deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: USERNAME_v300_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FB 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 8C C8 2B C1 8B C8 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 33 C0 8E D8 06 0E 07 FC 33 F6 }

Detection condition:
$a at pe.entry_point

Full rule:
rule USERNAME_v300_additional: PEiD
{
    strings:
        $a = { FB 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 8C C8 2B C1 8B C8 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 33 C0 8E D8 06 0E 07 FC 33 F6 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MSLRH_v032a_fake_PEX_099_emadicius
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED FF 22 40 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MSLRH_v032a_fake_PEX_099_emadicius: PEiD
{
    strings:
        $a = { 60 E8 01 00 00 00 E8 83 C4 04 E8 01 00 00 00 E9 5D 81 ED FF 22 40 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PCIENC_Cryptor_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 06 50 43 49 45 4E }

Detection condition:
$a at pe.entry_point

Full rule:
rule PCIENC_Cryptor_Hint_FILE_START: PEiD
{
    strings:
        $a = { 06 50 43 49 45 4E }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PKLITE32_11_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 4B 4C 49 54 45 33 32 20 43 6F 70 79 72 69 67 68 74 20 31 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PKLITE32_11_additional: PEiD
{
    strings:
        $a = { 50 4B 4C 49 54 45 33 32 20 43 6F 70 79 72 69 67 68 74 20 31 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Trap_114a
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B9 E8 03 EB 03 90 CD 20 E2 F9 8C D1 BA 99 CB 8E D2 33 D2 8E D1 8B CA 33 D2 B9 00 05 EB 03 90 CD 20 81 F9 E2 03 74 33 83 C1 FE 83 C2 01 EB ED EB FE EB 25 0D 0A 09 09 09 20 C4 C4 C4 C4 C4 C4 C4 C4 5B 20 54 52 41 50 20 31 2E 31 34 20 5D C4 C4 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Trap_114a: PEiD
{
    strings:
        $a = { B9 E8 03 EB 03 90 CD 20 E2 F9 8C D1 BA 99 CB 8E D2 33 D2 8E D1 8B CA 33 D2 B9 00 05 EB 03 90 CD 20 81 F9 E2 03 74 33 83 C1 FE 83 C2 01 EB ED EB FE EB 25 0D 0A 09 09 09 20 C4 C4 C4 C4 C4 C4 C4 C4 5B 20 54 52 41 50 20 31 2E 31 34 20 5D C4 C4 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SDProtector_BasicPro_Edition_112_Randy_Li_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 7B 03 00 00 03 C8 74 C4 75 C2 E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E2 }

Detection condition:
$a at pe.entry_point

Full rule:
rule SDProtector_BasicPro_Edition_112_Randy_Li_h: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 20 33 C0 89 41 04 89 41 08 89 41 0C 89 41 10 59 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 33 C0 64 FF 30 64 89 20 9C 80 4C 24 01 01 9D 90 90 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 C3 64 8F 00 58 74 07 75 05 19 32 67 E8 E8 74 27 75 25 EB 00 EB FC 68 39 44 CD 00 59 9C 50 74 0F 75 0D E8 59 C2 04 00 55 8B EC E9 FA FF FF 0E E8 EF FF FF FF 56 57 53 78 03 79 01 E8 68 A2 AF 47 01 59 E8 01 00 00 00 FF 58 05 7B 03 00 00 03 C8 74 C4 75 C2 E8 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E2 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ThinstallVS_v3x_Jitit_Software
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB ?? ?? 00 00 2B C3 50 68 00 00 ?? ?? 68 00 ?? 00 00 68 ?? ?? 00 00 E8 ?? ?? FF FF E9 90 FF FF FF CC CC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ThinstallVS_v3x_Jitit_Software: PEiD
{
    strings:
        $a = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB ?? ?? 00 00 2B C3 50 68 00 00 ?? ?? 68 00 ?? 00 00 68 ?? ?? 00 00 E8 ?? ?? FF FF E9 90 FF FF FF CC CC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CRYPToCRACks_PE_Protector_V092_Lukas_Fleischer
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 01 00 00 00 E8 58 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 37 84 DB 75 33 8B F3 03 ?? ?? 81 3E 50 45 00 00 75 26 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CRYPToCRACks_PE_Protector_V092_Lukas_Fleischer: PEiD
{
    strings:
        $a = { E8 01 00 00 00 E8 58 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 37 84 DB 75 33 8B F3 03 ?? ?? 81 3E 50 45 00 00 75 26 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_Armadillo_300
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_Armadillo_300: PEiD
{
    strings:
        $a = { 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: BamBam_001_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1 }

Detection condition:
$a at pe.entry_point

Full rule:
rule BamBam_001_additional: PEiD
{
    strings:
        $a = { 6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXEStealth_276_Unregistered_WebtoolMaster
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB ?? 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 53 68 61 72 65 77 61 72 65 20 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXEStealth_276_Unregistered_WebtoolMaster: PEiD
{
    strings:
        $a = { EB ?? 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 53 68 61 72 65 77 61 72 65 20 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: KenPack_V0X_CHKenCom_20080108
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E9 ?? FF FF FF 50 50 FF 35 ?? ?? ?? ?? E9 ?? FF FF FF FF 25 ?? ?? ?? ?? FF 25 }

Detection condition:
$a at pe.entry_point

Full rule:
rule KenPack_V0X_CHKenCom_20080108: PEiD
{
    strings:
        $a = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E9 ?? FF FF FF 50 50 FF 35 ?? ?? ?? ?? E9 ?? FF FF FF FF 25 ?? ?? ?? ?? FF 25 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Naked_Packer_V1X_BigBoote_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 FC 0F B6 05 ?? ?? ?? ?? 85 C0 75 31 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9A 00 00 00 A3 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? 01 83 3D ?? ?? ?? ?? 00 75 07 61 FF 25 ?? ?? ?? ?? 61 FF 74 24 04 6A 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Naked_Packer_V1X_BigBoote_additional: PEiD
{
    strings:
        $a = { 60 FC 0F B6 05 ?? ?? ?? ?? 85 C0 75 31 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9A 00 00 00 A3 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? 01 83 3D ?? ?? ?? ?? 00 75 07 61 FF 25 ?? ?? ?? ?? 61 FF 74 24 04 6A 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Cracked_by_AutoHack_1_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FA 50 51 57 56 1E 06 2E 80 3E ?? ?? ?? 74 ?? 8E 06 ?? ?? 2B FF FC }

Detection condition:
$a at pe.entry_point

Full rule:
rule Cracked_by_AutoHack_1_Hint_DOS_EP: PEiD
{
    strings:
        $a = { FA 50 51 57 56 1E 06 2E 80 3E ?? ?? ?? 74 ?? 8E 06 ?? ?? 2B FF FC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ShellModify_01_pll621
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 98 66 41 00 68 3C 3D 41 00 64 A1 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ShellModify_01_pll621: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 98 66 41 00 68 3C 3D 41 00 64 A1 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RLPack_V119_aPlib_043_ap0x_Sign_by_fly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RLPack_V119_aPlib_043_ap0x_Sign_by_fly: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 3C 04 00 00 EB 0C 8B 85 38 04 00 00 89 85 3C 04 00 00 8D B5 60 04 00 00 8D 9D EB 02 00 00 33 FF E8 52 01 00 00 EB 1B 8B 85 3C 04 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECrc32_088_ZhouJinYu
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED B6 A4 45 00 8D BD B0 A4 45 00 81 EF 82 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECrc32_088_ZhouJinYu: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED B6 A4 45 00 8D BD B0 A4 45 00 81 EF 82 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MSLRH_032a_fake_yodas_cryptor_12_emadicius
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC 90 2C 8A C0 C0 78 90 04 62 EB 01 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MSLRH_032a_fake_yodas_cryptor_12_emadicius: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED F3 1D 40 00 B9 7B 09 00 00 8D BD 3B 1E 40 00 8B F7 AC 90 2C 8A C0 C0 78 90 04 62 EB 01 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: tElock_v07x_v084_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 83 CD FF 31 DB 5E 8D BE FA ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 81 C6 B3 01 ?? ?? EB 0A ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 }

Detection condition:
$a at pe.entry_point

Full rule:
rule tElock_v07x_v084_additional: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 83 CD FF 31 DB 5E 8D BE FA ?? ?? FF 57 66 81 87 ?? ?? ?? ?? ?? ?? 81 C6 B3 01 ?? ?? EB 0A ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: X_PEOR_v099b_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? ?? ?? 5D 8B CD 81 ED 7A 29 40 ?? 89 AD 0F 6D 40 }

Detection condition:
$a at pe.entry_point

Full rule:
rule X_PEOR_v099b_additional: PEiD
{
    strings:
        $a = { E8 ?? ?? ?? ?? 5D 8B CD 81 ED 7A 29 40 ?? 89 AD 0F 6D 40 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: N_Joy_10_NEX
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 F0 B8 9C 3B 40 00 E8 8C FC FF FF 6A 00 68 E4 39 40 00 6A 0A 6A 00 E8 40 FD FF FF E8 EF F5 FF FF 8D 40 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule N_Joy_10_NEX: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 F0 B8 9C 3B 40 00 E8 8C FC FF FF 6A 00 68 E4 39 40 00 6A 0A 6A 00 E8 40 FD FF FF E8 EF F5 FF FF 8D 40 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PeCompact2_253_276_BitSum_Technologies_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? ?? ?? 55 53 51 57 56 52 8D 98 C9 11 00 10 8B 53 18 52 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 5A 8B F8 50 52 8B 33 8B 43 20 03 C2 8B 08 89 4B 20 8B 43 1C 03 C2 8B 08 89 4B 1C 03 F2 8B 4B 0C 03 CA 8D 43 1C 50 57 56 FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule PeCompact2_253_276_BitSum_Technologies_additional: PEiD
{
    strings:
        $a = { B8 ?? ?? ?? ?? 55 53 51 57 56 52 8D 98 C9 11 00 10 8B 53 18 52 8B E8 6A 40 68 00 10 00 00 FF 73 04 6A 00 8B 4B 10 03 CA 8B 01 FF D0 5A 8B F8 50 52 8B 33 8B 43 20 03 C2 8B 08 89 4B 20 8B 43 1C 03 C2 8B 08 89 4B 1C 03 F2 8B 4B 0C 03 CA 8D 43 1C 50 57 56 FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_XRCV1015_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? 5E 83 ?? ?? 53 51 1E 06 B4 99 CD 21 80 FC 21 ?? ?? ?? ?? ?? 33 C0 50 8C D8 48 8E C0 1F A1 ?? ?? 8B }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_XRCV1015_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E8 ?? ?? 5E 83 ?? ?? 53 51 1E 06 B4 99 CD 21 80 FC 21 ?? ?? ?? ?? ?? 33 C0 50 8C D8 48 8E C0 1F A1 ?? ?? 8B }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_Visual_Cpp_42_DLL
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 53 B8 ?? ?? ?? ?? 8B ?? ?? ?? 56 57 85 DB 55 75 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_Visual_Cpp_42_DLL: PEiD
{
    strings:
        $a = { 53 B8 ?? ?? ?? ?? 8B ?? ?? ?? 56 57 85 DB 55 75 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_SK_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { CD 20 B8 03 00 CD 10 51 E8 00 00 5E 83 EE 09 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_SK_Hint_DOS_EP: PEiD
{
    strings:
        $a = { CD 20 B8 03 00 CD 10 51 E8 00 00 5E 83 EE 09 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_v110b6_Jeremy_Collake
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 ?? 00 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB B7 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_v110b6_Jeremy_Collake: PEiD
{
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 ?? 00 87 DD 8B 85 9A 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 01 85 92 60 40 ?? BB B7 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CrypKey_Instant_Stealth_50161
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 00 00 00 00 58 83 E8 05 50 5F 57 8B F7 81 EF A7 1F 00 00 83 C6 39 BA 00 00 00 00 8B DF B9 0B 00 00 00 8B 06 33 03 89 06 83 C6 04 83 C3 04 E2 F2 42 83 FA 05 74 02 EB E3 6A 11 B6 AC 0D 65 DF D4 35 20 31 19 67 C0 CB 2D BA 36 19 73 C5 DB 70 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CrypKey_Instant_Stealth_50161: PEiD
{
    strings:
        $a = { E8 00 00 00 00 58 83 E8 05 50 5F 57 8B F7 81 EF A7 1F 00 00 83 C6 39 BA 00 00 00 00 8B DF B9 0B 00 00 00 8B 06 33 03 89 06 83 C6 04 83 C3 04 E2 F2 42 83 FA 05 74 02 EB E3 6A 11 B6 AC 0D 65 DF D4 35 20 31 19 67 C0 CB 2D BA 36 19 73 C5 DB 70 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPX_093_UnHack32_11
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 BE 00 80 43 00 8D BE 00 90 FC FF C7 87 D0 64 04 00 26 81 74 8D 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPX_093_UnHack32_11: PEiD
{
    strings:
        $a = { 60 BE 00 80 43 00 8D BE 00 90 FC FF C7 87 D0 64 04 00 26 81 74 8D 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_VirusConstructorIVPbased_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? E8 ?? ?? 5D ?? ?? ?? ?? ?? 81 ED ?? ?? ?? ?? ?? ?? E8 ?? ?? 81 FC ?? ?? ?? ?? 8D ?? ?? ?? BF ?? ?? 57 A4 A5 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_VirusConstructorIVPbased_additional: PEiD
{
    strings:
        $a = { E9 ?? ?? E8 ?? ?? 5D ?? ?? ?? ?? ?? 81 ED ?? ?? ?? ?? ?? ?? E8 ?? ?? 81 FC ?? ?? ?? ?? 8D ?? ?? ?? BF ?? ?? 57 A4 A5 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPX_093_UnHack32_12
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 BE 00 A0 43 00 8D BE 00 70 FC FF C7 87 D0 84 04 00 98 C1 DF 2D 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPX_093_UnHack32_12: PEiD
{
    strings:
        $a = { 60 BE 00 A0 43 00 8D BE 00 70 FC FF C7 87 D0 84 04 00 98 C1 DF 2D 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Unnamed_Scrambler_251Beta_2_252_p0ke
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC B9 ?? 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? ?? 40 00 E8 ?? EA FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 BA ?? ?? 40 00 B8 ?? ?? 40 00 E8 63 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? ?? FF FF BA ?? ?? 40 00 8B C3 8B 0D ?? ?? 40 00 E8 ?? ?? FF FF C7 05 ?? ?? 40 00 0A 00 00 00 BB ?? ?? 40 00 BE ?? ?? 40 00 BF ?? ?? 40 00 B8 ?? ?? 40 00 BA 04 00 00 00 E8 ?? EB FF FF 83 3B 00 74 04 33 C0 89 03 8B D7 8B C6 E8 0A F3 FF FF 89 03 83 3B 00 0F 84 F7 04 00 00 B8 ?? ?? 40 00 8B 16 E8 ?? E1 FF FF B8 ?? ?? 40 00 E8 ?? E0 FF FF 8B D0 8B 03 8B 0E E8 ?? ?? FF FF 8B C7 A3 ?? ?? 40 00 8D 55 EC 33 C0 E8 ?? D3 FF FF 8B 45 EC B9 ?? ?? 40 00 BA ?? ?? 40 00 E8 8B ED FF FF 3C 01 75 2B A1 }
        $b = { 55 8B EC B9 ?? 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? ?? 40 00 E8 ?? EA FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 BA ?? ?? 40 00 B8 ?? ?? 40 00 E8 63 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? ?? FF FF BA ?? ?? 40 00 8B C3 8B 0D ?? ?? 40 00 E8 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Unnamed_Scrambler_251Beta_2_252_p0ke: PEiD
{
    strings:
        $a = { 55 8B EC B9 ?? 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? ?? 40 00 E8 ?? EA FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 BA ?? ?? 40 00 B8 ?? ?? 40 00 E8 63 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? ?? FF FF BA ?? ?? 40 00 8B C3 8B 0D ?? ?? 40 00 E8 ?? ?? FF FF C7 05 ?? ?? 40 00 0A 00 00 00 BB ?? ?? 40 00 BE ?? ?? 40 00 BF ?? ?? 40 00 B8 ?? ?? 40 00 BA 04 00 00 00 E8 ?? EB FF FF 83 3B 00 74 04 33 C0 89 03 8B D7 8B C6 E8 0A F3 FF FF 89 03 83 3B 00 0F 84 F7 04 00 00 B8 ?? ?? 40 00 8B 16 E8 ?? E1 FF FF B8 ?? ?? 40 00 E8 ?? E0 FF FF 8B D0 8B 03 8B 0E E8 ?? ?? FF FF 8B C7 A3 ?? ?? 40 00 8D 55 EC 33 C0 E8 ?? D3 FF FF 8B 45 EC B9 ?? ?? 40 00 BA ?? ?? 40 00 E8 8B ED FF FF 3C 01 75 2B A1 }
        $b = { 55 8B EC B9 ?? 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? ?? 40 00 E8 ?? EA FF FF 33 C0 55 68 ?? ?? 40 00 64 FF 30 64 89 20 BA ?? ?? 40 00 B8 ?? ?? 40 00 E8 63 F3 FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? ?? FF FF BA ?? ?? 40 00 8B C3 8B 0D ?? ?? 40 00 E8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: RCryptor_v16b_v16c_Vaska_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RCryptor_v16b_v16c_Vaska_additional: PEiD
{
    strings:
        $a = { 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_v155
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A2 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 9E 80 40 ?? BB 2D 12 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_v155: PEiD
{
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A2 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 ?? 80 40 ?? 90 90 01 85 9E 80 40 ?? BB 2D 12 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_v156
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 90 40 ?? 87 DD 8B 85 A2 90 40 ?? 01 85 03 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 9E 90 40 ?? BB 2D 12 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_v156: PEiD
{
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 90 40 ?? 87 DD 8B 85 A2 90 40 ?? 01 85 03 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 9E 90 40 ?? BB 2D 12 }
    condition:
        $a at pe.entry_point

}