deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: UPX_Shit_05_snaker
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 83 F9 00 7E 06 80 30 ?? 40 E2 F5 E9 ?? ?? ?? FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPX_Shit_05_snaker: PEiD
{
    strings:
        $a = { B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 83 F9 00 7E 06 80 30 ?? 40 E2 F5 E9 ?? ?? ?? FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: DBPE_233
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 }

Detection condition:
$a at pe.entry_point

Full rule:
rule DBPE_233: PEiD
{
    strings:
        $a = { EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: App_Protector_Silent_Team_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 97 00 00 00 0D 0A 53 69 6C 65 6E 74 20 54 65 61 6D 20 41 70 70 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 72 65 61 74 65 64 20 62 79 20 53 69 6C 65 6E 74 20 53 6F 66 74 77 61 72 65 0D 0A 54 68 65 6E 6B 7A 20 74 6F 20 44 6F 63 68 74 6F 72 20 58 0D 0A 0D 0A }

Detection condition:
$a at pe.entry_point

Full rule:
rule App_Protector_Silent_Team_additional: PEiD
{
    strings:
        $a = { E9 97 00 00 00 0D 0A 53 69 6C 65 6E 74 20 54 65 61 6D 20 41 70 70 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 72 65 61 74 65 64 20 62 79 20 53 69 6C 65 6E 74 20 53 6F 66 74 77 61 72 65 0D 0A 54 68 65 6E 6B 7A 20 74 6F 20 44 6F 63 68 74 6F 72 20 58 0D 0A 0D 0A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Unknown_packer_03_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 06 1E 57 56 50 53 51 52 BD ?? ?? 0E 1F 8C }

Detection condition:
$a at pe.entry_point

Full rule:
rule Unknown_packer_03_additional: PEiD
{
    strings:
        $a = { 06 1E 57 56 50 53 51 52 BD ?? ?? 0E 1F 8C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: aPack_082_COM
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8C C8 80 C4 10 8E C0 FC B9 00 00 BE 00 01 8B FE 57 F3 A5 5F BE BC 01 06 68 20 01 1E 07 8E D8 CB 06 57 B6 01 BD 89 01 FF D5 73 5B FF D5 73 1C FF D5 73 3D BB A0 01 33 C9 FF D3 FF D3 FF D3 FF D3 8B D9 B1 01 85 DB 75 34 93 EB 36 E8 46 00 49 49 }

Detection condition:
$a at pe.entry_point

Full rule:
rule aPack_082_COM: PEiD
{
    strings:
        $a = { 8C C8 80 C4 10 8E C0 FC B9 00 00 BE 00 01 8B FE 57 F3 A5 5F BE BC 01 06 68 20 01 1E 07 8E D8 CB 06 57 B6 01 BD 89 01 FF D5 73 5B FF D5 73 1C FF D5 73 3D BB A0 01 33 C9 FF D3 FF D3 FF D3 FF D3 8B D9 B1 01 85 DB 75 34 93 EB 36 E8 46 00 49 49 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AsCrypt_v01_SToRM_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 ?? ?? E2 ?? ?? E2 ?? FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule AsCrypt_v01_SToRM_additional: PEiD
{
    strings:
        $a = { 83 ?? ?? E2 ?? ?? E2 ?? FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_125
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 00 87 DD 8B 85 A6 70 40 00 01 85 03 70 40 00 66 C7 85 00 70 40 00 90 90 01 85 9E 70 40 00 BB F3 0D 00 00 03 9D AA 70 40 00 03 9D A6 70 40 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_125: PEiD
{
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 00 87 DD 8B 85 A6 70 40 00 01 85 03 70 40 00 66 C7 85 00 70 40 00 90 90 01 85 9E 70 40 00 BB F3 0D 00 00 03 9D AA 70 40 00 03 9D A6 70 40 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PluginToExe_v102_BoB_BobSoft_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 00 00 00 00 29 C0 5D 81 ED 32 42 40 00 50 8F 85 DD 40 40 00 50 FF 95 11 42 40 00 89 85 D9 40 40 00 FF 95 0D 42 40 00 50 FF 95 21 42 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 25 42 40 00 89 85 E1 40 40 00 EB 6C 6A 01 8F 85 DD 40 40 00 6A 58 6A }

Detection condition:
$a at pe.entry_point

Full rule:
rule PluginToExe_v102_BoB_BobSoft_additional: PEiD
{
    strings:
        $a = { E8 00 00 00 00 29 C0 5D 81 ED 32 42 40 00 50 8F 85 DD 40 40 00 50 FF 95 11 42 40 00 89 85 D9 40 40 00 FF 95 0D 42 40 00 50 FF 95 21 42 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 25 42 40 00 89 85 E1 40 40 00 EB 6C 6A 01 8F 85 DD 40 40 00 6A 58 6A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_122
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 00 87 DD 8B 85 A6 70 40 00 01 85 03 70 40 00 66 C7 85 00 70 40 00 90 90 01 85 9E 70 40 00 BB F3 08 00 00 03 9D AA 70 40 00 03 9D A6 70 40 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_122: PEiD
{
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 00 87 DD 8B 85 A6 70 40 00 01 85 03 70 40 00 66 C7 85 00 70 40 00 90 90 01 85 9E 70 40 00 BB F3 08 00 00 03 9D AA 70 40 00 03 9D A6 70 40 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Banners_banner_file_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { D1 BA 01 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Banners_banner_file_Hint_FILE_START: PEiD
{
    strings:
        $a = { D1 BA 01 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RLPack_v118_Basic_LZMA_Ap0x
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A }

Detection condition:
$a at pe.entry_point

Full rule:
rule RLPack_v118_Basic_LZMA_Ap0x: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 21 0B 00 00 8D 9D FF 02 00 00 33 FF E8 9F 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 AA 0A 00 00 89 85 F9 0A 00 00 EB 14 60 FF B5 F9 0A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_v133_dulekxt
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_v133_dulekxt: PEiD
{
    strings:
        $a = { BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FreeJoiner_Small_build_023_GlOFF
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 E1 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }
        $b = { E8 E1 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule FreeJoiner_Small_build_023_GlOFF: PEiD
{
    strings:
        $a = { E8 E1 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }
        $b = { E8 E1 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: The_aPE_Inline_Patch_Basic_Advanced_Stealth_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B9 ?? ?? ?? 00 E8 ?? ?? 00 00 89 01 68 }

Detection condition:
$a at pe.entry_point

Full rule:
rule The_aPE_Inline_Patch_Basic_Advanced_Stealth_additional: PEiD
{
    strings:
        $a = { B9 ?? ?? ?? 00 E8 ?? ?? 00 00 89 01 68 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_PE_Pack_099
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_PE_Pack_099: PEiD
{
    strings:
        $a = { 60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Windows_9x_User_password_file_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E3 82 85 96 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Windows_9x_User_password_file_Hint_FILE_START: PEiD
{
    strings:
        $a = { E3 82 85 96 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Thunderbolt_V002_deXep_forgot
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 E8 AA 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Thunderbolt_V002_deXep_forgot: PEiD
{
    strings:
        $a = { E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 E8 AA 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ACProtect_109g_Risco_software_Inc
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 F9 50 E8 01 00 00 00 7C 58 58 49 50 E8 01 00 00 00 7E 58 58 79 04 66 B9 B8 72 E8 01 00 00 00 7A 83 C4 04 85 C8 EB 01 EB C1 F8 BE 72 03 73 01 74 0F 81 01 00 00 00 F9 EB 01 75 F9 E8 01 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ACProtect_109g_Risco_software_Inc: PEiD
{
    strings:
        $a = { 60 F9 50 E8 01 00 00 00 7C 58 58 49 50 E8 01 00 00 00 7E 58 58 79 04 66 B9 B8 72 E8 01 00 00 00 7A 83 C4 04 85 C8 EB 01 EB C1 F8 BE 72 03 73 01 74 0F 81 01 00 00 00 F9 EB 01 75 F9 E8 01 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_02_PEX_099_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_02_PEX_099_Anorganix: PEiD
{
    strings:
        $a = { 60 E8 01 00 00 00 55 83 C4 04 E8 01 00 00 00 90 5D 81 FF FF FF 00 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_v110_Eng_dulekxt_Borland_Cpp
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_v110_Eng_dulekxt_Borland_Cpp: PEiD
{
    strings:
        $a = { 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_01_REALBasic_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_01_REALBasic_Anorganix: PEiD
{
    strings:
        $a = { 55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AVP_Inspector_Database_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 47 68 6F 73 74 20 42 75 73 74 65 72 }

Detection condition:
$a at pe.entry_point

Full rule:
rule AVP_Inspector_Database_additional: PEiD
{
    strings:
        $a = { 47 68 6F 73 74 20 42 75 73 74 65 72 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PKLITE_v112_v115_v120_2_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? BA ?? ?? 3B C4 73 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PKLITE_v112_v115_v120_2_additional: PEiD
{
    strings:
        $a = { B8 ?? ?? BA ?? ?? 3B C4 73 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RLPack_116_aPLib_compression_ap0x_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 E8 02 00 00 89 85 4F 03 00 00 5B FF B5 4F 03 00 00 56 FF D3 83 C4 08 8B B5 4F 03 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 E8 CD 00 00 00 83 C0 04 89 85 4B 03 00 00 E9 93 00 00 00 56 FF 95 E0 02 00 00 85 C0 0F 84 AE 00 00 00 89 85 47 03 00 00 8B C6 EB 5B 8B 85 4B 03 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 4B 03 00 00 C7 00 20 20 20 00 EB 06 FF B5 4B 03 00 00 FF B5 47 03 00 00 FF 95 E4 02 00 00 85 C0 74 6B 89 07 83 C7 04 8B }

Detection condition:
$a at pe.entry_point

Full rule:
rule RLPack_116_aPLib_compression_ap0x_h: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 E8 02 00 00 89 85 4F 03 00 00 5B FF B5 4F 03 00 00 56 FF D3 83 C4 08 8B B5 4F 03 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 E8 CD 00 00 00 83 C0 04 89 85 4B 03 00 00 E9 93 00 00 00 56 FF 95 E0 02 00 00 85 C0 0F 84 AE 00 00 00 89 85 47 03 00 00 8B C6 EB 5B 8B 85 4B 03 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 4B 03 00 00 C7 00 20 20 20 00 EB 06 FF B5 4B 03 00 00 FF B5 47 03 00 00 FF 95 E4 02 00 00 85 C0 74 6B 89 07 83 C7 04 8B }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: kryptor_9_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 ?? ?? ?? ?? 5E B9 ?? ?? ?? ?? 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 ?? 66 B9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule kryptor_9_additional: PEiD
{
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5E B9 ?? ?? ?? ?? 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 ?? 66 B9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_TrojanTelefoon
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 1E E8 3B 01 BF CC 01 2E 03 3E CA 01 2E C7 05 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_TrojanTelefoon: PEiD
{
    strings:
        $a = { 60 1E E8 3B 01 BF CC 01 2E 03 3E CA 01 2E C7 05 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SLR_OPTLINK
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BF ?? ?? 8E DF FA 8E D7 81 C4 ?? ?? FB B4 30 CD 21 }

Detection condition:
$a at pe.entry_point

Full rule:
rule SLR_OPTLINK: PEiD
{
    strings:
        $a = { BF ?? ?? 8E DF FA 8E D7 81 C4 ?? ?? FB B4 30 CD 21 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MSLRH_032a_fake_Neolite_20_emadicius
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 A6 00 00 00 B0 7B 40 00 78 60 40 00 7C 60 40 00 00 00 00 00 B0 3F 00 00 12 62 40 00 4E 65 6F 4C 69 74 65 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 43 6F 6D 70 72 65 73 73 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 38 2C 31 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MSLRH_032a_fake_Neolite_20_emadicius: PEiD
{
    strings:
        $a = { E9 A6 00 00 00 B0 7B 40 00 78 60 40 00 7C 60 40 00 00 00 00 00 B0 3F 00 00 12 62 40 00 4E 65 6F 4C 69 74 65 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 43 6F 6D 70 72 65 73 73 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 39 38 2C 31 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Copy_Protector_v20
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 2E A2 ?? ?? 53 51 52 1E 06 B4 ?? 1E 0E 1F BA ?? ?? CD 21 1F }

Detection condition:
$a at pe.entry_point

Full rule:
rule Copy_Protector_v20: PEiD
{
    strings:
        $a = { 2E A2 ?? ?? 53 51 52 1E 06 B4 ?? 1E 0E 1F BA ?? ?? CD 21 1F }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Splice_11_by_Tw1sted_L0gic_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 00 1A 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 ?? ?? ?? ?? ?? ?? 50 72 6F 6A 65 63 74 31 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 06 00 00 00 AC 29 40 00 07 00 00 00 BC 28 40 00 07 00 00 00 74 28 40 00 07 00 00 00 2C 28 40 00 07 00 00 00 08 23 40 00 01 00 00 00 38 21 40 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 8C 21 40 00 08 ?? 40 00 01 00 00 00 AC 19 40 00 00 00 00 00 00 00 00 00 00 00 00 00 AC 19 40 00 4F 00 43 00 50 00 00 00 E7 AF 58 2F 9A 4C 17 4D B7 A9 CA 3E 57 6F F7 76 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Splice_11_by_Tw1sted_L0gic_additional: PEiD
{
    strings:
        $a = { 68 00 1A 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 ?? ?? ?? ?? ?? ?? 50 72 6F 6A 65 63 74 31 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 06 00 00 00 AC 29 40 00 07 00 00 00 BC 28 40 00 07 00 00 00 74 28 40 00 07 00 00 00 2C 28 40 00 07 00 00 00 08 23 40 00 01 00 00 00 38 21 40 00 00 00 00 00 FF FF FF FF FF FF FF FF 00 00 00 00 8C 21 40 00 08 ?? 40 00 01 00 00 00 AC 19 40 00 00 00 00 00 00 00 00 00 00 00 00 00 AC 19 40 00 4F 00 43 00 50 00 00 00 E7 AF 58 2F 9A 4C 17 4D B7 A9 CA 3E 57 6F F7 76 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SVK_Protector_v132
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 }

Detection condition:
$a at pe.entry_point

Full rule:
rule SVK_Protector_v132: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_v125_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? F3 0D }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_v125_additional: PEiD
{
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? F3 0D }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: DJoin_07_public_xor_encryption_drmist
Repository: Yara-Rules/rules

Pattern signatures:
$a = { C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule DJoin_07_public_xor_encryption_drmist: PEiD
{
    strings:
        $a = { C6 05 ?? ?? 40 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: XPack_V097_LZSS_JoKo
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 ?? ?? ?? 00 9C 60 E8 49 03 00 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 44 ?? ?? 00 34 ?? ?? 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule XPack_V097_LZSS_JoKo: PEiD
{
    strings:
        $a = { 68 ?? ?? ?? 00 9C 60 E8 49 03 00 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 44 ?? ?? 00 34 ?? ?? 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MSLRH_032a_fake_UPX_0896_102_105_124_emadicius_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 64 A0 23 00 00 00 83 C5 06 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MSLRH_032a_fake_UPX_0896_102_105_124_emadicius_additional: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 64 A0 23 00 00 00 83 C5 06 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: NsPacK_V33_LiuXingPing
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 00 74 }

Detection condition:
$a at pe.entry_point

Full rule:
rule NsPacK_V33_LiuXingPing: PEiD
{
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 85 ?? ?? ?? ?? 80 38 00 74 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Password_Protector_c_MiniSoft_1992_Hint_DOS_EP_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? 06 0E 0E 07 1F E8 00 00 5B 83 EB 08 BA 27 01 03 D3 E8 3C 02 BA EA }

Detection condition:
$a at pe.entry_point

Full rule:
rule Password_Protector_c_MiniSoft_1992_Hint_DOS_EP_additional: PEiD
{
    strings:
        $a = { E9 ?? ?? 06 0E 0E 07 1F E8 00 00 5B 83 EB 08 BA 27 01 03 D3 E8 3C 02 BA EA }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Obsidium_1304_Obsidium_Software_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsidium_1304_Obsidium_Software_h: PEiD
{
    strings:
        $a = { EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Obsidium_13017_Obsidium_software_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 02 ?? ?? E8 28 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsidium_13017_Obsidium_software_additional: PEiD
{
    strings:
        $a = { EB 02 ?? ?? E8 28 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_VOB_ProtectCD_5_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 36 3E 26 8A C0 60 E8 00 00 00 00 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_VOB_ProtectCD_5_Anorganix: PEiD
{
    strings:
        $a = { 36 3E 26 8A C0 60 E8 00 00 00 00 E9 }
    condition:
        $a at pe.entry_point

}