 00 FF 25 B4 40 40 00 FF 25 B0 40 40 00 FF 25 AC 40 40 00 FF 25 9C 40 40 00 FF 25 A0 40 40 00 FF 25 A8 40 40 00 FF 25 24 40 40 00 FF 25 28 40 40 00 FF 25 2C 40 40 00 FF 25 30 40 40 00 FF 25 34 40 40 00 FF 25 38 40 40 00 FF 25 3C 40 40 00 FF 25 40 40 40 00 FF 25 44 40 40 00 FF 25 48 40 40 00 FF 25 4C 40 40 00 FF 25 50 40 40 00 FF 25 54 40 40 00 FF 25 58 40 40 00 FF 25 5C 40 40 00 FF 25 60 40 40 00 FF 25 B

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule VIRUS_I_WormBagle: PEiD
{
    strings:
        $a = { 6A 00 E8 95 01 00 00 E8 9F E6 FF FF 83 3D 03 50 40 00 00 75 14 68 C8 AF 00 00 E8 01 E1 FF FF 05 88 13 00 00 A3 03 50 40 00 68 5C 57 40 00 68 F6 30 40 00 FF 35 03 50 40 00 E8 B0 EA FF FF E8 3A FC FF FF 83 3D 54 57 40 00 00 74 05 E8 F3 FA FF FF 68 E8 03 00 }
        $b = { 6A 00 E8 95 01 00 00 E8 9F E6 FF FF 83 3D 03 50 40 00 00 75 14 68 C8 AF 00 00 E8 01 E1 FF FF 05 88 13 00 00 A3 03 50 40 00 68 5C 57 40 00 68 F6 30 40 00 FF 35 03 50 40 00 E8 B0 EA FF FF E8 3A FC FF FF 83 3D 54 57 40 00 00 74 05 E8 F3 FA FF FF 68 E8 03 00 00 E8 B1 00 00 00 EB F4 CC FF 25 A4 40 40 00 FF 25 B8 40 40 00 FF 25 B4 40 40 00 FF 25 B0 40 40 00 FF 25 AC 40 40 00 FF 25 9C 40 40 00 FF 25 A0 40 40 00 FF 25 A8 40 40 00 FF 25 24 40 40 00 FF 25 28 40 40 00 FF 25 2C 40 40 00 FF 25 30 40 40 00 FF 25 34 40 40 00 FF 25 38 40 40 00 FF 25 3C 40 40 00 FF 25 40 40 40 00 FF 25 44 40 40 00 FF 25 48 40 40 00 FF 25 4C 40 40 00 FF 25 50 40 40 00 FF 25 54 40 40 00 FF 25 58 40 40 00 FF 25 5C 40 40 00 FF 25 60 40 40 00 FF 25 BC 40 40 00 FF 25 64 40 40 00 FF 25 68 40 40 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: N_Code_01_NEX
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BB E8 03 00 00 81 C3 E8 03 00 00 B8 05 00 00 00 B9 73 00 00 00 01 C8 83 E8 32 90 90 90 90 6B C0 02 90 68 FF 64 24 F0 90 90 90 90 90 68 58 58 58 58 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68 }

Detection condition:
$a at pe.entry_point

Full rule:
rule N_Code_01_NEX: PEiD
{
    strings:
        $a = { BB E8 03 00 00 81 C3 E8 03 00 00 B8 05 00 00 00 B9 73 00 00 00 01 C8 83 E8 32 90 90 90 90 6B C0 02 90 68 FF 64 24 F0 90 90 90 90 90 68 58 58 58 58 FF D4 50 8B 40 F2 05 B0 95 F6 95 0F 85 01 81 BB FF 68 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Pelles_C_280_290_EXE_X86_CRT_LIB
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 ?? E8 ?? ?? ?? ?? 59 A3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Pelles_C_280_290_EXE_X86_CRT_LIB: PEiD
{
    strings:
        $a = { 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 ?? E8 ?? ?? ?? ?? 59 A3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RLP_V073beta_ap0x
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 2E 72 6C 70 00 00 00 00 00 50 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RLP_V073beta_ap0x: PEiD
{
    strings:
        $a = { 2E 72 6C 70 00 00 00 00 00 50 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_v2xx_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_v2xx_additional: PEiD
{
    strings:
        $a = { B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: JRC_Archive_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 4A 52 63 68 69 76 65 }

Detection condition:
$a at pe.entry_point

Full rule:
rule JRC_Archive_Hint_FILE_START: PEiD
{
    strings:
        $a = { 4A 52 63 68 69 76 65 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PGMPACK_v014_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PGMPACK_v014_additional: PEiD
{
    strings:
        $a = { 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Borland_Cpp_TREXE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B4 0F CD 10 3C 03 74 05 B8 03 00 CD 10 BA 00 00 2E 89 16 00 01 8B 2E 02 00 8B 1E 2C 00 8E DA 8C 06 00 00 89 1E 00 00 89 2E 00 00 A1 00 00 8E C0 33 C0 8B D8 8B F8 B9 FF 7F FC F2 AE E3 00 43 26 38 05 75 F6 80 CD 80 F7 D9 89 0E 00 00 B9 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Borland_Cpp_TREXE: PEiD
{
    strings:
        $a = { B4 0F CD 10 3C 03 74 05 B8 03 00 CD 10 BA 00 00 2E 89 16 00 01 8B 2E 02 00 8B 1E 2C 00 8E DA 8C 06 00 00 89 1E 00 00 89 2E 00 00 A1 00 00 8E C0 33 C0 8B D8 8B F8 B9 FF 7F FC F2 AE E3 00 43 26 38 05 75 F6 80 CD 80 F7 D9 89 0E 00 00 B9 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Turbo_Basic_v10_1987
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 2E 8C ?? ?? ?? 2E C7 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Turbo_Basic_v10_1987: PEiD
{
    strings:
        $a = { 2E 8C ?? ?? ?? 2E C7 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: WinUpack_v030_beta_By_Dwing
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 }
        $b = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule WinUpack_v030_beta_By_Dwing: PEiD
{
    strings:
        $a = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 }
        $b = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: WWPACK_v305c4_Modified
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule WWPACK_v305c4_Modified: PEiD
{
    strings:
        $a = { B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Private_EXE_Protector_197_SetiSoft
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 02 44 24 0C 88 07 47 EB C6 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 82 6E 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 83 DC 00 00 00 B9 04 00 00 00 33 C0 8D A4 24 00 00 00 00 8D 64 24 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 48 74 B1 0F 89 EF 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 42 BD 00 01 00 00 B9 08 00 00 00 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 88 07 47 4D 75 D6 }
        $b = { 55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 7

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Private_EXE_Protector_197_SetiSoft: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 02 44 24 0C 88 07 47 EB C6 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 82 6E 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 83 DC 00 00 00 B9 04 00 00 00 33 C0 8D A4 24 00 00 00 00 8D 64 24 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 48 74 B1 0F 89 EF 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 42 BD 00 01 00 00 B9 08 00 00 00 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 88 07 47 4D 75 D6 }
        $b = { 55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: UPX_v062_Laszlo_Markus
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 8D B0 F0 01 ?? ?? 83 CD FF 31 DB 90 90 90 EB 08 90 90 8A 06 46 88 07 47 01 DB 75 07 }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPX_v062_Laszlo_Markus: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 8D B0 F0 01 ?? ?? 83 CD FF 31 DB 90 90 90 EB 08 90 90 8A 06 46 88 07 47 01 DB 75 07 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RLPack_FullEdition_V120_BasicEdition_Stub_ap0x_SignByfly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 10 00 00 08 00 00 00 }
        $b = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 4C 6F 61 64 4C 69 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule RLPack_FullEdition_V120_BasicEdition_Stub_ap0x_SignByfly: PEiD
{
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 10 00 00 08 00 00 00 }
        $b = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 4C 6F 61 64 4C 69 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Anskya_NTPacker_Generator_Anskya
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 F0 53 B8 88 1D 00 10 E8 C7 FA FF FF 6A 0A 68 20 1E 00 10 A1 14 31 00 10 50 E8 71 FB FF FF 8B D8 85 DB 74 2F 53 A1 14 31 00 10 50 E8 97 FB FF FF 85 C0 74 1F 53 A1 14 31 00 10 50 E8 5F FB FF FF 85 C0 74 0F 50 E8 5D FB FF FF 85 C0 74 05 E8 70 FC FF FF 5B E8 F2 F6 FF FF 00 00 48 45 41 52 54 }
        $b = { 55 8B EC 83 C4 F0 53 B8 88 1D 00 10 E8 C7 FA FF FF 6A 0A 68 20 1E 00 10 A1 14 31 00 10 50 E8 71 FB FF FF 8B D8 85 DB 74 2F 53 A1 14 31 00 10 50 E8 97 FB FF FF 85 C0 74 1F 53 A1 14 31 00 10 50 E8 5F FB FF FF 85 C0 74 0F 50 E8 5D FB FF FF 85 C0 74 05 E8 70 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Anskya_NTPacker_Generator_Anskya: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 F0 53 B8 88 1D 00 10 E8 C7 FA FF FF 6A 0A 68 20 1E 00 10 A1 14 31 00 10 50 E8 71 FB FF FF 8B D8 85 DB 74 2F 53 A1 14 31 00 10 50 E8 97 FB FF FF 85 C0 74 1F 53 A1 14 31 00 10 50 E8 5F FB FF FF 85 C0 74 0F 50 E8 5D FB FF FF 85 C0 74 05 E8 70 FC FF FF 5B E8 F2 F6 FF FF 00 00 48 45 41 52 54 }
        $b = { 55 8B EC 83 C4 F0 53 B8 88 1D 00 10 E8 C7 FA FF FF 6A 0A 68 20 1E 00 10 A1 14 31 00 10 50 E8 71 FB FF FF 8B D8 85 DB 74 2F 53 A1 14 31 00 10 50 E8 97 FB FF FF 85 C0 74 1F 53 A1 14 31 00 10 50 E8 5F FB FF FF 85 C0 74 0F 50 E8 5D FB FF FF 85 C0 74 05 E8 70 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: LZEXE_091
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 06 0E 1F 8B 0E 0C 00 8B F1 4E 89 F7 8C DB 03 1E 0A 00 8E C3 FD F3 A4 53 B8 00 00 50 CB 2E 8B 2E 08 00 00 DA 89 E8 3D 00 10 76 03 B8 00 10 29 C5 29 C2 29 C3 8E DA 8E C3 B1 03 D3 E0 89 C1 }

Detection condition:
$a at pe.entry_point

Full rule:
rule LZEXE_091: PEiD
{
    strings:
        $a = { 50 06 0E 1F 8B 0E 0C 00 8B F1 4E 89 F7 8C DB 03 1E 0A 00 8E C3 FD F3 A4 53 B8 00 00 50 CB 2E 8B 2E 08 00 00 DA 89 E8 3D 00 10 76 03 B8 00 10 29 C5 29 C2 29 C3 8E DA 8E C3 B1 03 D3 E0 89 C1 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: LZEXE_090
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 06 0E 1F 8B 0E 0C 00 8B F1 4E 89 F7 8C DB 03 1E 0A 00 8E C3 B4 00 31 ED FD AC 01 C5 AA E2 FA 8B 16 0E 00 8A C2 29 C5 8A C6 29 C5 39 D5 74 0C BA 91 01 B4 09 CD 21 B8 FF 4C CD 21 53 B8 53 00 50 CB 2E 8B 2E 08 00 8C DA 89 E8 3D 00 10 76 03 B8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule LZEXE_090: PEiD
{
    strings:
        $a = { 06 0E 1F 8B 0E 0C 00 8B F1 4E 89 F7 8C DB 03 1E 0A 00 8E C3 B4 00 31 ED FD AC 01 C5 AA E2 FA 8B 16 0E 00 8A C2 29 C5 8A C6 29 C5 39 D5 74 0C BA 91 01 B4 09 CD 21 B8 FF 4C CD 21 53 B8 53 00 50 CB 2E 8B 2E 08 00 8C DA 89 E8 3D 00 10 76 03 B8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CRYPACK_v30_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB ?? 06 1E 8C D8 05 ?? ?? 8E D8 33 DB 0E 07 33 FF BE ?? ?? 8A 07 26 ?? ?? 32 C4 88 07 47 3B FE }

Detection condition:
$a at pe.entry_point

Full rule:
rule CRYPACK_v30_Hint_DOS_EP: PEiD
{
    strings:
        $a = { EB ?? 06 1E 8C D8 05 ?? ?? 8E D8 33 DB 0E 07 33 FF BE ?? ?? 8A 07 26 ?? ?? 32 C4 88 07 47 3B FE }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: VBOX_v43_v46
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 }
        $b = { ?? ?? ?? ?? 90 03 C4 33 C4 33 C5 2B C5 33 C5 8B C5 ?? ?? 2B C5 48 ?? ?? 0B C0 86 E0 8C E0 ?? ?? 8C E0 86 E0 03 C4 40 }
        $c = { 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule VBOX_v43_v46: PEiD
{
    strings:
        $a = { 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 8B C5 }
        $b = { ?? ?? ?? ?? 90 03 C4 33 C4 33 C5 2B C5 33 C5 8B C5 ?? ?? 2B C5 48 ?? ?? 0B C0 86 E0 8C E0 ?? ?? 8C E0 86 E0 03 C4 40 }
        $c = { 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 8B C4 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: USERNAME_v300_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? E8 ?? ?? 5D 83 ?? ?? FA FC 33 F6 8E DE BF ?? ?? 03 FD B9 ?? ?? F3 A4 8B FC }

Detection condition:
$a at pe.entry_point

Full rule:
rule USERNAME_v300_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? E8 ?? ?? 5D 83 ?? ?? FA FC 33 F6 8E DE BF ?? ?? 03 FD B9 ?? ?? F3 A4 8B FC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Windows_9x_registry_file_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 43 52 45 47 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Windows_9x_registry_file_Hint_FILE_START: PEiD
{
    strings:
        $a = { 43 52 45 47 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PENinja_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 90 90 90 90 90 90 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ?? ?? 24 ?? 3A C4 90 90 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PENinja_additional: PEiD
{
    strings:
        $a = { 90 90 90 90 90 90 90 06 B8 ?? ?? 8E C0 B9 ?? ?? 26 ?? ?? ?? ?? 80 ?? ?? 26 ?? ?? ?? 24 ?? 3A C4 90 90 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Obsidium_1333_Obsidium_Software_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsidium_1333_Obsidium_Software_additional: PEiD
{
    strings:
        $a = { EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 28 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Obsidium_1338_Obsidium_Software_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 ?? EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 01 ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 57 27 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsidium_1338_Obsidium_Software_additional: PEiD
{
    strings:
        $a = { EB 04 ?? ?? ?? ?? E8 28 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 ?? EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 01 ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 02 ?? ?? EB 04 ?? ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 57 27 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_CodeSafe_20
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_CodeSafe_20: PEiD
{
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXECryptor_V21X_softcompletecom
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 C6 14 8B 55 FC E9 ?? FF FF FF }
        $b = { E9 ?? ?? ?? ?? 66 9C 60 50 8D 88 ?? ?? ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule EXECryptor_V21X_softcompletecom: PEiD
{
    strings:
        $a = { 83 C6 14 8B 55 FC E9 ?? FF FF FF }
        $b = { E9 ?? ?? ?? ?? 66 9C 60 50 8D 88 ?? ?? ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: MSLRH_v032a_fake_ASPack_212_emadicius
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 A0 02 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
        $b = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 73 00 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule MSLRH_v032a_fake_ASPack_212_emadicius: PEiD
{
    strings:
        $a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 A0 02 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
        $b = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 73 00 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: EXEPACK_LINK_v360_v364_v365_or_50121_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 ?? ?? ?? 8E C0 8B ?? ?? ?? 8B ?? 4F 8B F7 FD F3 A4 50 B8 ?? ?? 50 CB }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXEPACK_LINK_v360_v364_v365_or_50121_additional: PEiD
{
    strings:
        $a = { 8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 ?? ?? ?? 8E C0 8B ?? ?? ?? 8B ?? 4F 8B F7 FD F3 A4 50 B8 ?? ?? 50 CB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: NSPack_3x_Liu_Xing_Ping
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF ?? 38 01 0F 84 ?? 02 00 00 ?? 00 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule NSPack_3x_Liu_Xing_Ping: PEiD
{
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? FF FF ?? 38 01 0F 84 ?? 02 00 00 ?? 00 01 }
    condition:
        $a at pe.entry_point

}