deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: ObsidiumV1300ObsidiumSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 04 [4] E8 29 00 00 00 }
	$a1 = { EB 04 [4] E8 ?? 00 00 00 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule ObsidiumV1300ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 04 [4] E8 29 00 00 00 }
	$a1 = { EB 04 [4] E8 ?? 00 00 00 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: PCryptv351
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 50 43 52 59 50 54 FF 76 33 2E 35 31 00 E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PCryptv351
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 50 43 52 59 50 54 FF 76 33 2E 35 31 00 E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ThinstallEmbedded2312Jitit
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 6A 00 FF 15 [4] E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ThinstallEmbedded2312Jitit
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 6A 00 FF 15 [4] E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: WWPACKv305c4Extractable
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 03 05 00 1A B8 [2] 8C CA 03 D0 8C C9 81 C1 [2] 51 B9 [2] 51 06 06 B1 ?? 51 8C D3 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule WWPACKv305c4Extractable
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 03 05 00 1A B8 [2] 8C CA 03 D0 8C C9 81 C1 [2] 51 B9 [2] 51 06 06 B1 ?? 51 8C D3 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: RLPackAp0x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 CD 09 00 00 89 85 14 0A 00 00 EB 14 60 FF B5 14 0A }
	$a1 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 EB 09 00 00 89 85 3A 0A 00 00 EB 14 60 FF B5 3A 0A }
	$a2 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 0C 00 00 EB 03 0C 00 00 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 47 02 00 00 EB 03 15 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 9B 0A }
	$a3 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8 [4] 6A 40 68 [4] 68 [4] 6A 00 FF 95 CD 09 00 00 89 85 [4] EB 14 60 FF B5 14 0A }
	$a4 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 [4] 6A 40 68 [4] 68 [4] 6A 00 FF 95 EB 09 00 00 89 85 [4] EB 14 60 FF B5 3A 0A }
	$a5 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point or $a3 at pe.entry_point or $a4 at pe.entry_point or $a5 at pe.entry_point

Full rule:
rule RLPackAp0x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 CD 09 00 00 89 85 14 0A 00 00 EB 14 60 FF B5 14 0A }
	$a1 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 EB 09 00 00 89 85 3A 0A 00 00 EB 14 60 FF B5 3A 0A }
	$a2 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 0C 00 00 EB 03 0C 00 00 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 47 02 00 00 EB 03 15 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 9B 0A }
	$a3 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 2C 0A 00 00 8D 9D 22 02 00 00 33 FF E8 [4] 6A 40 68 [4] 68 [4] 6A 00 FF 95 CD 09 00 00 89 85 [4] EB 14 60 FF B5 14 0A }
	$a4 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 [4] 6A 40 68 [4] 68 [4] 6A 00 FF 95 EB 09 00 00 89 85 [4] EB 14 60 FF B5 3A 0A }
	$a5 = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 [3] EB 03 [3] 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 [4] EB 03 [3] 6A 40 68 [4] 68 [4] 6A 00 FF 95 9B 0A }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point or $a2 at pe.entry_point or $a3 at pe.entry_point or $a4 at pe.entry_point or $a5 at pe.entry_point
}
YARA Detection Rule: PseudoSigner02VOBProtectCD5Anorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 36 3E 26 8A C0 60 E8 00 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02VOBProtectCD5Anorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 36 3E 26 8A C0 60 E8 00 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PESpinv04x
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 01 68 60 E8 00 00 00 00 8B }

Detection condition:
$a0

Full rule:
rule PESpinv04x
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 68 60 E8 00 00 00 00 8B }

condition:
		$a0
}
YARA Detection Rule: PseudoSigner02WatcomCCDLLAnorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87 01 00 00 00 F1 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner02WatcomCCDLLAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87 01 00 00 00 F1 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: yodasCrypter13AshkbizDanehkar
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00 81 E9 C6 28 40 00 8B D5 81 C2 C6 28 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule yodasCrypter13AshkbizDanehkar
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00 81 E9 C6 28 40 00 8B D5 81 C2 C6 28 40 00 8D 3A 8B F7 33 C0 EB 04 90 EB 01 C2 AC }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: D1NS1GD1N
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 18 37 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 [2] 18 37 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 [2] 18 37 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 [2] 18 37 00 00 00 00 00 00 01 00 00 00 00 00 78 00 00 00 B0 F0 00 00 10 00 00 00 00 00 00 00 00 00 00 00 C0 F0 00 00 60 00 00 00 00 00 00 00 00 00 00 00 06 00 44 00 56 00 43 00 4C 00 41 00 4C 00 0B 00 50 00 41 00 43 00 4B 00 41 00 47 00 45 00 49 00 4E 00 46 00 4F 00 00 00 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a0

Full rule:
rule D1NS1GD1N
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 18 37 00 00 00 00 00 00 01 00 0A 00 00 00 18 00 00 80 00 00 00 00 [2] 18 37 00 00 00 00 02 00 00 00 88 00 00 80 38 00 00 80 96 00 00 80 50 00 00 80 00 00 00 00 [2] 18 37 00 00 00 00 00 00 01 00 00 00 00 00 68 00 00 00 00 00 00 00 [2] 18 37 00 00 00 00 00 00 01 00 00 00 00 00 78 00 00 00 B0 F0 00 00 10 00 00 00 00 00 00 00 00 00 00 00 C0 F0 00 00 60 00 00 00 00 00 00 00 00 00 00 00 06 00 44 00 56 00 43 00 4C 00 41 00 4C 00 0B 00 50 00 41 00 43 00 4B 00 41 00 47 00 45 00 49 00 4E 00 46 00 4F 00 00 00 00 00 00 00 00 00 00 00 00 00 }

condition:
		$a0
}
YARA Detection Rule: FSGv110EngdulekxtMicrosoftVisualC6070ASM
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 01 00 00 00 5A 5E E8 02 00 00 00 BA DD 5E 03 F2 EB 01 64 BB 80 [2] 00 8B FA EB 01 A8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule FSGv110EngdulekxtMicrosoftVisualC6070ASM
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 01 00 00 00 5A 5E E8 02 00 00 00 BA DD 5E 03 F2 EB 01 64 BB 80 [2] 00 8B FA EB 01 A8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ASPackv102aAlexeySolodovnikov
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 60 E8 [4] 5D 81 ED 3E D9 43 ?? B8 38 [3] 03 C5 2B 85 0B DE 43 ?? 89 85 17 DE 43 ?? 80 BD 01 DE 43 [2] 75 15 FE 85 01 DE 43 ?? E8 1D [3] E8 79 02 [2] E8 12 03 [2] 8B 85 03 DE 43 ?? 03 85 17 DE 43 ?? 89 44 24 1C 61 FF }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ASPackv102aAlexeySolodovnikov
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 60 E8 [4] 5D 81 ED 3E D9 43 ?? B8 38 [3] 03 C5 2B 85 0B DE 43 ?? 89 85 17 DE 43 ?? 80 BD 01 DE 43 [2] 75 15 FE 85 01 DE 43 ?? E8 1D [3] E8 79 02 [2] E8 12 03 [2] 8B 85 03 DE 43 ?? 03 85 17 DE 43 ?? 89 44 24 1C 61 FF }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PseudoSigner01MinGWGCC2xAnorganix
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 E9 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PseudoSigner01MinGWGCC2xAnorganix
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 89 E5 E8 02 00 00 00 C9 C3 90 90 45 58 45 E9 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Armadillov253
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 40 [3] 68 54 [3] 64 A1 [4] 50 64 89 25 [4] 83 EC 58 53 56 57 89 65 E8 FF 15 58 [3] 33 D2 8A D4 89 15 EC }
	$a1 = { 55 8B EC 6A FF 68 [4] 40 [4] 68 54 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF [3] 15 58 33 D2 8A D4 89 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule Armadillov253
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 40 [3] 68 54 [3] 64 A1 [4] 50 64 89 25 [4] 83 EC 58 53 56 57 89 65 E8 FF 15 58 [3] 33 D2 8A D4 89 15 EC }
	$a1 = { 55 8B EC 6A FF 68 [4] 40 [4] 68 54 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF [3] 15 58 33 D2 8A D4 89 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: Armadillov252
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 [4] E0 [4] 68 D4 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF [3] 15 38 }
	$a1 = { 55 8B EC 6A FF 68 E0 [3] 68 D4 [3] 64 A1 [4] 50 64 89 25 [4] 83 EC 58 53 56 57 89 65 E8 FF 15 38 }

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule Armadillov252
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 [4] E0 [4] 68 D4 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF [3] 15 38 }
	$a1 = { 55 8B EC 6A FF 68 E0 [3] 68 D4 [3] 64 A1 [4] 50 64 89 25 [4] 83 EC 58 53 56 57 89 65 E8 FF 15 38 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: Armadillov251
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 B8 [3] 68 D0 [3] 64 A1 [4] 50 64 89 25 [4] 83 EC 58 53 56 57 89 65 E8 FF 15 20 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Armadillov251
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 B8 [3] 68 D0 [3] 64 A1 [4] 50 64 89 25 [4] 83 EC 58 53 56 57 89 65 E8 FF 15 20 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Armadillov250
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 6A FF 68 B8 [3] 68 F8 [3] 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 20 [3] 33 D2 8A D4 89 15 D0 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Armadillov250
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 6A FF 68 B8 [3] 68 F8 [3] 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 20 [3] 33 D2 8A D4 89 15 D0 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: Obsidium1331ObsidiumSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 01 ?? E8 29 00 00 00 EB 02 [2] EB 03 [3] 8B 54 24 0C EB 02 [2] 83 82 B8 00 00 00 24 EB 04 [4] 33 C0 EB 02 [2] C3 EB 02 [2] EB 02 [2] 64 67 FF 36 00 00 EB 04 [4] 64 67 89 26 00 00 EB 01 ?? EB 02 [2] 50 EB 01 ?? 33 C0 EB 04 [4] 8B 00 EB 03 [3] C3 EB 03 [3] E9 FA 00 00 00 EB 02 [2] E8 D5 FF FF FF EB 01 ?? EB 04 [4] 58 EB 02 [2] EB 04 [4] 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 02 [2] E8 5F 27 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule Obsidium1331ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 01 ?? E8 29 00 00 00 EB 02 [2] EB 03 [3] 8B 54 24 0C EB 02 [2] 83 82 B8 00 00 00 24 EB 04 [4] 33 C0 EB 02 [2] C3 EB 02 [2] EB 02 [2] 64 67 FF 36 00 00 EB 04 [4] 64 67 89 26 00 00 EB 01 ?? EB 02 [2] 50 EB 01 ?? 33 C0 EB 04 [4] 8B 00 EB 03 [3] C3 EB 03 [3] E9 FA 00 00 00 EB 02 [2] E8 D5 FF FF FF EB 01 ?? EB 04 [4] 58 EB 02 [2] EB 04 [4] 64 67 8F 06 00 00 EB 01 ?? 83 C4 04 EB 02 [2] E8 5F 27 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: CExev10a
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 8B EC 81 EC 0C 02 [2] 56 BE 04 01 [2] 8D 85 F8 FE FF FF 56 50 6A ?? FF 15 54 10 40 ?? 8A 8D F8 FE FF FF 33 D2 84 C9 8D 85 F8 FE FF FF 74 16 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule CExev10a
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 8B EC 81 EC 0C 02 [2] 56 BE 04 01 [2] 8D 85 F8 FE FF FF 56 50 6A ?? FF 15 54 10 40 ?? 8A 8D F8 FE FF FF 33 D2 84 C9 8D 85 F8 FE FF FF 74 16 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: DIETv144v145f
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { F8 9C 06 1E 57 56 52 51 53 50 0E FC 8C C8 BA [2] 03 D0 52 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule DIETv144v145f
{
      meta:
		author="malware-lu"
strings:
		$a0 = { F8 9C 06 1E 57 56 52 51 53 50 0E FC 8C C8 BA [2] 03 D0 52 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PECompactv098
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D7 84 40 ?? 87 DD 8B 85 5C 85 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECompactv098
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D7 84 40 ?? 87 DD 8B 85 5C 85 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PECompactv099
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 2F 85 40 ?? 87 DD 8B 85 B4 85 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECompactv099
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 02 [3] 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 2F 85 40 ?? 87 DD 8B 85 B4 85 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: NsPacKV30LiuXingPing
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 [4] 66 8B 06 66 83 F8 00 74 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule NsPacKV30LiuXingPing
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 [4] 66 8B 06 66 83 F8 00 74 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: FSGv110EngdulekxtMicrosoftVisualBasic5060
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { C1 CB 10 EB 01 0F B9 03 74 F6 EE 0F B6 D3 8D 05 83 [2] EF 80 F3 F6 2B C1 EB 01 DE 68 77 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule FSGv110EngdulekxtMicrosoftVisualBasic5060
{
      meta:
		author="malware-lu"
strings:
		$a0 = { C1 CB 10 EB 01 0F B9 03 74 F6 EE 0F B6 D3 8D 05 83 [2] EF 80 F3 F6 2B C1 EB 01 DE 68 77 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PECompactv090
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 06 68 [2] 40 00 C3 9C 60 BD [2] 00 00 B9 02 00 00 00 B0 90 8D BD 7A 42 40 00 F3 AA 01 AD D9 43 40 00 FF B5 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECompactv090
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [2] 40 00 C3 9C 60 BD [2] 00 00 B9 02 00 00 00 B0 90 8D BD 7A 42 40 00 F3 AA 01 AD D9 43 40 00 FF B5 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PECompactv092
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 06 68 [4] C3 9C 60 BD [4] B9 02 [3] B0 90 8D BD A5 4F 40 ?? F3 AA 01 AD 04 51 40 ?? FF B5 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECompactv092
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 BD [4] B9 02 [3] B0 90 8D BD A5 4F 40 ?? F3 AA 01 AD 04 51 40 ?? FF B5 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PECompactv094
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 06 68 [4] C3 9C 60 E8 [4] 5D 55 58 81 ED [4] 2B 85 [4] 01 85 [4] 50 B9 02 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PECompactv094
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 06 68 [4] C3 9C 60 E8 [4] 5D 55 58 81 ED [4] 2B 85 [4] 01 85 [4] 50 B9 02 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: PeX099bartCrackPl
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E9 F5 [3] 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule PeX099bartCrackPl
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E9 F5 [3] 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ObsidiumV1304ObsidiumSoftware
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { EB 02 [2] E8 ?? 00 00 00 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ObsidiumV1304ObsidiumSoftware
{
      meta:
		author="malware-lu"
strings:
		$a0 = { EB 02 [2] E8 ?? 00 00 00 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: SoftwareCompressv14LITEBGSoftwareProtectTechnologies
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A }
	$a1 = { E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A 41 00 8B 4A 64 89 8D 51 1A 41 00 8B 4A 74 89 8D 59 1A 41 00 68 00 20 00 00 E8 D2 00 00 00 50 8D 8D 00 1C 41 00 50 51 E8 1B 00 00 00 83 C4 08 58 8D 78 74 8D B5 49 1A 41 00 B9 18 00 00 00 F3 A4 05 A4 00 00 00 50 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 

Detection condition:
$a0 at pe.entry_point or $a1 at pe.entry_point

Full rule:
rule SoftwareCompressv14LITEBGSoftwareProtectTechnologies
{
      meta:
		author="malware-lu"
strings:
		$a0 = { E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A }
	$a1 = { E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A 41 00 8B 4A 64 89 8D 51 1A 41 00 8B 4A 74 89 8D 59 1A 41 00 68 00 20 00 00 E8 D2 00 00 00 50 8D 8D 00 1C 41 00 50 51 E8 1B 00 00 00 83 C4 08 58 8D 78 74 8D B5 49 1A 41 00 B9 18 00 00 00 F3 A4 05 A4 00 00 00 50 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 4D 1A 41 00 89 44 24 1C 61 C2 04 }

condition:
		$a0 at pe.entry_point or $a1 at pe.entry_point
}
YARA Detection Rule: FixupPakv120
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 55 E8 00 00 00 00 5D 81 ED [2] 00 00 BE 00 ?? 00 00 03 F5 BA 00 00 [2] 2B D5 8B DD 33 C0 AC 3C 00 74 3D 3C 01 74 0E 3C 02 74 0E 3C 03 74 0D 03 D8 29 13 EB E7 66 AD EB F6 AD EB F3 AC 0F B6 C8 3C 00 74 06 3C 01 74 09 EB 0A 66 AD 0F B7 C8 EB 03 AD 8B C8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule FixupPakv120
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 55 E8 00 00 00 00 5D 81 ED [2] 00 00 BE 00 ?? 00 00 03 F5 BA 00 00 [2] 2B D5 8B DD 33 C0 AC 3C 00 74 3D 3C 01 74 0E 3C 02 74 0E 3C 03 74 0D 03 D8 29 13 EB E7 66 AD EB F6 AD EB F3 AC 0F B6 C8 3C 00 74 06 3C 01 74 09 EB 0A 66 AD 0F B7 C8 EB 03 AD 8B C8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: ARCSFXArchive
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 8C C8 8C DB 8E D8 8E C0 89 [3] 2B C3 A3 [2] 89 [3] BE [2] B9 [2] BF [2] BA [2] FC AC 32 C2 8A D8 }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule ARCSFXArchive
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 8C C8 8C DB 8E D8 8E C0 89 [3] 2B C3 A3 [2] 89 [3] BE [2] B9 [2] BF [2] BA [2] FC AC 32 C2 8A D8 }

condition:
		$a0 at pe.entry_point
}
YARA Detection Rule: MoleBoxv230Teggo
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 42 04 E8 [2] 00 00 A3 [3] 00 8B 4D F0 8B 11 89 15 [3] 00 ?? 45 FC A3 [3] 00 5F 5E 8B E5 5D C3 CC CC CC CC CC CC CC CC CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 20 61 58 FF D0 E8 [2] 00 00 CC CC CC CC CC CC CC }

Detection condition:
$a0

Full rule:
rule MoleBoxv230Teggo
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 42 04 E8 [2] 00 00 A3 [3] 00 8B 4D F0 8B 11 89 15 [3] 00 ?? 45 FC A3 [3] 00 5F 5E 8B E5 5D C3 CC CC CC CC CC CC CC CC CC CC CC E8 EB FB FF FF 58 E8 ?? 07 00 00 58 89 44 24 20 61 58 FF D0 E8 [2] 00 00 CC CC CC CC CC CC CC }

condition:
		$a0
}
YARA Detection Rule: VxIgor
Repository: Yara-Rules/rules
Author: malware-lu

Pattern signatures:
$a0 = { 1E B8 CD 7B CD 21 81 FB CD 7B 75 03 E9 87 00 33 DB 0E 1F 8C }

Detection condition:
$a0 at pe.entry_point

Full rule:
rule VxIgor
{
      meta:
		author="malware-lu"
strings:
		$a0 = { 1E B8 CD 7B CD 21 81 FB CD 7B 75 03 E9 87 00 33 DB 0E 1F 8C }

condition:
		$a0 at pe.entry_point
}