deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: EXECryptor2xxcompressedresources
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F C1 EA 05 74 2D 4A 74 15 8D 5C 13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3 05 8D 5C 03 04 46 89 FA 0F B7 0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1 E8 05 73 07 43 89 F2 01 DE EB 06 85 DB 74 0E EB A9 56 89 D6 89 D9 F3 A4 31 DB 5E EB 9D 89 F0 5B 5F 5E C3 }

Detection condition:
$a0

Full rule:
rule EXECryptor2xxcompressedresources
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F C1 EA 05 74 2D 4A 74 15 8D 5C 13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3 05 8D 5C 03 04 46 89 FA 0F B7 0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1 E8 05 73 07 43 89 F2 01 DE EB 06 85 DB 74 0E EB A9 56 89 D6 89 D9 F3 A4 31 DB 5E EB 9D 89 F0 5B 5F 5E C3 }

condition:
		$a0
}
YARA Detection Rule: NXPEPackerv10
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { FF 60 FF CA FF 00 BA DC 0D E0 40 00 50 00 60 00 70 00 80 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule NXPEPackerv10
{
      meta:
		author="malware-lu"
strings:
		$a0 = { FF 60 FF CA FF 00 BA DC 0D E0 40 00 50 00 60 00 70 00 80 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PolyBoxCAnskya
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 F0 53 56 B8 E4 41 00 10 E8 3A E1 FF FF 33 C0 55 68 11 44 00 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 6A 0A 68 20 44 00 10 A1 1C 71 00 10 50 E8 CC E1 [4] 85 DB 0F 84 77 01 00 00 53 A1 1C 71 00 10 50 E8 1E E2 FF FF 8B F0 85 F6 0F 84 61 01 00 00 53 A1 1C 71 00 10 50 E8 E0 E1 FF FF 85 C0 0F 84 4D 01 00 00 50 E8 DA E1 FF FF 8B D8 85 DB 0F 84 3D 01 00 00 56 B8 70 80 00 10 B9 01 00 00 00 8B 15 98 41 00 10 E8 9E DE FF FF 83 C4 04 A1 70 80 00 10 8B CE 8B D3 E8 E1 E1 FF FF 6A 00 6A 00 A1 70 80 00 10 B9 30 44 00 10 8B D6 E8 F8 FD FF FF }

Detection condition:
$a0

Full rule:
rule PolyBoxCAnskya
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 F0 53 56 B8 E4 41 00 10 E8 3A E1 FF FF 33 C0 55 68 11 44 00 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 6A 0A 68 20 44 00 10 A1 1C 71 00 10 50 E8 CC E1 [4] 85 DB 0F 84 77 01 00 00 53 A1 1C 71 00 10 50 E8 1E E2 FF FF 8B F0 85 F6 0F 84 61 01 00 00 53 A1 1C 71 00 10 50 E8 E0 E1 FF FF 85 C0 0F 84 4D 01 00 00 50 E8 DA E1 FF FF 8B D8 85 DB 0F 84 3D 01 00 00 56 B8 70 80 00 10 B9 01 00 00 00 8B 15 98 41 00 10 E8 9E DE FF FF 83 C4 04 A1 70 80 00 10 8B CE 8B D3 E8 E1 E1 FF FF 6A 00 6A 00 A1 70 80 00 10 B9 30 44 00 10 8B D6 E8 F8 FD FF FF }

condition:
		$a0
}
YARA Detection Rule: UPolyXv05
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC ?? 00 BD 46 00 8B ?? B9 ?? 00 00 00 80 [2] 51 [4] 00 [26] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
	$a1 = { 83 EC 04 89 14 24 59 BA ?? 00 00 00 52 [56] 00 [13] 00 }
	$a2 = { BB 00 BD 46 00 83 EC 04 89 1C 24 ?? B9 ?? 00 00 00 80 33 [6] 00 [13] 00 [12] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
	$a3 = { E8 00 00 00 00 59 83 C1 07 51 C3 C3 ?? 00 BD 46 00 83 EC 04 89 ?? 24 B9 ?? 00 00 00 81 [4] 00 [21] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
	$a4 = { E8 00 00 00 00 59 83 C1 07 51 C3 C3 ?? 00 BD 46 00 ?? B9 ?? 00 00 00 [27] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
	$a5 = { EB 01 C3 ?? 00 BD 46 00 [46] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a0 or $a1 or $a2 or $a3 or $a4 or $a5

Full rule:
rule UPolyXv05
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC ?? 00 BD 46 00 8B ?? B9 ?? 00 00 00 80 [2] 51 [4] 00 [26] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
	$a1 = { 83 EC 04 89 14 24 59 BA ?? 00 00 00 52 [56] 00 [13] 00 }
	$a2 = { BB 00 BD 46 00 83 EC 04 89 1C 24 ?? B9 ?? 00 00 00 80 33 [6] 00 [13] 00 [12] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
	$a3 = { E8 00 00 00 00 59 83 C1 07 51 C3 C3 ?? 00 BD 46 00 83 EC 04 89 ?? 24 B9 ?? 00 00 00 81 [4] 00 [21] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
	$a4 = { E8 00 00 00 00 59 83 C1 07 51 C3 C3 ?? 00 BD 46 00 ?? B9 ?? 00 00 00 [27] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
	$a5 = { EB 01 C3 ?? 00 BD 46 00 [46] 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

condition:
		$a0 or $a1 or $a2 or $a3 or $a4 or $a5
}
YARA Detection Rule: beriav007publicWIPsymbiont
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 83 EC 18 53 8B 1D 00 30 [2] 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 [2] FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 [2] FF D3 8B F0 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule beriav007publicWIPsymbiont
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 EC 18 53 8B 1D 00 30 [2] 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 [2] FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 [2] FF D3 8B F0 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PCGuardv405dv410dv415d
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { FC 55 50 E8 00 00 00 00 5D EB 01 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PCGuardv405dv410dv415d
{
      meta:
		author="malware-lu"
strings:
		$a0 = { FC 55 50 E8 00 00 00 00 5D EB 01 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: asscrypterbysantasdad
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 EC 53 [4] 89 45 EC B8 98 40 00 10 E8 AC EA FF FF 33 C0 55 68 78 51 00 10 64 [4] 20 6A 0A 68 88 51 00 10 A1 E0 97 00 10 50 E8 D8 EA FF FF 8B D8 53 A1 E0 97 00 10 50 E8 12 EB FF FF 8B F8 53 A1 E0 97 00 10 50 E8 DC EA FF FF 8B D8 53 E8 DC EA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 F0 97 00 10 E8 C9 E7 FF FF B8 F0 97 00 10 E8 B7 E7 FF FF 8B CF 8B D6 E8 EE EA FF FF 53 E8 98 EA FF FF 8D 4D EC BA 9C 51 00 10 A1 F0 97 00 10 E8 22 EB FF FF 8B 55 EC B8 F0 97 00 10 E8 89 E6 FF FF B8 F0 97 00 10 E8 7F E7 FF FF E8 6E EC FF FF 33 C0 5A 59 59 64 89 10 68 7F 51 00 10 8D 45 EC E8 11 E6 FF FF C3 E9 FF DF FF FF EB F0 5F 5E 5B E8 0D E5 FF FF 00 53 45 54 54 49 4E 47 53 00 00 00 00 FF FF FF FF 1C 00 00 00 45 4E 54 45 52 20 59 4F 55 52 20 4F 57 4E 20 50 41 53 53 57 4F 52 44 20 48 45 52 45 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule asscrypterbysantasdad
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 EC 53 [4] 89 45 EC B8 98 40 00 10 E8 AC EA FF FF 33 C0 55 68 78 51 00 10 64 [4] 20 6A 0A 68 88 51 00 10 A1 E0 97 00 10 50 E8 D8 EA FF FF 8B D8 53 A1 E0 97 00 10 50 E8 12 EB FF FF 8B F8 53 A1 E0 97 00 10 50 E8 DC EA FF FF 8B D8 53 E8 DC EA FF FF 8B F0 85 F6 74 26 8B D7 4A B8 F0 97 00 10 E8 C9 E7 FF FF B8 F0 97 00 10 E8 B7 E7 FF FF 8B CF 8B D6 E8 EE EA FF FF 53 E8 98 EA FF FF 8D 4D EC BA 9C 51 00 10 A1 F0 97 00 10 E8 22 EB FF FF 8B 55 EC B8 F0 97 00 10 E8 89 E6 FF FF B8 F0 97 00 10 E8 7F E7 FF FF E8 6E EC FF FF 33 C0 5A 59 59 64 89 10 68 7F 51 00 10 8D 45 EC E8 11 E6 FF FF C3 E9 FF DF FF FF EB F0 5F 5E 5B E8 0D E5 FF FF 00 53 45 54 54 49 4E 47 53 00 00 00 00 FF FF FF FF 1C 00 00 00 45 4E 54 45 52 20 59 4F 55 52 20 4F 57 4E 20 50 41 53 53 57 4F 52 44 20 48 45 52 45 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: CopyControlv303
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { CC 90 90 EB 0B 01 50 51 52 53 54 61 33 61 2D 35 CA D1 07 52 D1 A1 3C }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule CopyControlv303
{
      meta:
		author="malware-lu"
strings:
		$a0 = { CC 90 90 EB 0B 01 50 51 52 53 54 61 33 61 2D 35 CA D1 07 52 D1 A1 3C }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: FSGv110Engbartxt
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BB D0 01 40 00 BF 00 10 40 00 BE [3] 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule FSGv110Engbartxt
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BB D0 01 40 00 BF 00 10 40 00 BE [3] 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Elanguage
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 06 00 00 00 50 E8 ?? 01 00 00 55 8B EC 81 C4 F0 FE FF FF }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Elanguage
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 06 00 00 00 50 E8 ?? 01 00 00 55 8B EC 81 C4 F0 FE FF FF }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: EXELOCK66615
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BA [2] BF [2] EB ?? EA [4] 79 ?? 7F ?? 7E ?? 1C ?? 48 78 ?? E3 ?? 45 14 ?? 5A E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule EXELOCK66615
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BA [2] BF [2] EB ?? EA [4] 79 ?? 7F ?? 7E ?? 1C ?? 48 78 ?? E3 ?? 45 14 ?? 5A E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AdysGluev010
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 2E 8C 06 [2] 0E 07 33 C0 8E D8 BE [2] BF [2] FC B9 [2] 56 F3 A5 1E 07 5F }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AdysGluev010
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 2E 8C 06 [2] 0E 07 33 C0 8E D8 BE [2] BF [2] FC B9 [2] 56 F3 A5 1E 07 5F }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SVKProtectorv132
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SVKProtectorv132
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PKLITEv114v115v1203
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 [2] BA [2] 05 [2] 3B [3] 72 ?? B4 09 BA ?? 01 CD 21 CD 20 4E 6F }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PKLITEv114v115v1203
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [2] BA [2] 05 [2] 3B [3] 72 ?? B4 09 BA ?? 01 CD 21 CD 20 4E 6F }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SafeGuardV10Xsimonzh2000
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 00 00 00 00 EB 29 [26] 59 9C 81 C1 E2 FF FF FF EB 01 ?? 9D FF E1 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule SafeGuardV10Xsimonzh2000
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 EB 29 [26] 59 9C 81 C1 E2 FF FF FF EB 01 ?? 9D FF E1 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PEiDBundlev102v103DLLBoBBobSoft
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 83 7C 24 08 01 0F 85 [4] 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 00 08 00 39 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PEiDBundlev102v103DLLBoBBobSoft
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 83 7C 24 08 01 0F 85 [4] 60 E8 9C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 00 08 00 39 00 08 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 01 00 00 80 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: FreeJoinerSmallbuild023GlOFF
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 E1 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule FreeJoinerSmallbuild023GlOFF
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 E1 FD FF FF 6A 00 E8 0C 00 00 00 FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PrivatePersonalPackerPPP102ConquestOfTroycom
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 E8 D3 03 00 00 A3 20 37 00 10 50 6A 00 E8 DE 03 00 00 A3 24 37 00 10 FF 35 20 37 00 10 6A 00 E8 EA 03 00 00 A3 30 37 00 10 FF 35 24 37 00 10 E8 C2 03 00 00 A3 28 37 00 10 8B 0D 30 37 00 10 8B 3D 28 37 00 10 EB 09 49 C0 04 39 55 80 34 39 24 0B C9 }

Detection condition:
$a0

Full rule:
rule PrivatePersonalPackerPPP102ConquestOfTroycom
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 E8 D3 03 00 00 A3 20 37 00 10 50 6A 00 E8 DE 03 00 00 A3 24 37 00 10 FF 35 20 37 00 10 6A 00 E8 EA 03 00 00 A3 30 37 00 10 FF 35 24 37 00 10 E8 C2 03 00 00 A3 28 37 00 10 8B 0D 30 37 00 10 8B 3D 28 37 00 10 EB 09 49 C0 04 39 55 80 34 39 24 0B C9 }

condition:
		$a0
}
YARA Detection Rule: DIETv102bv110av120
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { BE [2] BF [2] B9 [2] 3B FC 72 ?? B4 4C CD 21 FD F3 A5 FC }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule DIETv102bv110av120
{
      meta:
		author="malware-lu"
strings:
		$a0 = { BE [2] BF [2] B9 [2] 3B FC 72 ?? B4 4C CD 21 FD F3 A5 FC }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: UPXECLiPSElayer
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B8 [4] B9 [4] 33 D2 EB 01 0F 56 EB 01 0F E8 03 00 00 00 EB 01 0F EB 01 0F 5E EB 01 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule UPXECLiPSElayer
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B8 [4] B9 [4] 33 D2 EB 01 0F 56 EB 01 0F E8 03 00 00 00 EB 01 0F EB 01 0F 5E EB 01 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Obsidium1334ObsidiumSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 02 [2] E8 29 00 00 00 EB 03 [3] EB 02 [2] 8B 54 24 0C EB 03 [3] 83 82 B8 00 00 00 25 EB 02 [2] 33 C0 EB 02 [2] C3 EB 03 [3] EB 01 ?? 64 67 FF 36 00 00 EB 02 [2] 64 67 89 26 00 00 EB 02 [2] EB 04 [4] 50 EB 02 [2] 33 }
	$a1 = { EB 02 [2] E8 29 00 00 00 EB 03 [3] EB 02 [2] 8B 54 24 0C EB 03 [3] 83 82 B8 00 00 00 25 EB 02 [2] 33 C0 EB 02 [2] C3 EB 03 [3] EB 01 ?? 64 67 FF 36 00 00 EB 02 [2] 64 67 89 26 00 00 EB 02 [2] EB 04 [4] 50 EB 02 [2] 33 C0 EB 01 ?? 8B 00 EB 04 [4] C3 EB 03 [3] E9 FA 00 00 00 EB 02 [2] E8 D5 FF FF FF EB 02 [2] EB 03 [3] 58 EB 02 [2] EB 03 [3] 64 67 8F 06 00 00 EB 03 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule Obsidium1334ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 [2] E8 29 00 00 00 EB 03 [3] EB 02 [2] 8B 54 24 0C EB 03 [3] 83 82 B8 00 00 00 25 EB 02 [2] 33 C0 EB 02 [2] C3 EB 03 [3] EB 01 ?? 64 67 FF 36 00 00 EB 02 [2] 64 67 89 26 00 00 EB 02 [2] EB 04 [4] 50 EB 02 [2] 33 }
	$a1 = { EB 02 [2] E8 29 00 00 00 EB 03 [3] EB 02 [2] 8B 54 24 0C EB 03 [3] 83 82 B8 00 00 00 25 EB 02 [2] 33 C0 EB 02 [2] C3 EB 03 [3] EB 01 ?? 64 67 FF 36 00 00 EB 02 [2] 64 67 89 26 00 00 EB 02 [2] EB 04 [4] 50 EB 02 [2] 33 C0 EB 01 ?? 8B 00 EB 04 [4] C3 EB 03 [3] E9 FA 00 00 00 EB 02 [2] E8 D5 FF FF FF EB 02 [2] EB 03 [3] 58 EB 02 [2] EB 03 [3] 64 67 8F 06 00 00 EB 03 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: PKLITEv150Devicedrivercompression
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { B4 09 BA 14 01 CD 21 B8 00 4C CD 21 F8 9C 50 53 51 52 56 57 55 1E 06 BB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PKLITEv150Devicedrivercompression
{
      meta:
		author="malware-lu"
strings:
		$a0 = { B4 09 BA 14 01 CD 21 B8 00 4C CD 21 F8 9C 50 53 51 52 56 57 55 1E 06 BB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxGrazie883
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 1E 0E 1F 50 06 BF 70 03 B4 1A BA 70 03 CD 21 B4 47 B2 00 BE 32 04 CD 21 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxGrazie883
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 1E 0E 1F 50 06 BF 70 03 B4 1A BA 70 03 CD 21 B4 47 B2 00 BE 32 04 CD 21 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PROTECTEXECOMv60
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 1E B4 30 CD 21 3C 02 73 ?? CD 20 BE [2] E8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PROTECTEXECOMv60
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 1E B4 30 CD 21 3C 02 73 ?? CD 20 BE [2] E8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ENIGMAProtectorSukhovVladimir
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 45 6E 69 67 6D 61 20 70 72 6F 74 65 63 74 6F 72 20 76 31 }

Detection condition:
$a0

Full rule:
rule ENIGMAProtectorSukhovVladimir
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 45 6E 69 67 6D 61 20 70 72 6F 74 65 63 74 6F 72 20 76 31 }

condition:
		$a0
}
YARA Detection Rule: CRYPToCRACksPEProtectorV093LukasFleischer
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule CRYPToCRACksPEProtectorV093LukasFleischer
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PECompactv147v150
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 5B 12 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECompactv147v150
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 5B 12 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PocketPCMIB
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF [3] 0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F [3] 0C 24 00 A7 8F [3] 0C 25 20 40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF ?? 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PocketPCMIB
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF [3] 0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F [3] 0C 24 00 A7 8F [3] 0C 25 20 40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF ?? 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: WWPACKv305c4ExtractableVirusShield
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 03 05 40 1A B8 [2] 8C CA 03 D0 8C C9 81 C1 [2] 51 B9 [2] 51 06 06 B1 ?? 51 8C D3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule WWPACKv305c4ExtractableVirusShield
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 03 05 40 1A B8 [2] 8C CA 03 D0 8C C9 81 C1 [2] 51 B9 [2] 51 06 06 B1 ?? 51 8C D3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: VxNoon1163
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 [2] 5B 50 56 B4 CB CD 21 3C 07 [2] 81 [3] 2E [2] 4D 5A [2] BF 00 01 89 DE FC }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxNoon1163
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 [2] 5B 50 56 B4 CB CD 21 3C 07 [2] 81 [3] 2E [2] 4D 5A [2] BF 00 01 89 DE FC }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PuNkMoD1xPuNkDuDe
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 94 B9 [2] 00 00 BC [4] 80 34 0C }

Detection condition:
$a0

Full rule:
rule PuNkMoD1xPuNkDuDe
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 94 B9 [2] 00 00 BC [4] 80 34 0C }

condition:
		$a0
}
YARA Detection Rule: PECrypt32Consolev10v101v102
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECrypt32Consolev10v101v102
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: InnoSetupModulev2018
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 73 71 FF FF E8 DA 85 FF FF E8 81 A7 FF FF E8 C8 }

Detection condition:
$a0

Full rule:
rule InnoSetupModulev2018
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 73 71 FF FF E8 DA 85 FF FF E8 81 A7 FF FF E8 C8 }

condition:
		$a0
}
YARA Detection Rule: Nakedbind10nakedcrew
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B 4D 5A 74 08 81 EB 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Nakedbind10nakedcrew
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B 4D 5A 74 08 81 EB 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NsPacKV31LiuXingPing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D [4] 8A 03 3C 00 74 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule NsPacKV31LiuXingPing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D [4] 8A 03 3C 00 74 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: AntiVirusVaccinev103
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { FA 33 DB B9 [2] 0E 1F 33 F6 FC AD 35 [2] 03 D8 E2 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule AntiVirusVaccinev103
{
      meta:
		author="malware-lu"
strings:
		$a0 = { FA 33 DB B9 [2] 0E 1F 33 F6 FC AD 35 [2] 03 D8 E2 }

condition:
		$a0 at pe.entry_point
}