deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: ASProtectv12AlexeySolodovnikovh1
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 90 60 E8 1B 00 00 00 E9 FC 8D B5 0F 06 00 00 8B FE B9 97 00 00 00 AD 35 78 56 34 12 AB 49 75 F6 EB 04 5D 45 55 C3 E9 [3] 00 }

Detection condition:
$a0

Full rule:
rule ASProtectv12AlexeySolodovnikovh1
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 90 60 E8 1B 00 00 00 E9 FC 8D B5 0F 06 00 00 8B FE B9 97 00 00 00 AD 35 78 56 34 12 AB 49 75 F6 EB 04 5D 45 55 C3 E9 [3] 00 }

condition:
		$a0
}
YARA Detection Rule: FSGv110EngdulekxtBorlandDelphiMicrosoftVisualCx
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 1B DB E8 02 00 00 00 1A 0D 5B 68 80 [2] 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule FSGv110EngdulekxtBorlandDelphiMicrosoftVisualCx
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 1B DB E8 02 00 00 00 1A 0D 5B 68 80 [2] 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PENightMare2Beta
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E9 [4] EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PENightMare2Beta
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E9 [4] EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: MinGWGCC3x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 [4] E8 [2] FF FF [8] 55 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule MinGWGCC3x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 [4] E8 [2] FF FF [8] 55 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PIRITv15
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B4 4D CD 21 E8 [2] FD E8 [2] B4 51 CD 21 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PIRITv15
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B4 4D CD 21 E8 [2] FD E8 [2] B4 51 CD 21 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Reg2Exe224byJanVorel
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 6A 00 E8 CF 20 00 00 A3 F4 45 40 00 E8 CB 20 00 00 6A 0A 50 6A 00 FF 35 F4 45 40 00 E8 07 00 00 00 50 E8 BB 20 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 F8 45 40 00 E8 06 19 00 00 83 C4 0C 8B 44 24 04 A3 FC 45 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 8C 20 00 00 A3 F8 45 40 00 E8 02 20 00 00 E8 32 1D 00 00 E8 20 19 00 00 E8 A3 16 00 00 68 01 00 00 00 68 38 46 40 00 68 00 00 00 00 8B 15 38 46 40 00 E8 71 4F 00 00 B8 00 00 10 00 BB 01 00 00 00 E8 82 4F 00 00 FF 35 48 41 40 00 B8 00 01 00 00 E8 9D 15 00 00 8D 0D 1C 46 40 00 5A E8 82 16 00 00 68 00 01 00 00 FF 35 1C 46 40 00 E8 24 20 00 00 A3 24 46 40 00 FF 35 48 41 40 00 FF 35 24 46 40 00 FF 35 1C 46 40 00 E8 DC 10 00 00 8D 0D 14 46 40 00 5A E8 4A 16 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Reg2Exe224byJanVorel
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 6A 00 E8 CF 20 00 00 A3 F4 45 40 00 E8 CB 20 00 00 6A 0A 50 6A 00 FF 35 F4 45 40 00 E8 07 00 00 00 50 E8 BB 20 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 F8 45 40 00 E8 06 19 00 00 83 C4 0C 8B 44 24 04 A3 FC 45 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 8C 20 00 00 A3 F8 45 40 00 E8 02 20 00 00 E8 32 1D 00 00 E8 20 19 00 00 E8 A3 16 00 00 68 01 00 00 00 68 38 46 40 00 68 00 00 00 00 8B 15 38 46 40 00 E8 71 4F 00 00 B8 00 00 10 00 BB 01 00 00 00 E8 82 4F 00 00 FF 35 48 41 40 00 B8 00 01 00 00 E8 9D 15 00 00 8D 0D 1C 46 40 00 5A E8 82 16 00 00 68 00 01 00 00 FF 35 1C 46 40 00 E8 24 20 00 00 A3 24 46 40 00 FF 35 48 41 40 00 FF 35 24 46 40 00 FF 35 1C 46 40 00 E8 DC 10 00 00 8D 0D 14 46 40 00 5A E8 4A 16 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SVKProtectorv13xEngPavolCerven
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 [2] 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SVKProtectorv13xEngPavolCerven
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 [2] 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ThinstallEmbedded2609Jitit
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 00 00 00 00 58 BB AD 19 00 00 2B C3 50 68 [4] 68 B0 1C 00 00 68 80 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ThinstallEmbedded2609Jitit
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 58 BB AD 19 00 00 2B C3 50 68 [4] 68 B0 1C 00 00 68 80 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: UPXcrypterarchphaseNWC
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BF [3] 00 81 FF [3] 00 74 10 81 2F ?? 00 00 00 83 C7 04 BB 05 [2] 00 FF E3 BE [3] 00 FF E6 00 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule UPXcrypterarchphaseNWC
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BF [3] 00 81 FF [3] 00 74 10 81 2F ?? 00 00 00 83 C7 04 BB 05 [2] 00 FF E3 BE [3] 00 FF E6 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: StarForceProtectionDriverProtectionTechnology
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 57 68 ?? 0D 01 00 68 00 [2] 00 E8 50 ?? FF FF 68 [3] 00 68 [3] 00 68 [3] 00 68 [3] 00 68 [3] 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule StarForceProtectionDriverProtectionTechnology
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 57 68 ?? 0D 01 00 68 00 [2] 00 E8 50 ?? FF FF 68 [3] 00 68 [3] 00 68 [3] 00 68 [3] 00 68 [3] 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: FishPEV10Xhellfish
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 [4] C3 90 09 00 00 00 2C 00 00 00 [4] C4 03 00 00 BC A0 00 00 00 40 01 00 [4] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 [2] 00 00 [4] 00 00 02 00 00 00 A0 00 00 18 01 00 00 [4] 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 [4] 00 00 00 00 00 00 C0 00 00 40 39 00 00 [4] 00 00 08 00 00 00 00 01 00 C8 06 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule FishPEV10Xhellfish
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 [4] C3 90 09 00 00 00 2C 00 00 00 [4] C4 03 00 00 BC A0 00 00 00 40 01 00 [4] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 [2] 00 00 [4] 00 00 02 00 00 00 A0 00 00 18 01 00 00 [4] 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 [4] 00 00 00 00 00 00 C0 00 00 40 39 00 00 [4] 00 00 08 00 00 00 00 01 00 C8 06 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PECrypter
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D EB 26 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECrypter
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D EB 26 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: tElockv051
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule tElockv051
{
      meta:
		author="malware-lu"
strings:
		$a0 = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 59 EB 01 EB AC 54 E8 03 5C EB 08 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: LY_WGKXwwwszleyucom
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 4D 79 46 75 6E 00 62 73 }

Detection condition:
$a0

Full rule:
rule LY_WGKXwwwszleyucom
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 4D 79 46 75 6E 00 62 73 }

condition:
		$a0
}
YARA Detection Rule: ASProtect13321RegisteredAlexeySolodovnikov
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 68 01 [3] E8 01 00 00 00 C3 C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ASProtect13321RegisteredAlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 01 [3] E8 01 00 00 00 C3 C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RLPackV111ap0x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule RLPackV111ap0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 4A 02 00 00 8D 9D 11 01 00 00 33 FF EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: FSGv110EngdulekxtMicrosoftVisualC4xLCCWin321x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 2C 71 1B CA EB 01 2A EB 01 65 8D 35 80 [2] 00 80 C9 84 80 C9 68 BB F4 00 00 00 EB 01 EB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule FSGv110EngdulekxtMicrosoftVisualC4xLCCWin321x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 2C 71 1B CA EB 01 2A EB 01 65 8D 35 80 [2] 00 80 C9 84 80 C9 68 BB F4 00 00 00 EB 01 EB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: dePACKdeNULL
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 01 DD 60 68 00 [3] 68 [2] 00 00 E8 ?? 00 00 00 }
	$a1 = { EB 01 DD 60 68 00 [3] 68 [3] 00 E8 ?? 00 00 00 [128] D2 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule dePACKdeNULL
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 DD 60 68 00 [3] 68 [2] 00 00 E8 ?? 00 00 00 }
	$a1 = { EB 01 DD 60 68 00 [3] 68 [3] 00 E8 ?? 00 00 00 [128] D2 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: EXECryptorv1401
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 [2] 00 31 C0 89 41 14 89 41 18 80 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EXECryptorv1401
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 [2] 00 31 C0 89 41 14 89 41 18 80 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: MSLRHv032afakePELockNT204emadicius
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 EB EB 03 CD 20 03 61 9D 83 C4 04 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule MSLRHv032afakePELockNT204emadicius
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 EB EB 03 CD 20 03 61 9D 83 C4 04 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PELockNTv203
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 02 C7 85 1E EB 03 CD 20 C7 9C EB 02 69 B1 60 EB 02 EB 01 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PELockNTv203
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 C7 85 1E EB 03 CD 20 C7 9C EB 02 69 B1 60 EB 02 EB 01 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Reg2Exe220221byJanVorel
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 6A 00 E8 7D 12 00 00 A3 A0 44 40 00 E8 79 12 00 00 6A 0A 50 6A 00 FF 35 A0 44 40 00 E8 0F 00 00 00 50 E8 69 12 00 00 CC CC CC CC CC CC CC CC CC 68 2C 02 00 00 68 00 00 00 00 68 B0 44 40 00 E8 3A 12 00 00 83 C4 0C 8B 44 24 04 A3 B8 44 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 32 12 00 00 A3 B0 44 40 00 68 F4 01 00 00 68 BC 44 40 00 FF 35 B8 44 40 00 E8 1E 12 00 00 B8 BC 44 40 00 89 C1 8A 30 40 80 FE 5C 75 02 89 C1 80 FE 00 75 F1 C6 01 00 E8 EC 18 00 00 E8 28 16 00 00 E8 4A 12 00 00 68 00 FA 00 00 68 08 00 00 00 FF 35 B0 44 40 00 E8 E7 11 00 00 A3 B4 44 40 00 8B 15 D4 46 40 00 E8 65 0A 00 00 BB 00 00 10 00 B8 01 00 00 00 E8 72 0A 00 00 74 09 C7 00 01 00 00 00 83 C0 04 A3 D4 46 40 00 FF 35 B4 44 40 00 E8 26 05 00 00 8D 0D B8 46 40 00 5A E8 CF 0F 00 00 FF 35 B4 44 40 00 FF 35 B8 46 40 00 E8 EE 06 00 00 8D 0D B4 46 40 00 5A E8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Reg2Exe220221byJanVorel
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 6A 00 E8 7D 12 00 00 A3 A0 44 40 00 E8 79 12 00 00 6A 0A 50 6A 00 FF 35 A0 44 40 00 E8 0F 00 00 00 50 E8 69 12 00 00 CC CC CC CC CC CC CC CC CC 68 2C 02 00 00 68 00 00 00 00 68 B0 44 40 00 E8 3A 12 00 00 83 C4 0C 8B 44 24 04 A3 B8 44 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 32 12 00 00 A3 B0 44 40 00 68 F4 01 00 00 68 BC 44 40 00 FF 35 B8 44 40 00 E8 1E 12 00 00 B8 BC 44 40 00 89 C1 8A 30 40 80 FE 5C 75 02 89 C1 80 FE 00 75 F1 C6 01 00 E8 EC 18 00 00 E8 28 16 00 00 E8 4A 12 00 00 68 00 FA 00 00 68 08 00 00 00 FF 35 B0 44 40 00 E8 E7 11 00 00 A3 B4 44 40 00 8B 15 D4 46 40 00 E8 65 0A 00 00 BB 00 00 10 00 B8 01 00 00 00 E8 72 0A 00 00 74 09 C7 00 01 00 00 00 83 C0 04 A3 D4 46 40 00 FF 35 B4 44 40 00 E8 26 05 00 00 8D 0D B8 46 40 00 5A E8 CF 0F 00 00 FF 35 B4 44 40 00 FF 35 B8 46 40 00 E8 EE 06 00 00 8D 0D B4 46 40 00 5A E8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PELockNTv201
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 03 CD 20 EB EB 01 EB 1E EB 01 EB EB 02 CD 20 9C EB 03 CD }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PELockNTv201
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 03 CD 20 EB EB 01 EB 1E EB 01 EB EB 02 CD 20 9C EB 03 CD }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PELockNTv204
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB ?? CD [5] CD [5] EB ?? EB ?? EB ?? EB ?? CD [5] E8 [4] E9 [4] 50 C3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PELockNTv204
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB ?? CD [5] CD [5] EB ?? EB ?? EB ?? EB ?? CD [5] E8 [4] E9 [4] 50 C3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: UPXFreakv01BorlandDelphiHMX0101
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE [4] 83 C6 01 FF E6 00 00 00 [3] 00 03 00 00 00 [4] 00 10 00 00 00 00 [4] 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 [3] 00 [3] 00 [3] 00 ?? 24 ?? 00 [3] 00 }
	$a1 = { BE [4] 83 C6 01 FF E6 00 00 00 [3] 00 03 00 00 00 [4] 00 10 00 00 00 00 [4] 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 [3] 00 [3] 00 [3] 00 ?? 24 ?? 00 [3] 00 34 50 45 00 [3] 00 FF FF 00 00 ?? 24 ?? 00 ?? 24 ?? 00 [3] 00 40 00 00 C0 00 00 [4] 00 00 ?? 00 00 00 ?? 1E ?? 00 ?? F7 ?? 00 A6 4E 43 00 ?? 56 ?? 00 AD D1 42 00 ?? F7 ?? 00 A1 D2 42 00 ?? 56 ?? 00 0B 4D 43 00 ?? F7 ?? 00 ?? F7 ?? 00 ?? 56 ?? 00 [5] 00 00 00 [7] 77 [3] 00 [3] 00 [3] 77 [2] 00 00 [3] 00 [6] 00 00 [3] 00 [11] 00 [4] 00 00 00 00 [3] 00 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule UPXFreakv01BorlandDelphiHMX0101
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE [4] 83 C6 01 FF E6 00 00 00 [3] 00 03 00 00 00 [4] 00 10 00 00 00 00 [4] 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 [3] 00 [3] 00 [3] 00 ?? 24 ?? 00 [3] 00 }
	$a1 = { BE [4] 83 C6 01 FF E6 00 00 00 [3] 00 03 00 00 00 [4] 00 10 00 00 00 00 [4] 00 00 ?? F6 ?? 00 B2 4F 45 00 ?? F9 ?? 00 EF 4F 45 00 ?? F6 ?? 00 8C D1 42 00 ?? 56 ?? 00 [3] 00 [3] 00 [3] 00 ?? 24 ?? 00 [3] 00 34 50 45 00 [3] 00 FF FF 00 00 ?? 24 ?? 00 ?? 24 ?? 00 [3] 00 40 00 00 C0 00 00 [4] 00 00 ?? 00 00 00 ?? 1E ?? 00 ?? F7 ?? 00 A6 4E 43 00 ?? 56 ?? 00 AD D1 42 00 ?? F7 ?? 00 A1 D2 42 00 ?? 56 ?? 00 0B 4D 43 00 ?? F7 ?? 00 ?? F7 ?? 00 ?? 56 ?? 00 [5] 00 00 00 [7] 77 [3] 00 [3] 00 [3] 77 [2] 00 00 [3] 00 [6] 00 00 [3] 00 [11] 00 [4] 00 00 00 00 [3] 00 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: Obsidium13017Obsidiumsoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 02 [2] E8 28 00 00 00 EB 04 [4] EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 02 [2] 33 C0 EB 03 [3] C3 EB 03 [3] EB 02 [2] 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 [3] EB 04 [4] 50 EB 04 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Obsidium13017Obsidiumsoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 [2] E8 28 00 00 00 EB 04 [4] EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 25 EB 02 [2] 33 C0 EB 03 [3] C3 EB 03 [3] EB 02 [2] 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 03 [3] EB 04 [4] 50 EB 04 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Petite22c199899IanLuck
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 68 [4] 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 [2] 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Petite22c199899IanLuck
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 68 [4] 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 [2] 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PluginToExev101BoBBobSoft
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 00 00 00 00 29 C0 5D 81 ED C6 41 40 00 50 8F 85 71 40 40 00 50 FF 95 A5 41 40 00 89 85 6D 40 40 00 FF 95 A1 41 40 00 50 FF 95 B5 41 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 B9 41 40 00 89 85 75 40 40 00 EB 6C 6A 01 8F 85 71 40 40 00 6A 58 6A 40 FF 95 A9 41 40 00 89 85 69 40 40 00 89 C7 68 00 08 00 00 6A 40 FF 95 A9 41 40 00 89 47 1C C7 07 58 00 00 00 C7 47 20 00 08 00 00 C7 47 18 01 00 00 00 C7 47 34 04 10 88 00 8D 8D B9 40 40 00 89 4F 0C 8D 8D DB 40 40 00 89 4F 30 FF B5 69 40 40 00 FF 95 95 41 40 00 FF 77 1C 8F 85 75 40 40 00 8B 9D 6D 40 40 00 60 6A 00 6A 01 53 81 C3 [3] 00 FF D3 61 6A 00 68 44 69 45 50 FF B5 75 40 40 00 6A 00 81 C3 [2] 00 00 FF D3 83 C4 10 83 BD 71 40 40 00 00 74 10 FF 77 1C FF 95 AD 41 40 00 57 FF 95 AD 41 40 00 6A 00 FF 95 9D 41 40 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PluginToExev101BoBBobSoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 29 C0 5D 81 ED C6 41 40 00 50 8F 85 71 40 40 00 50 FF 95 A5 41 40 00 89 85 6D 40 40 00 FF 95 A1 41 40 00 50 FF 95 B5 41 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 B9 41 40 00 89 85 75 40 40 00 EB 6C 6A 01 8F 85 71 40 40 00 6A 58 6A 40 FF 95 A9 41 40 00 89 85 69 40 40 00 89 C7 68 00 08 00 00 6A 40 FF 95 A9 41 40 00 89 47 1C C7 07 58 00 00 00 C7 47 20 00 08 00 00 C7 47 18 01 00 00 00 C7 47 34 04 10 88 00 8D 8D B9 40 40 00 89 4F 0C 8D 8D DB 40 40 00 89 4F 30 FF B5 69 40 40 00 FF 95 95 41 40 00 FF 77 1C 8F 85 75 40 40 00 8B 9D 6D 40 40 00 60 6A 00 6A 01 53 81 C3 [3] 00 FF D3 61 6A 00 68 44 69 45 50 FF B5 75 40 40 00 6A 00 81 C3 [2] 00 00 FF D3 83 C4 10 83 BD 71 40 40 00 00 74 10 FF 77 1C FF 95 AD 41 40 00 57 FF 95 AD 41 40 00 6A 00 FF 95 9D 41 40 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Enigmaprotector110unregistered
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89 }
	$a1 = { 60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89 E9 51 0B C4 80 BC 7E 35 09 37 E7 C9 3D C9 45 C9 4D 74 92 BA E4 E9 24 6B DF 3E 0E 38 0C 49 10 27 80 51 A1 8E 3A A3 C8 AE 3B 1C 35 }

Detection condition:
$a0 or $a1

Full rule:
rule Enigmaprotector110unregistered
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89 }
	$a1 = { 60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89 E9 51 0B C4 80 BC 7E 35 09 37 E7 C9 3D C9 45 C9 4D 74 92 BA E4 E9 24 6B DF 3E 0E 38 0C 49 10 27 80 51 A1 8E 3A A3 C8 AE 3B 1C 35 }

condition:
		$a0 or $a1
}
YARA Detection Rule: Obsidium1341ObsidiumSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 01 ?? E8 2A 00 00 00 EB 04 [4] EB 02 [2] 8B 54 24 0C EB 03 [3] 83 82 B8 00 00 00 21 EB 02 [2] 33 C0 EB 03 [3] C3 EB 02 [2] EB 01 ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 [2] EB 03 [3] 50 EB 04 [4] 33 C0 EB 02 [2] 8B 00 EB 04 [4] C3 EB 02 [2] E9 FA 00 00 00 EB 02 [2] E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 03 [3] EB 04 [4] 64 67 8F 06 00 00 EB 04 [4] 83 C4 04 EB 02 [2] E8 C3 27 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Obsidium1341ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 ?? E8 2A 00 00 00 EB 04 [4] EB 02 [2] 8B 54 24 0C EB 03 [3] 83 82 B8 00 00 00 21 EB 02 [2] 33 C0 EB 03 [3] C3 EB 02 [2] EB 01 ?? 64 67 FF 36 00 00 EB 01 ?? 64 67 89 26 00 00 EB 02 [2] EB 03 [3] 50 EB 04 [4] 33 C0 EB 02 [2] 8B 00 EB 04 [4] C3 EB 02 [2] E9 FA 00 00 00 EB 02 [2] E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 03 [3] EB 04 [4] 64 67 8F 06 00 00 EB 04 [4] 83 C4 04 EB 02 [2] E8 C3 27 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: WebCopsDLLLINKDataSecurity
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { A8 BE 58 DC D6 CC C4 63 4A 0F E0 02 BB CE F3 5C 50 23 FB 62 E7 3D 2B }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule WebCopsDLLLINKDataSecurity
{
      meta:
		author="malware-lu"
strings:
		$a0 = { A8 BE 58 DC D6 CC C4 63 4A 0F E0 02 BB CE F3 5C 50 23 FB 62 E7 3D 2B }

condition:
		$a0 at pe.entry_point
}