deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: ACProtect_141_AntiCrack_Software_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 01 00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A 40 00 8B C0 8B D2 2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2 FF FF FF F3 B9 05 00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6 D0 EB 01 00 D0 C0 FE C8 02 C1 AA E2 EF 59 E2 DE B7 FE AB E1 24 C8 0C 88 7A E1 B1 6A F7 95 83 1B A8 7F F8 A8 B0 1A 8B 08 91 47 6C 5A 88 6C 65 39 85 DB CB 54 3D B9 24 CF 4C AE C6 63 74 2C 63 F0 C8 18 0B 97 6B 79 63 A8 AB B8 78 A9 30 2F 2B DA 18 AC 35 45 36 BC 0D 7D 24 D1 51 3C E6 34 11 5A 43 06 24 89 FA 74 30 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ACProtect_141_AntiCrack_Software_additional: PEiD
{
    strings:
        $a = { E8 01 00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A 40 00 8B C0 8B D2 2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2 FF FF FF F3 B9 05 00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6 D0 EB 01 00 D0 C0 FE C8 02 C1 AA E2 EF 59 E2 DE B7 FE AB E1 24 C8 0C 88 7A E1 B1 6A F7 95 83 1B A8 7F F8 A8 B0 1A 8B 08 91 47 6C 5A 88 6C 65 39 85 DB CB 54 3D B9 24 CF 4C AE C6 63 74 2C 63 F0 C8 18 0B 97 6B 79 63 A8 AB B8 78 A9 30 2F 2B DA 18 AC 35 45 36 BC 0D 7D 24 D1 51 3C E6 34 11 5A 43 06 24 89 FA 74 30 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Trap_114
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8C D1 BA 99 CB 8E D2 33 D2 8E D1 8B CA B9 E8 03 EB 03 90 CD 20 E2 F9 33 D2 B9 00 05 EB 03 90 CD 20 81 F9 E2 03 74 0C 83 C1 FE 83 C2 01 EB ED EB FE CD 78 E8 05 00 CD 21 EB 6E 90 FA 66 8C E3 66 B8 00 00 01 00 8E E0 66 8C E0 8E E3 66 3D 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Trap_114: PEiD
{
    strings:
        $a = { 8C D1 BA 99 CB 8E D2 33 D2 8E D1 8B CA B9 E8 03 EB 03 90 CD 20 E2 F9 33 D2 B9 00 05 EB 03 90 CD 20 81 F9 E2 03 74 0C 83 C1 FE 83 C2 01 EB ED EB FE CD 78 E8 05 00 CD 21 EB 6E 90 FA 66 8C E3 66 B8 00 00 01 00 8E E0 66 8C E0 8E E3 66 3D 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Trap_115
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B9 E8 03 EB 03 90 CD 20 E2 F9 8C D1 BA 99 CB 8E D2 33 D2 8E D1 8B CA 33 D2 B9 00 05 EB 03 90 CD 20 81 F9 E2 03 74 0C 83 C1 FE 83 C2 01 EB ED EB FE CD 78 E8 0C 00 CD 21 EB 73 90 EA 00 00 FF FF EB F9 FA 66 8C E3 66 B8 00 00 01 00 8E E0 66 8C }

Detection condition:
$a at pe.entry_point

Full rule:
rule Trap_115: PEiD
{
    strings:
        $a = { B9 E8 03 EB 03 90 CD 20 E2 F9 8C D1 BA 99 CB 8E D2 33 D2 8E D1 8B CA 33 D2 B9 00 05 EB 03 90 CD 20 81 F9 E2 03 74 0C 83 C1 FE 83 C2 01 EB ED EB FE CD 78 E8 0C 00 CD 21 EB 73 90 EA 00 00 FF FF EB F9 FA 66 8C E3 66 B8 00 00 01 00 8E E0 66 8C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AHpack_01_FEUERRADER_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 }

Detection condition:
$a at pe.entry_point

Full rule:
rule AHpack_01_FEUERRADER_additional: PEiD
{
    strings:
        $a = { 60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_Visual_Cpp_60_DLL_Debug
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 ?? ?? 83 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_Visual_Cpp_60_DLL_Debug: PEiD
{
    strings:
        $a = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 57 8B 7D 10 85 F6 ?? ?? 83 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: File_Analyzer_Compiled_Datafile
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 46 69 6C 65 20 41 6E 61 6C 79 7A 65 72 20 43 6F 6D 70 69 6C 65 64 20 44 61 74 61 66 69 6C 65 20 56 65 72 73 69 6F 6E }

Detection condition:
$a at pe.entry_point

Full rule:
rule File_Analyzer_Compiled_Datafile: PEiD
{
    strings:
        $a = { 46 69 6C 65 20 41 6E 61 6C 79 7A 65 72 20 43 6F 6D 70 69 6C 65 64 20 44 61 74 61 66 69 6C 65 20 56 65 72 73 69 6F 6E }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: yodas_Protector_v101_Ashkbiz_Danehkar_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule yodas_Protector_v101_Ashkbiz_Danehkar_h: PEiD
{
    strings:
        $a = { 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UCOMCRY_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? 60 06 FA E4 64 0C 40 E6 64 B8 ?? ?? 8E C0 26 }

Detection condition:
$a at pe.entry_point

Full rule:
rule UCOMCRY_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? 60 06 FA E4 64 0C 40 E6 64 B8 ?? ?? 8E C0 26 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASProtect_v123_RC1_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 53 60 BD ?? ?? ?? ?? 8D 45 ?? 8D 5D ?? E8 ?? ?? ?? ?? 8D }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASProtect_v123_RC1_additional: PEiD
{
    strings:
        $a = { 53 60 BD ?? ?? ?? ?? 8D 45 ?? 8D 5D ?? E8 ?? ?? ?? ?? 8D }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Turbo_or_Borland_Pascal_v70_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9A ?? ?? ?? ?? C8 ?? ?? ?? 9A ?? ?? ?? ?? 09 C0 75 ?? EB ?? 8D ?? ?? ?? 16 57 6A ?? 9A ?? ?? ?? ?? BF ?? ?? 1E 57 68 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Turbo_or_Borland_Pascal_v70_additional: PEiD
{
    strings:
        $a = { 9A ?? ?? ?? ?? C8 ?? ?? ?? 9A ?? ?? ?? ?? 09 C0 75 ?? EB ?? 8D ?? ?? ?? 16 57 6A ?? 9A ?? ?? ?? ?? BF ?? ?? 1E 57 68 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PE_PACK_v10_by_ANAKiN_1998_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 74 ?? E9 ?? ?? ?? ?? 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PE_PACK_v10_by_ANAKiN_1998_additional: PEiD
{
    strings:
        $a = { 74 ?? E9 ?? ?? ?? ?? 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXECryptor_V22X_V24X_StrongBit_Technology_SignByfly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? ?? ?? 05 ?? ?? ?? ?? FF E0 E8 ?? ?? ?? ?? 05 ?? ?? ?? ?? FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXECryptor_V22X_V24X_StrongBit_Technology_SignByfly: PEiD
{
    strings:
        $a = { E8 ?? ?? ?? ?? 05 ?? ?? ?? ?? FF E0 E8 ?? ?? ?? ?? 05 ?? ?? ?? ?? FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Thinstall_V2736_Jitit
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 60 E8 00 00 00 00 58 BB F3 1C 00 00 2B C3 50 68 00 00 40 00 68 00 26 00 00 68 CC 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Thinstall_V2736_Jitit: PEiD
{
    strings:
        $a = { 9C 60 E8 00 00 00 00 58 BB F3 1C 00 00 2B C3 50 68 00 00 40 00 68 00 26 00 00 68 CC 00 00 00 E8 C1 FE FF FF E9 97 FF FF FF CC CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PE_Protect_09_by_Cristoph_Gabler_1998
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PE_Protect_09_by_Cristoph_Gabler_1998: PEiD
{
    strings:
        $a = { 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Unknown_by_SMT_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 83 ?? ?? 57 EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule Unknown_by_SMT_additional: PEiD
{
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 83 ?? ?? 57 EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Warning_may_be_SimbyOZ_polycryptor_by_3xpl01t_ver_2xx_25032007_2200_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 57 57 8D 7C 24 04 50 B8 00 D0 17 13 AB 58 5F C3 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Warning_may_be_SimbyOZ_polycryptor_by_3xpl01t_ver_2xx_25032007_2200_additional: PEiD
{
    strings:
        $a = { 57 57 8D 7C 24 04 50 B8 00 D0 17 13 AB 58 5F C3 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Private_EXE_Protector_18_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 FF 31 F6 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Private_EXE_Protector_18_additional: PEiD
{
    strings:
        $a = { A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 89 E8 B3 01 56 89 FE 29 C6 F3 A4 5E EB 8E 00 D2 75 05 8A 16 46 10 D2 C3 31 C9 41 E8 EE FF FF FF 11 C9 E8 E7 FF FF FF 72 F2 C3 31 FF 31 F6 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Obsidium_V1350_Obsidium_Software_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 03 ?? ?? ?? E8 ?? ?? ?? ?? EB 02 ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 20 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 04 ?? ?? ?? ?? 50 EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsidium_V1350_Obsidium_Software_additional: PEiD
{
    strings:
        $a = { EB 03 ?? ?? ?? E8 ?? ?? ?? ?? EB 02 ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 20 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 04 ?? ?? ?? ?? 50 EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_Visual_Cue_V80
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 6A 14 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BB 94 00 00 00 53 6A 00 8B ?? ?? ?? ?? ?? FF D7 50 FF ?? ?? ?? ?? ?? 8B F0 85 F6 75 0A 6A 12 E8 ?? ?? ?? ?? 59 EB 18 89 1E 56 FF ?? ?? ?? ?? ?? 56 85 C0 75 14 50 FF D7 50 FF ?? ?? ?? ?? ?? B8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_Visual_Cue_V80: PEiD
{
    strings:
        $a = { 6A 14 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BB 94 00 00 00 53 6A 00 8B ?? ?? ?? ?? ?? FF D7 50 FF ?? ?? ?? ?? ?? 8B F0 85 F6 75 0A 6A 12 E8 ?? ?? ?? ?? 59 EB 18 89 1E 56 FF ?? ?? ?? ?? ?? 56 85 C0 75 14 50 FF D7 50 FF ?? ?? ?? ?? ?? B8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Involuntary1349_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BA ?? ?? B9 ?? ?? 8C DD ?? 8C C8 ?? 8E D8 8E C0 33 F6 8B FE FC ?? ?? AD ?? 33 C2 AB }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Involuntary1349_additional: PEiD
{
    strings:
        $a = { BA ?? ?? B9 ?? ?? 8C DD ?? 8C C8 ?? 8E D8 8E C0 33 F6 8B FE FC ?? ?? AD ?? 33 C2 AB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_v098_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D7 84 40 ?? 87 DD 8B 85 5C 85 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_v098_additional: PEiD
{
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D7 84 40 ?? 87 DD 8B 85 5C 85 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_XPEH4768_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? 5B 81 ?? ?? ?? 50 56 57 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B8 01 00 50 B8 ?? ?? 50 E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_XPEH4768_additional: PEiD
{
    strings:
        $a = { E8 ?? ?? 5B 81 ?? ?? ?? 50 56 57 2E ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B8 01 00 50 B8 ?? ?? 50 E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Nullsoft_Install_System_206
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 EC 20 53 55 56 33 DB 57 89 5C 24 18 C7 44 24 10 ?? ?? ?? ?? C6 44 24 14 20 FF 15 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 02 23 00 00 BE ?? ?? ?? ?? 56 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Nullsoft_Install_System_206: PEiD
{
    strings:
        $a = { 83 EC 20 53 55 56 33 DB 57 89 5C 24 18 C7 44 24 10 ?? ?? ?? ?? C6 44 24 14 20 FF 15 ?? ?? ?? ?? 53 FF 15 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 02 23 00 00 BE ?? ?? ?? ?? 56 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CorelDraw_8_CDR_Graphics_format_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 25 ?? ?? ?? ?? EF 6A 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CorelDraw_8_CDR_Graphics_format_additional: PEiD
{
    strings:
        $a = { 83 25 ?? ?? ?? ?? EF 6A 00 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? CC FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? FF 25 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Obsidium_1300_Obsidium_Software_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsidium_1300_Obsidium_Software_h: PEiD
{
    strings:
        $a = { EB 04 25 80 34 CA E8 29 00 00 00 EB 02 C1 81 EB 01 3A 8B 54 24 0C EB 02 32 92 83 82 B8 00 00 00 22 EB 02 F2 7F 33 C0 EB 04 65 7E 14 79 C3 EB 04 05 AD 7F 45 EB 04 05 65 0B E8 64 67 FF 36 00 00 EB 04 0D F6 A8 7F 64 67 89 26 00 00 EB 04 8D 68 C7 FB EB 01 6B }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MS_Run_Time_Library_OS2_FORTRAN_Compiler_1989_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B4 30 CD 21 86 E0 2E A3 ?? ?? 3D ?? ?? 73 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MS_Run_Time_Library_OS2_FORTRAN_Compiler_1989_Hint_DOS_EP: PEiD
{
    strings:
        $a = { B4 30 CD 21 86 E0 2E A3 ?? ?? 3D ?? ?? 73 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PEiD_Bundle_V101_BoB_BobSoft
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 23 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A }

Detection condition:
$a at pe.entry_point

Full rule:
rule PEiD_Bundle_V101_BoB_BobSoft: PEiD
{
    strings:
        $a = { 60 E8 23 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_GRUNT2Family
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 48 E2 F7 C3 51 53 52 E8 DD FF 5A 5B 59 C3 B9 00 00 E2 FE C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_GRUNT2Family: PEiD
{
    strings:
        $a = { 48 E2 F7 C3 51 53 52 E8 DD FF 5A 5B 59 C3 B9 00 00 E2 FE C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CauseWay_DOS_Extender_v325_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FA 16 1F 26 ?? ?? ?? 83 ?? ?? 8E D0 FB 06 16 07 BE ?? ?? 8B FE B9 ?? ?? F3 A4 07 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CauseWay_DOS_Extender_v325_additional: PEiD
{
    strings:
        $a = { FA 16 1F 26 ?? ?? ?? 83 ?? ?? 8E D0 FB 06 16 07 BE ?? ?? 8B FE B9 ?? ?? F3 A4 07 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: xPEP_03x_xIkUg
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 53 56 51 52 57 E8 16 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule xPEP_03x_xIkUg: PEiD
{
    strings:
        $a = { 55 53 56 51 52 57 E8 16 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: REC_C0ded_by_ROSE_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 06 1E 0E 0E 07 1F B4 30 CD 21 86 E0 3D 00 03 73 ?? CD 20 EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule REC_C0ded_by_ROSE_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 06 1E 0E 0E 07 1F B4 30 CD 21 86 E0 3D 00 03 73 ?? CD 20 EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: DrWeb_Virus_Finding_Engine_InSoft_EDV_Systeme
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 01 00 00 00 C2 0C 00 8D 80 00 00 00 00 8B D2 8B ?? 24 04 }

Detection condition:
$a at pe.entry_point

Full rule:
rule DrWeb_Virus_Finding_Engine_InSoft_EDV_Systeme: PEiD
{
    strings:
        $a = { B8 01 00 00 00 C2 0C 00 8D 80 00 00 00 00 8B D2 8B ?? 24 04 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PeCompact_253_DLL_BitSum_Technologies_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PeCompact_253_DLL_BitSum_Technologies_additional: PEiD
{
    strings:
        $a = { B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Borland_Delphi_v20
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 6A E8 FF FF BA 52 89 05 89 42 04 E8 5A 58 E8 C3 55 8B EC 33 }
        $b = { E8 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0A ?? ?? ?? B8 ?? ?? ?? ?? C3 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Borland_Delphi_v20: PEiD
{
    strings:
        $a = { 50 6A E8 FF FF BA 52 89 05 89 42 04 E8 5A 58 E8 C3 55 8B EC 33 }
        $b = { E8 ?? ?? ?? ?? 6A ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 05 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? 0A ?? ?? ?? B8 ?? ?? ?? ?? C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: HA_Archive
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 48 41 }

Detection condition:
$a at pe.entry_point

Full rule:
rule HA_Archive: PEiD
{
    strings:
        $a = { 48 41 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: The_Guard_Library
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 E8 ?? ?? ?? ?? 58 25 ?? F0 FF FF 8B C8 83 C1 60 51 83 C0 40 83 EA 06 52 FF 20 9D C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule The_Guard_Library: PEiD
{
    strings:
        $a = { 50 E8 ?? ?? ?? ?? 58 25 ?? F0 FF FF 8B C8 83 C1 60 51 83 C0 40 83 EA 06 52 FF 20 9D C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Exe_Shield_v29
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED 0B 20 40 00 B9 EB 08 00 00 8D BD 53 20 40 00 8B F7 AC ?? ?? ?? F8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Exe_Shield_v29: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 0B 20 40 00 B9 EB 08 00 00 8D BD 53 20 40 00 8B F7 AC ?? ?? ?? F8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Thinstall_v2460_Jitit_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 F4 18 40 00 50 E8 87 FC FF FF 59 59 A1 94 1A 40 00 8B 40 10 03 05 90 1A 40 00 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00 76 0C 00 00 D4 0C 00 00 1E }

Detection condition:
$a at pe.entry_point

Full rule:
rule Thinstall_v2460_Jitit_additional: PEiD
{
    strings:
        $a = { 55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 F4 18 40 00 50 E8 87 FC FF FF 59 59 A1 94 1A 40 00 8B 40 10 03 05 90 1A 40 00 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00 76 0C 00 00 D4 0C 00 00 1E }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: HQR_data_file_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 48 00 00 00 ?? 02 00 00 ?? ?? 00 00 ?? ?? 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule HQR_data_file_additional: PEiD
{
    strings:
        $a = { 48 00 00 00 ?? 02 00 00 ?? ?? 00 00 ?? ?? 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UNITA3_tm_by_Sanitary_Equipment_Research_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? 4D 5A 3E }

Detection condition:
$a at pe.entry_point

Full rule:
rule UNITA3_tm_by_Sanitary_Equipment_Research_additional: PEiD
{
    strings:
        $a = { E8 ?? ?? 4D 5A 3E }
    condition:
        $a at pe.entry_point

}