deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: StarForce_Protection_Technology
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule StarForce_Protection_Technology: PEiD
{
    strings:
        $a = { 68 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: JPEG_GIF_library_file
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 05 16 07 00 02 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule JPEG_GIF_library_file: PEiD
{
    strings:
        $a = { 00 05 16 07 00 02 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_v120_Eng_dulekxt_Borland_Cpp
Repository: Yara-Rules/rules

Pattern signatures:
$a = { C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6 }
        $b = { C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6 EB 02 56 7B 2A D3 E8 01 00 00 00 ED 58 88 16 13 C3 46 EB 02 CD 20 4B EB 02 CD 20 2B C9 3B D9 75 A1 E8 02 00 00 00 D7 6B 58 EB 00 9E 96 6A 28 67 AB 69 54 03 3E 7F ?? ?? ?? 31 0D 63 44 35 38 37 18 87 9F 10 8C 37 C6 41 80 4C 5E 8B DB 60 4C 3A 28 08 30 BF 93 05 D1 58 13 2D B8 86 AE C8 58 16 A6 95 C5 94 03 33 6F FF 92 20 98 87 9C E5 B9 20 B5 68 DE 16 4A 15 C1 7F 72 71 65 3E A9 85 20 AF 5A 59 54 26 66 E9 3F 27 DE 8E 7D 34 53 61 F7 AF 09 29 5C F7 36 83 60 5F 52 92 5C D

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule FSG_v120_Eng_dulekxt_Borland_Cpp: PEiD
{
    strings:
        $a = { C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6 }
        $b = { C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6 EB 02 56 7B 2A D3 E8 01 00 00 00 ED 58 88 16 13 C3 46 EB 02 CD 20 4B EB 02 CD 20 2B C9 3B D9 75 A1 E8 02 00 00 00 D7 6B 58 EB 00 9E 96 6A 28 67 AB 69 54 03 3E 7F ?? ?? ?? 31 0D 63 44 35 38 37 18 87 9F 10 8C 37 C6 41 80 4C 5E 8B DB 60 4C 3A 28 08 30 BF 93 05 D1 58 13 2D B8 86 AE C8 58 16 A6 95 C5 94 03 33 6F FF 92 20 98 87 9C E5 B9 20 B5 68 DE 16 4A 15 C1 7F 72 71 65 3E A9 85 20 AF 5A 59 54 26 66 E9 3F 27 DE 8E 7D 34 53 61 F7 AF 09 29 5C F7 36 83 60 5F 52 92 5C D0 56 55 C9 61 7A FD EF 7E E8 70 F8 6E 7B EF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: aPack_058_082_1_EXE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 1E 06 8C C8 8E D8 05 00 00 8E C0 50 BE 00 00 33 FF FC B6 01 BD }

Detection condition:
$a at pe.entry_point

Full rule:
rule aPack_058_082_1_EXE: PEiD
{
    strings:
        $a = { 1E 06 8C C8 8E D8 05 00 00 8E C0 50 BE 00 00 33 FF FC B6 01 BD }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RLPack_V121_Dll_LZMA_430_ap0x_20080504
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 80 7C 24 08 01 0F 85 AF 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 E0 0C 00 00 EB 0C 8B 85 DC 0C 00 00 89 85 E0 0C 00 00 E8 87 01 00 00 8D B5 08 0D 00 00 8D 9D C6 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 71 0C 00 00 89 85 D8 0C 00 00 E8 98 01 00 00 EB 20 60 8B 85 E0 0C 00 00 FF B5 D8 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD EC 0C 00 00 00 74 0E 83 BD F0 0C 00 00 00 74 05 E8 31 02 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 71 0C 00 00 89 85 04 0D 00 00 5B 60 FF B5 D8 0C 00 00 56 FF B5 04 0D 00 00 FF D3 61 8B B5 04 0D 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD E0 0C 00 00 83 C0 04 89 85 00 0D 00 00 EB 72 56 FF 95 69 0C 00 00 0B C0 75 05 E8 25 03 00 00 85 C0 0F 84 AC 00 00 00 89 85 FC 0C 00 00 8B C6 EB 2E 8B 85 00 0D 00 00 8B 00 50 FF B5 FC 0C 00 00 E8 6D 02 00 00 85 C0 0F 84 86 00 00 00 89 07 83 85 00 0D 00 00 04 83 C7 04 8B 85 00 0D 00 

Detection condition:
$a at pe.entry_point

Full rule:
rule RLPack_V121_Dll_LZMA_430_ap0x_20080504: PEiD
{
    strings:
        $a = { 80 7C 24 08 01 0F 85 AF 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 E0 0C 00 00 EB 0C 8B 85 DC 0C 00 00 89 85 E0 0C 00 00 E8 87 01 00 00 8D B5 08 0D 00 00 8D 9D C6 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 71 0C 00 00 89 85 D8 0C 00 00 E8 98 01 00 00 EB 20 60 8B 85 E0 0C 00 00 FF B5 D8 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD EC 0C 00 00 00 74 0E 83 BD F0 0C 00 00 00 74 05 E8 31 02 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 71 0C 00 00 89 85 04 0D 00 00 5B 60 FF B5 D8 0C 00 00 56 FF B5 04 0D 00 00 FF D3 61 8B B5 04 0D 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD E0 0C 00 00 83 C0 04 89 85 00 0D 00 00 EB 72 56 FF 95 69 0C 00 00 0B C0 75 05 E8 25 03 00 00 85 C0 0F 84 AC 00 00 00 89 85 FC 0C 00 00 8B C6 EB 2E 8B 85 00 0D 00 00 8B 00 50 FF B5 FC 0C 00 00 E8 6D 02 00 00 85 C0 0F 84 86 00 00 00 89 07 83 85 00 0D 00 00 04 83 C7 04 8B 85 00 0D 00 00 83 38 00 75 CD EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD E0 0C 00 00 83 C0 04 89 85 00 0D 00 00 80 3E 01 75 89 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 04 0D 00 00 FF 95 75 0C 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 04 0D 00 00 FF 95 75 0C 00 00 68 ?? ?? ?? ?? 6A 00 FF B5 D8 0C 00 00 FF 95 75 0C 00 00 E8 A0 00 00 00 E8 9B 01 00 00 61 E9 ?? ?? ?? ?? ?? 61 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PGPROT_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? 2E ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 0E 1F 8C C0 01 ?? ?? ?? 01 ?? ?? ?? 26 ?? ?? ?? ?? 07 32 C0 33 FF B9 ?? ?? F2 AE }

Detection condition:
$a at pe.entry_point

Full rule:
rule PGPROT_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? 2E ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 0E 1F 8C C0 01 ?? ?? ?? 01 ?? ?? ?? 26 ?? ?? ?? ?? 07 32 C0 33 FF B9 ?? ?? F2 AE }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASPack_212b_Solodovnikov_Alexey
Repository: Yara-Rules/rules

Pattern signatures:
$a = { ?? 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB EC FF FF FF 03 DD 81 EB 00 ?? ?? 00 83 BD 22 04 00 00 00 89 9D 22 04 00 00 0F 85 65 03 00 00 8D 85 2E 04 00 00 50 FF 95 4C 0F 00 00 89 85 26 04 00 00 8B F8 8D 5D 5E 53 50 FF 95 48 0F 00 00 89 85 4C 05 00 00 8D 5D 6B 53 57 FF 95 48 0F }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASPack_212b_Solodovnikov_Alexey: PEiD
{
    strings:
        $a = { ?? 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB EC FF FF FF 03 DD 81 EB 00 ?? ?? 00 83 BD 22 04 00 00 00 89 9D 22 04 00 00 0F 85 65 03 00 00 8D 85 2E 04 00 00 50 FF 95 4C 0F 00 00 89 85 26 04 00 00 8B F8 8D 5D 5E 53 50 FF 95 48 0F 00 00 89 85 4C 05 00 00 8D 5D 6B 53 57 FF 95 48 0F }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Nullsoft_Install_System_v1xx
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00 }
        $b = { 55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00 56 56 56 89 75 E4 E8 C1 C9 FF FF 8B 1D 68 70 40 00 83 C4 0C 89 45 E8 89 75 F0 6A 02 56 6A FC 57 FF D3 89 45 FC 8D 45 F8 56 50 8D 45 E4 6A 04 50 57 FF 15 48 70 40 00 85 C0 75 07 BB 7C 9E 40 00 EB 7A 56 56 56 57 FF D3 39 75 FC 7E 62 BF 74 A2 40 00 B8 00 10 00 00 39 45 FC 7F 03 8B 45 FC 8D 4D F8 56 51 50 57 FF 75 EC FF 15 48 70 40 00 85 C0 74 5A FF 75 F8 57 FF 75 E8 E8 4D C9 FF FF 89 45 E8 8B 45 F8 29 45 FC 83 C4 0C 39 75 F4 75 11 57 E8 D3 F9 FF FF 85 C0 59 74 06 8

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Nullsoft_Install_System_v1xx: PEiD
{
    strings:
        $a = { 55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00 }
        $b = { 55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00 56 56 56 89 75 E4 E8 C1 C9 FF FF 8B 1D 68 70 40 00 83 C4 0C 89 45 E8 89 75 F0 6A 02 56 6A FC 57 FF D3 89 45 FC 8D 45 F8 56 50 8D 45 E4 6A 04 50 57 FF 15 48 70 40 00 85 C0 75 07 BB 7C 9E 40 00 EB 7A 56 56 56 57 FF D3 39 75 FC 7E 62 BF 74 A2 40 00 B8 00 10 00 00 39 45 FC 7F 03 8B 45 FC 8D 4D F8 56 51 50 57 FF 75 EC FF 15 48 70 40 00 85 C0 74 5A FF 75 F8 57 FF 75 E8 E8 4D C9 FF FF 89 45 E8 8B 45 F8 29 45 FC 83 C4 0C 39 75 F4 75 11 57 E8 D3 F9 FF FF 85 C0 59 74 06 8B 45 F0 89 45 F4 8B 45 F8 01 45 F0 39 75 FC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: USCC_v14_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? 60 BB ?? ?? B9 ?? ?? 30 0F 43 E2 ?? 5D F5 F5 FC EF EE FA 4B 9E }

Detection condition:
$a at pe.entry_point

Full rule:
rule USCC_v14_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? 60 BB ?? ?? B9 ?? ?? 30 0F 43 E2 ?? 5D F5 F5 FC EF EE FA 4B 9E }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _22b_Shoooo
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 11 55 07 8B EC B8 14 80 0E 03 E8 D1 09 00 0A 57 33 D2 FF 75 18 B9 E8 1F DE 16 81 C0 8D BD EE 7F FB F8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _22b_Shoooo: PEiD
{
    strings:
        $a = { 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 11 55 07 8B EC B8 14 80 0E 03 E8 D1 09 00 0A 57 33 D2 FF 75 18 B9 E8 1F DE 16 81 C0 8D BD EE 7F FB F8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UCEXE_v23_v24_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 1E 0E 1F FC 33 F6 E8 ?? ?? 16 07 33 F6 33 FF B9 ?? ?? F3 A5 06 B8 ?? ?? 50 CB }

Detection condition:
$a at pe.entry_point

Full rule:
rule UCEXE_v23_v24_additional: PEiD
{
    strings:
        $a = { 50 1E 0E 1F FC 33 F6 E8 ?? ?? 16 07 33 F6 33 FF B9 ?? ?? F3 A5 06 B8 ?? ?? 50 CB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_XPEH4768
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? 5B 81 ?? ?? ?? 50 56 57 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B8 01 00 50 B8 ?? ?? 50 E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_XPEH4768: PEiD
{
    strings:
        $a = { E8 ?? ?? 5B 81 ?? ?? ?? 50 56 57 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B8 01 00 50 B8 ?? ?? 50 E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: nPack_112502006Beta_NEOxuinC
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule nPack_112502006Beta_NEOxuinC: PEiD
{
    strings:
        $a = { 83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXE_Liuli
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 53 03 00 00 8B F0 56 56 E8 98 03 00 00 8B C8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXE_Liuli: PEiD
{
    strings:
        $a = { E8 53 03 00 00 8B F0 56 56 E8 98 03 00 00 8B C8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Berio_100_beta
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 01 12 00 00 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 B0 01 00 83 BD 22 04 00 00 00 89 9D 22 04 00 00 0F 85 65 03 00 00 8D 85 2E 04 00 00 50 FF 95 4D 0F }

Detection condition:
$a at pe.entry_point

Full rule:
rule Berio_100_beta: PEiD
{
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 01 12 00 00 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 B0 01 00 83 BD 22 04 00 00 00 89 9D 22 04 00 00 0F 85 65 03 00 00 8D 85 2E 04 00 00 50 FF 95 4D 0F }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: nCrypt_1x_Cryptor_InterFac_NEG
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 95 00 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 F1 BB 00 10 40 00 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB 00 00 00 00 75 05 BB 00 00 00 00 8A 23 30 C4 88 23 43 81 FB ?? ?? ?? ?? 75 89 1E 68 ?? ?? ?? ?? C3 BA C9 ?? ?? ?? 0F 10 02 BA 06 ?? ?? ?? 0F 11 02 BA ?? ?? ?? ?? 0F 10 02 BA ?? ?? ?? ?? 0F 11 02 64 8B 0D 20 00 00 00 EB 01 C? }

Detection condition:
$a at pe.entry_point

Full rule:
rule nCrypt_1x_Cryptor_InterFac_NEG: PEiD
{
    strings:
        $a = { E9 95 00 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 F1 BB 00 10 40 00 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB ?? ?? ?? ?? 75 05 BB ?? ?? ?? ?? 81 FB 00 00 00 00 75 05 BB 00 00 00 00 8A 23 30 C4 88 23 43 81 FB ?? ?? ?? ?? 75 89 1E 68 ?? ?? ?? ?? C3 BA C9 ?? ?? ?? 0F 10 02 BA 06 ?? ?? ?? 0F 11 02 BA ?? ?? ?? ?? 0F 10 02 BA ?? ?? ?? ?? 0F 11 02 64 8B 0D 20 00 00 00 EB 01 C? }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_02_ExeSmasher_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_02_ExeSmasher_Anorganix: PEiD
{
    strings:
        $a = { 9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MSLRH_032a_fake_WWPack32_1x_emadicius
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 20 64 65 63 6F 6D 70 72 65 73 73 69 6F 6E 20 72 6F 75 74 69 6E 65 20 76 65 72 73 69 6F 6E 20 31 2E 31 32 0D 0A 28 63 29 20 31 39 39 38 20 50 69 6F 74 72 20 57 61 72 65 7A 61 6B 20 61 6E 64 20 52 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MSLRH_032a_fake_WWPack32_1x_emadicius: PEiD
{
    strings:
        $a = { 53 55 8B E8 33 DB EB 60 0D 0A 0D 0A 57 57 50 61 63 6B 33 32 20 64 65 63 6F 6D 70 72 65 73 73 69 6F 6E 20 72 6F 75 74 69 6E 65 20 76 65 72 73 69 6F 6E 20 31 2E 31 32 0D 0A 28 63 29 20 31 39 39 38 20 50 69 6F 74 72 20 57 61 72 65 7A 61 6B 20 61 6E 64 20 52 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: tElock_v042
Repository: Yara-Rules/rules

Pattern signatures:
$a = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 52 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08 }

Detection condition:
$a at pe.entry_point

Full rule:
rule tElock_v042: PEiD
{
    strings:
        $a = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 52 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Shrink_v20_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? 50 9C FC BE ?? ?? 8B FE 8C C8 05 ?? ?? 8E C0 06 57 B9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Shrink_v20_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? 50 9C FC BE ?? ?? 8B FE 8C C8 05 ?? ?? 8E C0 06 57 B9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_Visual_Cpp_v50
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 24 ?? 8B 24 }
        $b = { 55 8B EC 6A FF 68 68 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 53 56 57 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Microsoft_Visual_Cpp_v50: PEiD
{
    strings:
        $a = { 24 ?? 8B 24 }
        $b = { 55 8B EC 6A FF 68 68 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 53 56 57 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: RJ_Crush_110
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 06 FC 8C C8 BA 00 00 03 D0 52 BA 00 00 52 BA 00 00 03 C2 8B D8 05 00 00 8E DB 8E C0 33 F6 33 FF B9 08 00 F3 A5 4B 48 4A 79 EE 8E D8 8E C3 BE 47 00 AD 8B E8 B2 10 CB FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule RJ_Crush_110: PEiD
{
    strings:
        $a = { 06 FC 8C C8 BA 00 00 03 D0 52 BA 00 00 52 BA 00 00 03 C2 8B D8 05 00 00 8E DB 8E C0 33 F6 33 FF B9 08 00 F3 A5 4B 48 4A 79 EE 8E D8 8E C3 BE 47 00 AD 8B E8 B2 10 CB FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_DxPack_10_Anorganix_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_DxPack_10_Anorganix_additional: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Password_Protector_c_MiniSoft_1992_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 06 0E 0E 07 1F E8 00 00 5B 83 EB 08 BA 27 01 03 D3 E8 3C 02 BA EA }

Detection condition:
$a at pe.entry_point

Full rule:
rule Password_Protector_c_MiniSoft_1992_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 06 0E 0E 07 1F E8 00 00 5B 83 EB 08 BA 27 01 03 D3 E8 3C 02 BA EA }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Gardian_Angel_10_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 06 8C C8 8E D8 8E C0 FC BF ?? ?? EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule Gardian_Angel_10_additional: PEiD
{
    strings:
        $a = { 06 8C C8 8E D8 8E C0 FC BF ?? ?? EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: eXpressor_v11_CGSoftLabs_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 12 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 FB FF FF FF C3 68 ?? ?? ?? ?? 64 FF 35 }

Detection condition:
$a at pe.entry_point

Full rule:
rule eXpressor_v11_CGSoftLabs_additional: PEiD
{
    strings:
        $a = { E9 12 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 FB FF FF FF C3 68 ?? ?? ?? ?? 64 FF 35 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_v094_Jeremy_Collake
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 ?? ?? ?? ?? 5D 55 58 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 01 85 ?? ?? ?? ?? 50 B9 02 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_v094_Jeremy_Collake: PEiD
{
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 ?? ?? ?? ?? 5D 55 58 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 01 85 ?? ?? ?? ?? 50 B9 02 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: REC_C0ded_by_ROSE_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 06 1E 0E 0E 07 1F B4 30 CD 21 86 E0 3D 00 03 73 ?? CD 20 EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule REC_C0ded_by_ROSE_additional: PEiD
{
    strings:
        $a = { 06 1E 0E 0E 07 1F B4 30 CD 21 86 E0 3D 00 03 73 ?? CD 20 EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_02_Borland_Delphi_DLL
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 B4 B8 90 90 90 90 E8 00 00 00 00 E8 00 00 00 00 8D 40 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_02_Borland_Delphi_DLL: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 B4 B8 90 90 90 90 E8 00 00 00 00 E8 00 00 00 00 8D 40 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Ding_Boys_PE_lock_Phantasm_v10_v11_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 57 56 52 51 53 66 81 C3 EB 02 EB FC 66 81 C3 EB 02 EB FC }

Detection condition:
$a at pe.entry_point

Full rule:
rule Ding_Boys_PE_lock_Phantasm_v10_v11_additional: PEiD
{
    strings:
        $a = { 55 57 56 52 51 53 66 81 C3 EB 02 EB FC 66 81 C3 EB 02 EB FC }
    condition:
        $a at pe.entry_point

}