deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Armadillov430v440SiliconRealmsToolworks
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 40 [2] 00 68 80 [2] 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 [2] 00 33 D2 8A D4 89 15 30 [2] 00 8B C8 81 E1 FF 00 00 00 89 0D 2C [2] 00 C1 E1 08 03 CA 89 0D 28 [2] 00 C1 E8 10 A3 24 }
	$a1 = { 60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule Armadillov430v440SiliconRealmsToolworks
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 40 [2] 00 68 80 [2] 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 [2] 00 33 D2 8A D4 89 15 30 [2] 00 8B C8 81 E1 FF 00 00 00 89 0D 2C [2] 00 C1 E1 08 03 CA 89 0D 28 [2] 00 C1 E8 10 A3 24 }
	$a1 = { 60 E8 00 00 00 00 5D 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 9D 0F C9 8B CA F7 D1 59 58 50 51 0F CA F7 D2 9C F7 D2 0F CA EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: MoleBoxv20
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 [4] 60 E8 4F }

Detection condition:
$a0

Full rule:
rule MoleBoxv20
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [4] 60 E8 4F }

condition:
		$a0
}
YARA Detection Rule: FucknJoyv10cUsAr
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00 }
	$a1 = { 60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00 00 0B C0 0F 84 EC 00 00 00 89 85 4D 08 40 00 8D 85 51 08 40 00 50 FF B5 6C 08 40 00 E8 AF 02 00 00 0B C0 0F 84 CC 00 00 00 89 85 5C 08 40 00 8D 85 67 07 40 00 E8 7B 02 00 00 8D B5 C4 07 40 00 56 6A 64 FF 95 74 07 40 00 46 80 3E 00 75 FA C7 06 74 6D 70 2E 83 C6 04 C7 06 65 78 65 00 8D 85 36 07 40 00 E8 4C 02 00 00 33 DB 53 53 6A 02 53 53 68 00 00 00 40 8D 85 C4 07 40 00 50 FF 95 74 07 40 00 89 85 78 07 40 00 8D 85 51 07 40 00 E8 21 02 00 00 6A 00 8D 85 7C 07 40 00 50 

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule FucknJoyv10cUsAr
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00 }
	$a1 = { 60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00 00 0B C0 0F 84 EC 00 00 00 89 85 4D 08 40 00 8D 85 51 08 40 00 50 FF B5 6C 08 40 00 E8 AF 02 00 00 0B C0 0F 84 CC 00 00 00 89 85 5C 08 40 00 8D 85 67 07 40 00 E8 7B 02 00 00 8D B5 C4 07 40 00 56 6A 64 FF 95 74 07 40 00 46 80 3E 00 75 FA C7 06 74 6D 70 2E 83 C6 04 C7 06 65 78 65 00 8D 85 36 07 40 00 E8 4C 02 00 00 33 DB 53 53 6A 02 53 53 68 00 00 00 40 8D 85 C4 07 40 00 50 FF 95 74 07 40 00 89 85 78 07 40 00 8D 85 51 07 40 00 E8 21 02 00 00 6A 00 8D 85 7C 07 40 00 50 68 00 [2] 00 8D 85 F2 09 40 00 50 FF }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: PseudoSigner02VideoLanClientAnorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02VideoLanClientAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 83 EC 08 90 90 90 90 90 90 90 90 90 90 90 90 90 90 01 FF FF 01 01 01 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 00 01 00 01 90 90 00 01 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SoftWrap
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 52 53 51 56 57 55 E8 [4] 5D 81 ED 36 [3] E8 ?? 01 [2] 60 BA [4] E8 [4] 5F }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SoftWrap
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 52 53 51 56 57 55 E8 [4] 5D 81 ED 36 [3] E8 ?? 01 [2] 60 BA [4] E8 [4] 5F }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AI1Creator1Beta2byMZ
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 FE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }

Detection condition:
$a0

Full rule:
rule AI1Creator1Beta2byMZ
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 FE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }

condition:
		$a0
}
YARA Detection Rule: JAMv211
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 50 06 16 07 BE [2] 8B FE B9 [2] FD FA F3 2E A5 FB 06 BD [2] 55 CB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule JAMv211
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 06 16 07 BE [2] 8B FE B9 [2] FD FA F3 2E A5 FB 06 BD [2] 55 CB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PECompactv0978
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 24 88 40 ?? 87 DD 8B 85 A9 88 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECompactv0978
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 24 88 40 ?? 87 DD 8B 85 A9 88 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Setup2GoInstallerStub
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 5B 53 45 54 55 50 5F 49 4E 46 4F 5D 0D 0A 56 65 72 }

Detection condition:
$a0

Full rule:
rule Setup2GoInstallerStub
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 5B 53 45 54 55 50 5F 49 4E 46 4F 5D 0D 0A 56 65 72 }

condition:
		$a0
}
YARA Detection Rule: themida1005httpwwworeanscom
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule themida1005httpwwworeanscom
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: yodasProtectorv1033exescrcomAshkbizDanehkar
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule yodasProtectorv1033exescrcomAshkbizDanehkar
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ORiENv211DEMO
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 5D 01 00 00 CE D1 CE CE 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ORiENv211DEMO
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 5D 01 00 00 CE D1 CE CE 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PECompactv0977
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB A0 86 40 ?? 87 DD 8B 85 2A 87 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECompactv0977
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB A0 86 40 ?? 87 DD 8B 85 2A 87 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PESpinv13betaCyberbob
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PESpinv13betaCyberbob
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RCryptorv13bVaska
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 61 83 EF 4F 60 68 [4] FF D7 }
	$a1 = { 61 83 EF 4F 60 68 [4] FF D7 B8 [4] 3D [4] 74 06 80 30 ?? 40 EB F3 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule RCryptorv13bVaska
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 61 83 EF 4F 60 68 [4] FF D7 }
	$a1 = { 61 83 EF 4F 60 68 [4] FF D7 B8 [4] 3D [4] 74 06 80 30 ?? 40 EB F3 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: mkfpackllydd
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 00 00 00 00 5B 81 EB 05 00 00 00 8B 93 9F 08 00 00 53 6A 40 68 00 10 00 00 52 6A 00 FF 93 32 08 00 00 5B 8B F0 8B BB 9B 08 00 00 03 FB 56 57 E8 86 08 00 00 83 C4 08 8D 93 BB 08 00 00 52 53 FF E6 }

Detection condition:
$a0

Full rule:
rule mkfpackllydd
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 5B 81 EB 05 00 00 00 8B 93 9F 08 00 00 53 6A 40 68 00 10 00 00 52 6A 00 FF 93 32 08 00 00 5B 8B F0 8B BB 9B 08 00 00 03 FB 56 57 E8 86 08 00 00 83 C4 08 8D 93 BB 08 00 00 52 53 FF E6 }

condition:
		$a0
}
YARA Detection Rule: PESpinV03cyberbob
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 CB 2C 40 00 8B 42 3C 03 C2 89 85 D5 2C 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D E9 2C 40 00 53 8F 85 B6 2B 40 00 BB ?? 00 00 00 B9 75 0A 00 00 8D BD 7E 2D 40 00 4F 30 1C 39 FE CB E2 F9 68 3C 01 00 00 59 8D BD B6 36 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 1F 53 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 [4] 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D DC 2C 40 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PESpinV03cyberbob
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 CB 2C 40 00 8B 42 3C 03 C2 89 85 D5 2C 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D E9 2C 40 00 53 8F 85 B6 2B 40 00 BB ?? 00 00 00 B9 75 0A 00 00 8D BD 7E 2D 40 00 4F 30 1C 39 FE CB E2 F9 68 3C 01 00 00 59 8D BD B6 36 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 1F 53 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 [4] 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D DC 2C 40 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner02BorlandDelphiSetupModuleAnorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 90 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8 00 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02BorlandDelphiSetupModuleAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 90 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PELOCKnt204
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PELOCKnt204
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: MacromediaWindowsFlashProjectorPlayerv60
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule MacromediaWindowsFlashProjectorPlayerv60
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: IMPostorPack10MahdiHezavehi
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE [3] 00 83 C6 01 FF E6 00 00 00 00 [2] 00 00 00 00 00 00 00 00 00 [3] 00 ?? 02 [2] 00 10 00 00 00 02 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule IMPostorPack10MahdiHezavehi
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE [3] 00 83 C6 01 FF E6 00 00 00 00 [2] 00 00 00 00 00 00 00 00 00 [3] 00 ?? 02 [2] 00 10 00 00 00 02 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PluginToExev102BoBBobSoft
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 00 00 00 00 29 C0 5D 81 ED 32 42 40 00 50 8F 85 DD 40 40 00 50 FF 95 11 42 40 00 89 85 D9 40 40 00 FF 95 0D 42 40 00 50 FF 95 21 42 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 25 42 40 00 89 85 E1 40 40 00 EB 6C 6A 01 8F 85 DD 40 40 00 6A 58 6A 40 FF 95 15 42 40 00 89 85 D5 40 40 00 89 C7 68 00 08 00 00 6A 40 FF 95 15 42 40 00 89 47 1C C7 07 58 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PluginToExev102BoBBobSoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 29 C0 5D 81 ED 32 42 40 00 50 8F 85 DD 40 40 00 50 FF 95 11 42 40 00 89 85 D9 40 40 00 FF 95 0D 42 40 00 50 FF 95 21 42 40 00 80 38 00 74 16 8A 08 80 F9 22 75 07 50 FF 95 25 42 40 00 89 85 E1 40 40 00 EB 6C 6A 01 8F 85 DD 40 40 00 6A 58 6A 40 FF 95 15 42 40 00 89 85 D5 40 40 00 89 C7 68 00 08 00 00 6A 40 FF 95 15 42 40 00 89 47 1C C7 07 58 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PKLITEv120
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 [2] BA [2] 05 [2] 3B 06 [2] 72 ?? B4 09 BA [2] CD 21 B4 4C CD 21 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PKLITEv120
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [2] BA [2] 05 [2] 3B 06 [2] 72 ?? B4 09 BA [2] CD 21 B4 4C CD 21 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PrivateexeProtectorV18SetiSoftTeam
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 [4] 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }

Detection condition:
$a0

Full rule:
rule PrivateexeProtectorV18SetiSoftTeam
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 [4] 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }

condition:
		$a0
}
YARA Detection Rule: PENinjamodified
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 5D 8B C5 81 ED B2 2C 40 00 2B 85 94 3E 40 00 2D 71 02 00 00 89 85 98 3E 40 00 0F B6 B5 9C 3E 40 00 8B FD }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PENinjamodified
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 5D 8B C5 81 ED B2 2C 40 00 2B 85 94 3E 40 00 2D 71 02 00 00 89 85 98 3E 40 00 0F B6 B5 9C 3E 40 00 8B FD }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: DotFixNiceProtect21GPcHSoft
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 B8 [4] 03 C5 50 B8 [4] 03 C5 FF 10 BB [4] 03 DD 83 C3 0C 53 50 B8 [4] 03 C5 FF 10 6A 40 68 00 10 00 00 FF 74 24 2C 6A 00 FF D0 89 44 24 1C 61 C3 }

Detection condition:
$a0

Full rule:
rule DotFixNiceProtect21GPcHSoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 FF 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 B8 [4] 03 C5 50 B8 [4] 03 C5 FF 10 BB [4] 03 DD 83 C3 0C 53 50 B8 [4] 03 C5 FF 10 6A 40 68 00 10 00 00 FF 74 24 2C 6A 00 FF D0 89 44 24 1C 61 C3 }

condition:
		$a0
}
YARA Detection Rule: EXEStealthv276WebToolMaster
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 65 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 59 4F 55 52 20 41 44 20 48 45 52 45 21 50 69 52 41 43 59 20 69 53 20 41 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EXEStealthv276WebToolMaster
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 65 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 59 4F 55 52 20 41 44 20 48 45 52 45 21 50 69 52 41 43 59 20 69 53 20 41 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EXECryptor239DLLcompressedresources
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 50 68 [4] 58 C1 C0 0F E9 [3] 00 87 04 24 58 89 45 FC E9 [3] FF FF 05 [4] E9 [3] 00 C1 C3 18 E9 [4] 8B 55 08 09 42 F8 E9 [3] FF 83 7D F0 01 0F 85 [4] E9 [3] 00 87 34 24 5E 8B 45 FC 33 D2 56 8B F2 E9 [3] 00 BA [4] E8 [3] 00 A3 [4] C3 E9 [3] 00 C3 83 C4 04 C3 E9 [3] FF 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 E8 [3] 00 E9 [3] FF C1 C2 03 81 CA [4] 81 C2 [4] 03 C2 5A E9 [3] FF 81 E7 [4] 81 EF [4] 81 C7 [4] 89 07 E9 [4] 0F 89 [4] 87 14 24 5A 50 C1 C8 10 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EXECryptor239DLLcompressedresources
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 68 [4] 58 C1 C0 0F E9 [3] 00 87 04 24 58 89 45 FC E9 [3] FF FF 05 [4] E9 [3] 00 C1 C3 18 E9 [4] 8B 55 08 09 42 F8 E9 [3] FF 83 7D F0 01 0F 85 [4] E9 [3] 00 87 34 24 5E 8B 45 FC 33 D2 56 8B F2 E9 [3] 00 BA [4] E8 [3] 00 A3 [4] C3 E9 [3] 00 C3 83 C4 04 C3 E9 [3] FF 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 E8 [3] 00 E9 [3] FF C1 C2 03 81 CA [4] 81 C2 [4] 03 C2 5A E9 [3] FF 81 E7 [4] 81 EF [4] 81 C7 [4] 89 07 E9 [4] 0F 89 [4] 87 14 24 5A 50 C1 C8 10 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: UnoPiX103110BaGiE
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 83 EC 04 C7 04 24 00 [3] C3 00 [2] 00 00 00 00 00 00 00 00 00 00 00 00 [2] 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 [2] 00 00 10 00 00 00 00 00 00 02 00 00 ?? 00 00 ?? 00 00 [2] 00 00 00 10 00 00 10 00 00 00 00 00 00 10 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule UnoPiX103110BaGiE
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 04 C7 04 24 00 [3] C3 00 [2] 00 00 00 00 00 00 00 00 00 00 00 00 [2] 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 00 [2] 00 00 10 00 00 00 00 00 00 02 00 00 ?? 00 00 ?? 00 00 [2] 00 00 00 10 00 00 10 00 00 00 00 00 00 10 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PECompactv110b3
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 95 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECompactv110b3
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 95 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: IonicWindSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9B DB E3 9B DB E2 D9 2D 00 [2] 00 55 89 E5 E8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule IonicWindSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9B DB E3 9B DB E2 D9 2D 00 [2] 00 55 89 E5 E8 }

condition:
		$a0 at pe.entry_point
}