deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: PEiD_Bundle_V102_BoB_BobSoft
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PEiD_Bundle_V102_BoB_BobSoft: PEiD
{
    strings:
        $a = { 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 36 ?? ?? ?? 2E ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 44 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FOXSQZ_Archive_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 46 4F 58 53 51 5A }

Detection condition:
$a at pe.entry_point

Full rule:
rule FOXSQZ_Archive_Hint_FILE_START: PEiD
{
    strings:
        $a = { 46 4F 58 53 51 5A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Tiny_Xor_v01_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? FC B8 ?? ?? BB ?? ?? B9 ?? ?? BE ?? ?? 30 04 02 C3 86 C4 86 DF 46 E2 ?? BE ?? ?? C7 ?? ?? ?? C6 ?? ?? ?? 33 C0 33 DB 33 C9 FF E6 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Tiny_Xor_v01_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? FC B8 ?? ?? BB ?? ?? B9 ?? ?? BE ?? ?? 30 04 02 C3 86 C4 86 DF 46 E2 ?? BE ?? ?? C7 ?? ?? ?? C6 ?? ?? ?? 33 C0 33 DB 33 C9 FF E6 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CHECKPRG_c_1992
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 33 C0 BE ?? ?? 8B D8 B9 ?? ?? BF ?? ?? BA ?? ?? 47 4A 74 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CHECKPRG_c_1992: PEiD
{
    strings:
        $a = { 33 C0 BE ?? ?? 8B D8 B9 ?? ?? BF ?? ?? BA ?? ?? 47 4A 74 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_13
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D }
        $b = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule FSG_13: PEiD
{
    strings:
        $a = { BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D }
        $b = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: RLP_V073beta_ap0x_Sign_by_fly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 2E 72 6C 70 00 00 00 00 00 50 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 }
        $b = { 60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule RLP_V073beta_ap0x_Sign_by_fly: PEiD
{
    strings:
        $a = { 2E 72 6C 70 00 00 00 00 00 50 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 }
        $b = { 60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: WinZip_32_bit_SFX_v8x_module
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 53 FF 15 ?? ?? ?? 00 B3 22 38 18 74 03 80 C3 FE 8A 48 01 40 33 D2 3A CA 74 0A 3A CB 74 06 8A 48 01 40 EB F2 38 10 74 01 40 ?? ?? ?? ?? FF 15 }

Detection condition:
$a at pe.entry_point

Full rule:
rule WinZip_32_bit_SFX_v8x_module: PEiD
{
    strings:
        $a = { 53 FF 15 ?? ?? ?? 00 B3 22 38 18 74 03 80 C3 FE 8A 48 01 40 33 D2 3A CA 74 0A 3A CB 74 06 8A 48 01 40 EB F2 38 10 74 01 40 ?? ?? ?? ?? FF 15 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: yodas_Protector_10_beta_Ashkbiz_Danehkar_
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule yodas_Protector_10_beta_Ashkbiz_Danehkar_: PEiD
{
    strings:
        $a = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: WinZIP_Self_Extractor
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 33 ED 55 9A FF FF 00 00 0B C0 74 EE 81 C1 00 01 72 E8 89 0E 90 03 89 36 92 03 89 3E 94 03 89 1E 96 03 8C 06 98 03 89 16 9A 03 33 C0 50 9A FF FF 00 00 FF 36 94 03 9A FF FF 00 00 0B C0 74 BB FF 36 94 03 FF 36 92 03 FF 36 98 03 FF 36 96 03 FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule WinZIP_Self_Extractor: PEiD
{
    strings:
        $a = { 33 ED 55 9A FF FF 00 00 0B C0 74 EE 81 C1 00 01 72 E8 89 0E 90 03 89 36 92 03 89 3E 94 03 89 1E 96 03 8C 06 98 03 89 16 9A 03 33 C0 50 9A FF FF 00 00 FF 36 94 03 9A FF FF 00 00 0B C0 74 BB FF 36 94 03 FF 36 92 03 FF 36 98 03 FF 36 96 03 FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: NsPack_31_North_Star_h_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? ?? ?? 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule NsPack_31_North_Star_h_additional: PEiD
{
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? ?? ?? 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Turbo_C_20_1988_COM
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8C CA 2E 89 16 D6 02 B4 30 CD 21 8B 2E 02 00 8B 1E 2C 00 8E DA A3 00 00 8C 06 00 00 89 1E 00 00 89 2E 00 00 C7 06 00 00 FF FF E8 13 01 C4 3E 00 00 8B C7 8B D8 B9 FF 7F 26 81 3D 38 37 75 19 26 8B 55 02 80 FA 3D 75 10 80 E6 DF FF 06 00 00 80 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Turbo_C_20_1988_COM: PEiD
{
    strings:
        $a = { 8C CA 2E 89 16 D6 02 B4 30 CD 21 8B 2E 02 00 8B 1E 2C 00 8E DA A3 00 00 8C 06 00 00 89 1E 00 00 89 2E 00 00 C7 06 00 00 FF FF E8 13 01 C4 3E 00 00 8B C7 8B D8 B9 FF 7F 26 81 3D 38 37 75 19 26 8B 55 02 80 FA 3D 75 10 80 E6 DF FF 06 00 00 80 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Interplays_MVE_file_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 49 6E 74 65 72 70 6C 61 79 20 4D 56 45 20 46 69 6C 65 1A 00 1A }

Detection condition:
$a at pe.entry_point

Full rule:
rule Interplays_MVE_file_Hint_FILE_START: PEiD
{
    strings:
        $a = { 49 6E 74 65 72 70 6C 61 79 20 4D 56 45 20 46 69 6C 65 1A 00 1A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: InstallShield_Custom
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 EC 44 56 FF 15 ?? ?? 41 00 8B F0 85 F6 75 08 6A FF FF 15 ?? ?? 41 00 8A 06 57 8B 3D ?? ?? 41 00 3C 22 75 1B 56 FF D7 8B F0 8A 06 3C 22 74 04 84 C0 75 F1 80 3E 22 75 15 56 FF D7 8B }

Detection condition:
$a at pe.entry_point

Full rule:
rule InstallShield_Custom: PEiD
{
    strings:
        $a = { 55 8B EC 83 EC 44 56 FF 15 ?? ?? 41 00 8B F0 85 F6 75 08 6A FF FF 15 ?? ?? 41 00 8A 06 57 8B 3D ?? ?? 41 00 3C 22 75 1B 56 FF D7 8B F0 8A 06 3C 22 74 04 84 C0 75 F1 80 3E 22 75 15 56 FF D7 8B }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MEW_5_Northfox
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE ?? ?? ?? ?? AD 91 AD 93 53 AD 96 56 5F AC }

Detection condition:
$a at pe.entry_point

Full rule:
rule MEW_5_Northfox: PEiD
{
    strings:
        $a = { BE ?? ?? ?? ?? AD 91 AD 93 53 AD 96 56 5F AC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Turbo_Pascal_v20_1984
Repository: Yara-Rules/rules

Pattern signatures:
$a = { ?? ?? ?? 90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 34 }
        $b = { 90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 34 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Turbo_Pascal_v20_1984: PEiD
{
    strings:
        $a = { ?? ?? ?? 90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 34 }
        $b = { 90 90 CD AB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 38 34 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: REALbasic
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule REALbasic: PEiD
{
    strings:
        $a = { 55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Adobe_PhotoShop_Graphics_format
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 38 42 50 53 00 01 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Adobe_PhotoShop_Graphics_format: PEiD
{
    strings:
        $a = { 38 42 50 53 00 01 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RLPack_Full_Edition_117_LZMA_Ap0x
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 73 26 00 00 8D 9D 58 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A }

Detection condition:
$a at pe.entry_point

Full rule:
rule RLPack_Full_Edition_117_LZMA_Ap0x: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 73 26 00 00 8D 9D 58 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: JDPack_2x_JDPack
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 68 51 40 00 68 04 25 40 00 64 A1 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule JDPack_2x_JDPack: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 68 51 40 00 68 04 25 40 00 64 A1 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Obsidium_V1360_Obsidium_Software_20080730
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 02 ?? ?? 50 EB 01 ?? E8 ?? 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 1F EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 33 C0 EB 01 ?? 64 FF 30 EB 04 ?? ?? ?? ?? 64 89 20 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 00 EB 01 ?? C3 EB 02 ?? ?? E9 ?? 00 00 00 EB 01 ?? E8 ?? FF FF FF EB 01 ?? EB 03 ?? ?? ?? EB 02 ?? ?? EB 02 ?? ?? 64 8F 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsidium_V1360_Obsidium_Software_20080730: PEiD
{
    strings:
        $a = { EB 02 ?? ?? 50 EB 01 ?? E8 ?? 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 1F EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 33 C0 EB 01 ?? 64 FF 30 EB 04 ?? ?? ?? ?? 64 89 20 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 00 EB 01 ?? C3 EB 02 ?? ?? E9 ?? 00 00 00 EB 01 ?? E8 ?? FF FF FF EB 01 ?? EB 03 ?? ?? ?? EB 02 ?? ?? EB 02 ?? ?? 64 8F 00 EB 01 ?? 83 C4 04 EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Audio_CD_file_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 52 49 46 46 ?? ?? ?? ?? 43 44 44 41 66 6D 74 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Audio_CD_file_Hint_FILE_START: PEiD
{
    strings:
        $a = { 52 49 46 46 ?? ?? ?? ?? 43 44 44 41 66 6D 74 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PPC_PROTECT_V10_Alexey_Gorchakov
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FF 5F 2D E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PPC_PROTECT_V10_Alexey_Gorchakov: PEiD
{
    strings:
        $a = { FF 5F 2D E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXE_Shield_V01b_V03b_SMoKE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXE_Shield_V01b_V03b_SMoKE: PEiD
{
    strings:
        $a = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ATT_Group_4_Graphics_format
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 01 00 ?? 00 3A 03 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ATT_Group_4_Graphics_format: PEiD
{
    strings:
        $a = { 01 00 ?? 00 3A 03 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: BeRoEXEPacker_v100_LZBRR_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10 }

Detection condition:
$a at pe.entry_point

Full rule:
rule BeRoEXEPacker_v100_LZBRR_additional: PEiD
{
    strings:
        $a = { 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Enigma_protector_v102_Vladimir_Sukhov_h_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 53 20 50 54 4F 20 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Enigma_protector_v102_Vladimir_Sukhov_h_additional: PEiD
{
    strings:
        $a = { 55 53 20 50 54 4F 20 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: LARP_V20_lena151_20080321
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 01 00 00 00 81 E8 02 00 00 00 81 84 E8 EF 01 00 00 81 84 E8 01 00 00 00 64 E8 02 00 00 00 E8 81 E8 81 00 00 00 C3 81 84 E8 04 00 00 00 01 31 00 00 50 68 23 31 40 00 E8 A1 01 00 00 81 68 D7 17 40 00 3B D1 0F 87 32 04 00 00 0F 86 52 28 00 00 81 84 68 F1 17 40 00 85 C9 0F 85 84 28 00 00 0F 84 42 04 00 00 81 E8 D4 18 00 00 68 5B 50 E8 76 01 00 00 81 84 68 14 18 40 00 68 B3 2C 40 00 85 C0 0F 84 27 28 00 00 0F 85 FA 03 00 00 81 84 58 83 04 24 01 83 C4 04 0B E4 74 04 FF 64 24 FC 81 E8 4B 01 00 00 81 E8 01 00 00 00 84 E8 06 00 00 00 81 84 74 00 81 84 0B E4 74 ?? ?? ?? ?? ?? ?? 00 0B E4 74 02 FF E0 81 E8 00 00 00 00 68 ?? ?? ?? ?? E8 02 00 00 00 75 BA F8 72 02 73 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 E8 FA 00 00 00 81 84 0B E4 74 27 E8 EF 00 00 00 81 84 E8 01 00 00 00 50 E8 02 00 00 00 81 84 0B E4 E8 D9 00 00 00 81 84 74 08 ?? ?? ?? ?? ?? ?? FF E2 }

Detection condition:
$a at pe.entry_point

Full rule:
rule LARP_V20_lena151_20080321: PEiD
{
    strings:
        $a = { E8 01 00 00 00 81 E8 02 00 00 00 81 84 E8 EF 01 00 00 81 84 E8 01 00 00 00 64 E8 02 00 00 00 E8 81 E8 81 00 00 00 C3 81 84 E8 04 00 00 00 01 31 00 00 50 68 23 31 40 00 E8 A1 01 00 00 81 68 D7 17 40 00 3B D1 0F 87 32 04 00 00 0F 86 52 28 00 00 81 84 68 F1 17 40 00 85 C9 0F 85 84 28 00 00 0F 84 42 04 00 00 81 E8 D4 18 00 00 68 5B 50 E8 76 01 00 00 81 84 68 14 18 40 00 68 B3 2C 40 00 85 C0 0F 84 27 28 00 00 0F 85 FA 03 00 00 81 84 58 83 04 24 01 83 C4 04 0B E4 74 04 FF 64 24 FC 81 E8 4B 01 00 00 81 E8 01 00 00 00 84 E8 06 00 00 00 81 84 74 00 81 84 0B E4 74 ?? ?? ?? ?? ?? ?? 00 0B E4 74 02 FF E0 81 E8 00 00 00 00 68 ?? ?? ?? ?? E8 02 00 00 00 75 BA F8 72 02 73 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 E8 FA 00 00 00 81 84 0B E4 74 27 E8 EF 00 00 00 81 84 E8 01 00 00 00 50 E8 02 00 00 00 81 84 0B E4 E8 D9 00 00 00 81 84 74 08 ?? ?? ?? ?? ?? ?? FF E2 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PUNiSHER_v15_DEMO_FEUERRADERAHTeam
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04 }
        $b = { EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04 24 EB 04 64 6B 88 18 89 85 9C C2 41 00 EB 04 64 6B 88 18 58 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 C2 50 00 EB D3 5B F3 68 89 5C 24 48 5C 24 58 FF 8D 5C 24 58 5B 83 C3 4C 75 F4 5A 8D 71 78 75 09 81 F3 EB FF 52 BA 01 00 83 EB FC 4A FF 71 0F 75 19 8B 5C 24 00 00 81 33 50 53 8B 1B 0F FF C6 75 1B 81 F3 EB 87 1C 24 8B 8B 04 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 58 EB FF F0 EB FF C0 83 E8 FD EB FF 30 E8 C9 00 00 00 89 E0 EB FF D0 EB FF 71 0F 83 C0 01 EB F

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule PUNiSHER_v15_DEMO_FEUERRADERAHTeam: PEiD
{
    strings:
        $a = { EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04 }
        $b = { EB 04 83 A4 BC CE 60 EB 04 80 BC 04 11 E8 00 00 00 00 81 2C 24 CA C2 41 00 EB 04 64 6B 88 18 5D E8 00 00 00 00 EB 04 64 6B 88 18 81 2C 24 86 00 00 00 EB 04 64 6B 88 18 8B 85 9C C2 41 00 EB 04 64 6B 88 18 29 04 24 EB 04 64 6B 88 18 EB 04 64 6B 88 18 8B 04 24 EB 04 64 6B 88 18 89 85 9C C2 41 00 EB 04 64 6B 88 18 58 68 9F 6F 56 B6 50 E8 5D 00 00 00 EB FF 71 78 C2 50 00 EB D3 5B F3 68 89 5C 24 48 5C 24 58 FF 8D 5C 24 58 5B 83 C3 4C 75 F4 5A 8D 71 78 75 09 81 F3 EB FF 52 BA 01 00 83 EB FC 4A FF 71 0F 75 19 8B 5C 24 00 00 81 33 50 53 8B 1B 0F FF C6 75 1B 81 F3 EB 87 1C 24 8B 8B 04 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 58 EB FF F0 EB FF C0 83 E8 FD EB FF 30 E8 C9 00 00 00 89 E0 EB FF D0 EB FF 71 0F 83 C0 01 EB FF 70 F0 71 EE EB FA EB 83 C0 14 EB FF 70 ED }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Enigma_protector_110111_Vladimir_Sukhov
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 }
        $b = { 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E EB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 01 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 05 F

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Enigma_protector_110111_Vladimir_Sukhov: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 }
        $b = { 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E EB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 01 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 05 F6 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 B9 3D 1A }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Solidshield_Protector_V1X_Solidshield_Technologies_SignByfly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 00 60 89 00 0A 00 00 00 46 33 00 00 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Solidshield_Protector_V1X_Solidshield_Technologies_SignByfly: PEiD
{
    strings:
        $a = { 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 00 60 89 00 0A 00 00 00 46 33 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_TravJack883
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB ?? 9C 9E 26 ?? ?? 51 04 ?? 7D ?? 00 ?? 2E ?? ?? ?? ?? 8C C8 8E C0 8E D8 80 ?? ?? ?? ?? 74 ?? 8A ?? ?? ?? BB ?? ?? 8A ?? 32 C2 88 ?? FE C2 43 81 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_TravJack883: PEiD
{
    strings:
        $a = { EB ?? 9C 9E 26 ?? ?? 51 04 ?? 7D ?? 00 ?? 2E ?? ?? ?? ?? 8C C8 8E C0 8E D8 80 ?? ?? ?? ?? 74 ?? 8A ?? ?? ?? BB ?? ?? 8A ?? 32 C2 88 ?? FE C2 43 81 }
    condition:
        $a at pe.entry_point

}