deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: yodas_Protector_v102_exescrcom_Ashkbiz_Danehkar_h_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 35 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 BE 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC }

Detection condition:
$a at pe.entry_point

Full rule:
rule yodas_Protector_v102_exescrcom_Ashkbiz_Danehkar_h_additional: PEiD
{
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 35 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 BE 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_Visual_Cpp_70_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 ?? ?? 83 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_Visual_Cpp_70_additional: PEiD
{
    strings:
        $a = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 ?? ?? 83 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PESpin_V0b_cyberbobnbsp_nbsp_SignByfly_20080312
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 26 E8 01 00 00 00 ?? 5A 33 C9 ?? ?? ?? ?? ?? ?? 8B 42 3C 03 C2 89 ?? ?? ?? ?? ?? 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B ?? ?? ?? ?? ?? ?? 8B 59 24 03 DA 8B 1B ?? ?? ?? ?? ?? ?? 53 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 0C 5B 6A 17 59 30 0C 03 02 CB 4B 75 F8 40 8D 9D 41 8F 4E 00 50 53 81 2C 24 01 78 0E 00 ?? ?? ?? ?? ?? ?? C3 92 EB 15 68 ?? ?? ?? ?? ?? B9 ?? 08 00 00 ?? ?? ?? ?? ?? ?? 4F 30 1C 39 FE CB E2 F9 68 1D 01 00 00 59 ?? ?? ?? ?? ?? ?? C0 0C 39 02 E2 FA 68 ?? ?? ?? ?? 50 01 6C 24 04 E8 BD 09 00 00 33 C0 0F 84 C0 08 00 00 ?? ?? ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF E0 C3 8D 64 24 04 E8 53 0A 00 00 D7 58 5B 51 C3 F7 F3 32 DA ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 2C 24 A3 00 00 00 58 ?? ?? ?? ?? ?? ?? 53 FF E0 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PESpin_V0b_cyberbobnbsp_nbsp_SignByfly_20080312: PEiD
{
    strings:
        $a = { EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 26 E8 01 00 00 00 ?? 5A 33 C9 ?? ?? ?? ?? ?? ?? 8B 42 3C 03 C2 89 ?? ?? ?? ?? ?? 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B ?? ?? ?? ?? ?? ?? 8B 59 24 03 DA 8B 1B ?? ?? ?? ?? ?? ?? 53 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 0C 5B 6A 17 59 30 0C 03 02 CB 4B 75 F8 40 8D 9D 41 8F 4E 00 50 53 81 2C 24 01 78 0E 00 ?? ?? ?? ?? ?? ?? C3 92 EB 15 68 ?? ?? ?? ?? ?? B9 ?? 08 00 00 ?? ?? ?? ?? ?? ?? 4F 30 1C 39 FE CB E2 F9 68 1D 01 00 00 59 ?? ?? ?? ?? ?? ?? C0 0C 39 02 E2 FA 68 ?? ?? ?? ?? 50 01 6C 24 04 E8 BD 09 00 00 33 C0 0F 84 C0 08 00 00 ?? ?? ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF E0 C3 8D 64 24 04 E8 53 0A 00 00 D7 58 5B 51 C3 F7 F3 32 DA ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 2C 24 A3 00 00 00 58 ?? ?? ?? ?? ?? ?? 53 FF E0 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: InterLok_V5X_PACE_Anti_Piracy
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 81 EC A4 00 00 00 53 56 33 F6 57 39 35 ?? ?? ?? ?? 75 53 8D 45 DC 6A 1C 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 05 8B 45 E0 EB 22 8B 7D 08 6A 02 57 FF 15 ?? ?? ?? ?? 85 C0 75 0B 66 81 3F 4D 5A 75 04 8B C7 EB 07 56 FF 15 ?? ?? ?? ?? A3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule InterLok_V5X_PACE_Anti_Piracy: PEiD
{
    strings:
        $a = { 55 8B EC 81 EC A4 00 00 00 53 56 33 F6 57 39 35 ?? ?? ?? ?? 75 53 8D 45 DC 6A 1C 50 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 85 C0 74 05 8B 45 E0 EB 22 8B 7D 08 6A 02 57 FF 15 ?? ?? ?? ?? 85 C0 75 0B 66 81 3F 4D 5A 75 04 8B C7 EB 07 56 FF 15 ?? ?? ?? ?? A3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PureBasic_4x_Neil_Hodgson
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 ?? ?? 00 00 68 00 00 00 00 68 ?? ?? ?? 00 E8 ?? ?? ?? 00 83 C4 0C 68 00 00 00 00 E8 ?? ?? ?? 00 A3 ?? ?? ?? 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? ?? ?? 00 A3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PureBasic_4x_Neil_Hodgson: PEiD
{
    strings:
        $a = { 68 ?? ?? 00 00 68 00 00 00 00 68 ?? ?? ?? 00 E8 ?? ?? ?? 00 83 C4 0C 68 00 00 00 00 E8 ?? ?? ?? 00 A3 ?? ?? ?? 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? ?? ?? 00 A3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: VIRUS_I_WormHybris
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 16 A8 54 ?? ?? 47 41 42 4C 4B 43 47 43 ?? ?? ?? ?? ?? ?? 52 49 53 ?? FC 68 4C 70 40 ?? FF 15 }

Detection condition:
$a at pe.entry_point

Full rule:
rule VIRUS_I_WormHybris: PEiD
{
    strings:
        $a = { EB 16 A8 54 ?? ?? 47 41 42 4C 4B 43 47 43 ?? ?? ?? ?? ?? ?? 52 49 53 ?? FC 68 4C 70 40 ?? FF 15 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SLR_OPTLINK_1_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 87 C0 EB ?? 71 ?? 02 D8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule SLR_OPTLINK_1_additional: PEiD
{
    strings:
        $a = { 87 C0 EB ?? 71 ?? 02 D8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MSLRH_v032a_fake_UPX_0896_102_105_124_emadicius
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 BE 00 90 8B 00 8D BE 00 80 B4 FF 57 83 CD FF EB 3A 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B 75 19 8B 1E 83 EE FC 11 DB 72 10 58 61 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule MSLRH_v032a_fake_UPX_0896_102_105_124_emadicius: PEiD
{
    strings:
        $a = { 60 BE 00 90 8B 00 8D BE 00 80 B4 FF 57 83 CD FF EB 3A 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B 75 19 8B 1E 83 EE FC 11 DB 72 10 58 61 90 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_ACME_Clonewar_Mutant
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FC AD 3D FF FF 74 20 E6 42 8A C4 E6 42 E4 61 0C 03 E6 61 AD B9 40 1F E2 FE }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_ACME_Clonewar_Mutant: PEiD
{
    strings:
        $a = { FC AD 3D FF FF 74 20 E6 42 8A C4 E6 42 E4 61 0C 03 E6 61 AD B9 40 1F E2 FE }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_GRUNT2Family_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 48 E2 F7 C3 51 53 52 E8 DD FF 5A 5B 59 C3 B9 00 00 E2 FE C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_GRUNT2Family_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 48 E2 F7 C3 51 53 52 E8 DD FF 5A 5B 59 C3 B9 00 00 E2 FE C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Borland_Cpp_1992_1994_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8C C8 8E D8 8C 1E ?? ?? 8C 06 ?? ?? 8C 06 ?? ?? 8C 06 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Borland_Cpp_1992_1994_additional: PEiD
{
    strings:
        $a = { 8C C8 8E D8 8C 1E ?? ?? 8C 06 ?? ?? 8C 06 ?? ?? 8C 06 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: StarForce_30_StarForce_Technology
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 ?? ?? ?? ?? FF 25 ?? ?? 63 }

Detection condition:
$a at pe.entry_point

Full rule:
rule StarForce_30_StarForce_Technology: PEiD
{
    strings:
        $a = { 68 ?? ?? ?? ?? FF 25 ?? ?? 63 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ExeShield_36_wwwexeshieldcom_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F }

Detection condition:
$a at pe.entry_point

Full rule:
rule ExeShield_36_wwwexeshieldcom_additional: PEiD
{
    strings:
        $a = { B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Imaging_Technology_Graphics_format_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 49 4D 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Imaging_Technology_Graphics_format_Hint_FILE_START: PEiD
{
    strings:
        $a = { 49 4D 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PESHiELD_v02_v02b_v02b2
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 ?? ?? ?? ?? 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PESHiELD_v02_v02b_v02b2: PEiD
{
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: eXPressor_v120b_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? 00 2B 05 84 ?? ?? 00 A3 ?? ?? ?? 00 83 3D ?? ?? ?? 00 00 74 16 A1 ?? ?? ?? 00 03 05 80 ?? ?? 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? 00 01 00 00 00 68 04 01 00 00 8D 85 F0 FE FF FF 50 6A 00 FF 15 ?? ?? ?? 00 8D 84 05 EF FE FF FF 89 85 38 FE FF FF 8B 85 38 FE FF FF 0F BE 00 83 F8 5C }

Detection condition:
$a at pe.entry_point

Full rule:
rule eXPressor_v120b_additional: PEiD
{
    strings:
        $a = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? 00 2B 05 84 ?? ?? 00 A3 ?? ?? ?? 00 83 3D ?? ?? ?? 00 00 74 16 A1 ?? ?? ?? 00 03 05 80 ?? ?? 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? 00 01 00 00 00 68 04 01 00 00 8D 85 F0 FE FF FF 50 6A 00 FF 15 ?? ?? ?? 00 8D 84 05 EF FE FF FF 89 85 38 FE FF FF 8B 85 38 FE FF FF 0F BE 00 83 F8 5C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: VOB_ProtectCD_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 36 3E 26 8A C0 60 E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule VOB_ProtectCD_additional: PEiD
{
    strings:
        $a = { 36 3E 26 8A C0 60 E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: COMCRYPT
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B9 00 00 BE 00 01 89 F7 0E 1F 0E 07 BB 00 00 FC AD 31 D8 AB E2 FA C6 06 00 01 00 C6 06 01 01 00 C6 06 02 01 00 E9 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule COMCRYPT: PEiD
{
    strings:
        $a = { B9 00 00 BE 00 01 89 F7 0E 1F 0E 07 BB 00 00 FC AD 31 D8 AB E2 FA C6 06 00 01 00 C6 06 01 01 00 C6 06 02 01 00 E9 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MS_Run_Time_Library_1990_10_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? 2E FF 2E ?? ?? BB ?? ?? E8 ?? ?? CB }

Detection condition:
$a at pe.entry_point

Full rule:
rule MS_Run_Time_Library_1990_10_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E8 ?? ?? 2E FF 2E ?? ?? BB ?? ?? E8 ?? ?? CB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Hymn1865_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? 5E 83 EE 4C FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 ?? ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 50 06 56 1E 0E 1F B8 00 C5 CD 21 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Hymn1865_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E8 ?? ?? 5E 83 EE 4C FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 ?? ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 50 06 56 1E 0E 1F B8 00 C5 CD 21 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_v172_v173_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 E8 C1 ?? ?? 68 F4 86 ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_v172_v173_additional: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 E8 C1 ?? ?? 68 F4 86 ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: dxp_Decrementing_1_byte_XOR
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 30 10 FE CA 48 49 ?? 85 C9 75 F5 }

Detection condition:
$a at pe.entry_point

Full rule:
rule dxp_Decrementing_1_byte_XOR: PEiD
{
    strings:
        $a = { 30 10 FE CA 48 49 ?? 85 C9 75 F5 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PMODEW_133
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FC 16 07 BF 00 01 8B F7 57 B9 5E 16 F3 A5 06 1E 07 1F 5F BE 22 02 06 0E A4 AD 8B E8 B2 10 1E B8 D9 01 50 CB D1 ED FE CA 75 05 AD 8B E8 B2 10 C3 E8 F1 FF 73 0F E8 EC FF 80 D1 01 D0 E1 E8 E4 FF D0 D7 E2 F9 B6 02 B1 04 FE C6 E8 D7 FF 72 1D E2 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PMODEW_133: PEiD
{
    strings:
        $a = { FC 16 07 BF 00 01 8B F7 57 B9 5E 16 F3 A5 06 1E 07 1F 5F BE 22 02 06 0E A4 AD 8B E8 B2 10 1E B8 D9 01 50 CB D1 ED FE CA 75 05 AD 8B E8 B2 10 C3 E8 F1 FF 73 0F E8 EC FF 80 D1 01 D0 E1 E8 E4 FF D0 D7 E2 F9 B6 02 B1 04 FE C6 E8 D7 FF 72 1D E2 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_02_ZCode_101_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_02_ZCode_101_Anorganix: PEiD
{
    strings:
        $a = { E9 12 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E9 FB FF FF FF C3 68 00 00 00 00 64 FF 35 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: eXpressor_v10_CGSoftLabs
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 }

Detection condition:
$a at pe.entry_point

Full rule:
rule eXpressor_v10_CGSoftLabs: PEiD
{
    strings:
        $a = { E9 35 14 00 00 E9 31 13 00 00 E9 98 12 00 00 E9 EF 0C 00 00 E9 42 13 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPX_062_EXE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8C CB B9 00 00 BE 00 00 89 F7 1E A9 B5 80 8D 87 05 00 8E D8 05 00 00 8E C0 FD F3 A5 FC 2E 80 6C 13 10 73 E8 00 00 00 00 00 0E 0E 00 00 00 00 00 00 00 00 00 00 00 CB 55 50 58 21 07 00 02 07 }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPX_062_EXE: PEiD
{
    strings:
        $a = { 8C CB B9 00 00 BE 00 00 89 F7 1E A9 B5 80 8D 87 05 00 8E D8 05 00 00 8E C0 FD F3 A5 FC 2E 80 6C 13 10 73 E8 00 00 00 00 00 0E 0E 00 00 00 00 00 00 00 00 00 00 00 CB 55 50 58 21 07 00 02 07 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Macromedia_Windows_Flash_ProjectorPlayer_v50
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00 }
        $b = { 83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00 00 00 00 50 FF 15 80 61 44 00 F6 44 24 30 01 74 0B 8B 44 24 34 25 FF FF 00 00 EB 05 B8 0A 00 00 00 50 56 6A 00 6A 00 FF 15 74 61 44 00 50 E8 18 00 00 00 50 FF 15 78 61 44 00 5E 83 C4 44 C3 90 90 90 90 90 90 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Macromedia_Windows_Flash_ProjectorPlayer_v50: PEiD
{
    strings:
        $a = { 83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00 }
        $b = { 83 EC 44 56 FF 15 70 61 44 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C 3C 20 7E 08 8A 46 01 46 3C 20 7F F8 8A 06 84 C0 74 0C 3C 20 7F 08 8A 46 01 46 84 C0 75 F4 8D 44 24 04 C7 44 24 30 00 00 00 00 50 FF 15 80 61 44 00 F6 44 24 30 01 74 0B 8B 44 24 34 25 FF FF 00 00 EB 05 B8 0A 00 00 00 50 56 6A 00 6A 00 FF 15 74 61 44 00 50 E8 18 00 00 00 50 FF 15 78 61 44 00 5E 83 C4 44 C3 90 90 90 90 90 90 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: HackStop_115_117_EXE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 00 00 52 BA EB 04 5A EB FB 9A B0 AD E6 64 52 BA EB 04 5A EB FB 9A 1E 52 B8 4D 30 CD 21 86 C4 3D FE 02 73 02 CD 20 52 BA EB 04 5A EB FB 9A 0E 1F E8 02 00 24 24 5A B4 09 CD 21 52 BA EB 04 5A EB FB 9A EB 02 D8 88 5A 1F 52 BA EB 04 5A EB FB }

Detection condition:
$a at pe.entry_point

Full rule:
rule HackStop_115_117_EXE: PEiD
{
    strings:
        $a = { E8 00 00 52 BA EB 04 5A EB FB 9A B0 AD E6 64 52 BA EB 04 5A EB FB 9A 1E 52 B8 4D 30 CD 21 86 C4 3D FE 02 73 02 CD 20 52 BA EB 04 5A EB FB 9A 0E 1F E8 02 00 24 24 5A B4 09 CD 21 52 BA EB 04 5A EB FB 9A EB 02 D8 88 5A 1F 52 BA EB 04 5A EB FB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PE_Armor_046_China_Cracking_Group_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PE_Armor_046_China_Cracking_Group_additional: PEiD
{
    strings:
        $a = { E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Turbo_C_or_Borland_Cpp_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BA ?? ?? 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA }

Detection condition:
$a at pe.entry_point

Full rule:
rule Turbo_C_or_Borland_Cpp_Hint_DOS_EP: PEiD
{
    strings:
        $a = { BA ?? ?? 2E 89 16 ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Morphine_V27_Holy_Father_Ratter29A
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Morphine_V27_Holy_Father_Ratter29A: PEiD
{
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_02_Microsoft_Visual_Basic_50_60
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_02_Microsoft_Visual_Basic_50_60: PEiD
{
    strings:
        $a = { 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AVPack_12x_EXE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 1E 0E 1F 16 07 33 F6 8B FE B9 10 01 FC F3 A5 06 BB 28 00 53 CB 2E 8B 16 0C 00 58 50 03 C2 2E 03 06 0E 00 BE FE FF 8B FE FD 8C D3 BD 00 10 8B CB 2B CA 51 8B CA 3B CD 76 02 8B CD 2B C5 2B DD 8E D8 8E C3 2B D1 D1 E1 D1 E1 D1 E1 F3 A5 0B D2 }

Detection condition:
$a at pe.entry_point

Full rule:
rule AVPack_12x_EXE: PEiD
{
    strings:
        $a = { 50 1E 0E 1F 16 07 33 F6 8B FE B9 10 01 FC F3 A5 06 BB 28 00 53 CB 2E 8B 16 0C 00 58 50 03 C2 2E 03 06 0E 00 BE FE FF 8B FE FD 8C D3 BD 00 10 8B CB 2B CA 51 8B CA 3B CD 76 02 8B CD 2B C5 2B DD 8E D8 8E C3 2B D1 D1 E1 D1 E1 D1 E1 F3 A5 0B D2 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Spalsher_v10_v30
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? 89 AD 8C 01 ?? ?? 8B C5 2B 85 FE 75 ?? ?? 89 85 3E }
        $b = { 9C 60 8B 44 24 24 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 50 E8 ED 02 ?? ?? 8C C0 0F 84 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Spalsher_v10_v30: PEiD
{
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? 89 AD 8C 01 ?? ?? 8B C5 2B 85 FE 75 ?? ?? 89 85 3E }
        $b = { 9C 60 8B 44 24 24 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 50 E8 ED 02 ?? ?? 8C C0 0F 84 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: MS_Run_Time_Library_1990_10
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? 2E FF 2E ?? ?? BB ?? ?? E8 ?? ?? CB }

Detection condition:
$a at pe.entry_point

Full rule:
rule MS_Run_Time_Library_1990_10: PEiD
{
    strings:
        $a = { E8 ?? ?? 2E FF 2E ?? ?? BB ?? ?? E8 ?? ?? CB }
    condition:
        $a at pe.entry_point

}