deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: HackStop_114EXE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 52 B8 02 30 1E CD 21 86 E0 3D FE 02 73 02 CD 20 0E 1F B4 09 E8 03 00 24 24 EA 5A CD 21 1F 5A 53 BB EB 04 5B EB FB 9A B4 30 CD 21 FA 8B EC 8B 46 FA 05 0C 00 FF E0 81 EB 02 EB F0 81 46 FA 1A 00 83 EC 06 CF 82 53 BB EB 04 5B EB FB 9A B9 08 02 }

Detection condition:
$a at pe.entry_point

Full rule:
rule HackStop_114EXE: PEiD
{
    strings:
        $a = { 52 B8 02 30 1E CD 21 86 E0 3D FE 02 73 02 CD 20 0E 1F B4 09 E8 03 00 24 24 EA 5A CD 21 1F 5A 53 BB EB 04 5B EB FB 9A B4 30 CD 21 FA 8B EC 8B 46 FA 05 0C 00 FF E0 81 EB 02 EB F0 81 46 FA 1A 00 83 EC 06 CF 82 53 BB EB 04 5B EB FB 9A B9 08 02 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_01x_beta_Dwing_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_01x_beta_Dwing_additional: PEiD
{
    strings:
        $a = { BE 48 01 40 00 AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: GHF_Protector_pack_GPcH_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 A0 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 }

Detection condition:
$a at pe.entry_point

Full rule:
rule GHF_Protector_pack_GPcH_additional: PEiD
{
    strings:
        $a = { 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 A0 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MS_HTML_Help_file_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 49 54 53 46 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MS_HTML_Help_file_Hint_FILE_START: PEiD
{
    strings:
        $a = { 49 54 53 46 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AVPACK_v120
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 1E 0E 1F 16 07 33 F6 8B FE B9 ?? ?? FC F3 A5 06 BB ?? ?? 53 CB }

Detection condition:
$a at pe.entry_point

Full rule:
rule AVPACK_v120: PEiD
{
    strings:
        $a = { 50 1E 0E 1F 16 07 33 F6 8B FE B9 ?? ?? FC F3 A5 06 BB ?? ?? 53 CB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Raubkopie2219_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? 8C D0 2E ?? ?? ?? 2E ?? ?? ?? ?? 8C C8 8E D0 BC ?? ?? 1E 8E D8 58 A3 ?? ?? E8 ?? ?? 8C C8 8E C0 E8 ?? ?? BA ?? ?? B4 1A CD 21 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Raubkopie2219_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? 8C D0 2E ?? ?? ?? 2E ?? ?? ?? ?? 8C C8 8E D0 BC ?? ?? 1E 8E D8 58 A3 ?? ?? E8 ?? ?? 8C C8 8E C0 E8 ?? ?? BA ?? ?? B4 1A CD 21 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXECryptor_2223_compressed_code_wwwstrongbitcom_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXECryptor_2223_compressed_code_wwwstrongbitcom_additional: PEiD
{
    strings:
        $a = { E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: XPack_140_EXE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 2E 83 26 01 01 00 8B EC EB 01 E8 FA B8 C9 03 EB 01 9A FF E0 F3 03 FD 03 5E 04 86 04 E2 00 98 04 CF 00 82 04 AC 00 85 04 AA 00 7A 04 FC 00 33 C0 8E D0 BC 10 00 2E 8F 06 0A 04 2E 8F 06 0F 04 EB 01 9A 0E 2E FF 36 B1 03 5F EB 01 9A 17 8B E5 FB }

Detection condition:
$a at pe.entry_point

Full rule:
rule XPack_140_EXE: PEiD
{
    strings:
        $a = { 2E 83 26 01 01 00 8B EC EB 01 E8 FA B8 C9 03 EB 01 9A FF E0 F3 03 FD 03 5E 04 86 04 E2 00 98 04 CF 00 82 04 AC 00 85 04 AA 00 7A 04 FC 00 33 C0 8E D0 BC 10 00 2E 8F 06 0A 04 2E 8F 06 0F 04 EB 01 9A 0E 2E FF 36 B1 03 5F EB 01 9A 17 8B E5 FB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: eXPressorProtection_V150X_CGSoftLabs_Sign_by_fly_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 01 68 EB 01 ?? ?? ?? ?? 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 ?? ?? ?? ?? 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 C8 EB 02 }

Detection condition:
$a at pe.entry_point

Full rule:
rule eXPressorProtection_V150X_CGSoftLabs_Sign_by_fly_additional: PEiD
{
    strings:
        $a = { EB 01 68 EB 01 ?? ?? ?? ?? 83 EC 0C 53 56 57 EB 01 ?? 83 3D ?? ?? ?? ?? 00 74 08 EB 01 E9 E9 56 01 00 00 EB 02 E8 E9 C7 05 ?? ?? ?? ?? 01 00 00 00 EB 01 C2 E8 E2 05 00 00 EB 02 DA 9F 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF D0 59 59 EB 01 C8 EB 02 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: tElock_v099_tE_TMD
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? 02 00 00 00 00 00 ?? ?? 02 00 00 00 00 00 ?? ?? 02 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 00 00 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 00 00 ?? 00 00 ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule tElock_v099_tE_TMD: PEiD
{
    strings:
        $a = { E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? 02 00 00 00 00 00 ?? ?? 02 00 00 00 00 00 ?? ?? 02 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? 00 00 00 00 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 00 00 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 00 00 ?? 00 00 ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASL_Crypt_01
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 41 2E 53 2E 4C F8 43 72 79 70 74 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASL_Crypt_01: PEiD
{
    strings:
        $a = { 41 2E 53 2E 4C F8 43 72 79 70 74 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PKLITE_v112_v115_v120_1_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 73 ?? 2D ?? ?? FA 8E D0 FB 2D ?? ?? 8E C0 50 B9 ?? ?? 33 FF 57 BE ?? ?? FC F3 A5 CB B4 09 BA ?? ?? CD 21 CD 20 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PKLITE_v112_v115_v120_1_Hint_DOS_EP: PEiD
{
    strings:
        $a = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 73 ?? 2D ?? ?? FA 8E D0 FB 2D ?? ?? 8E C0 50 B9 ?? ?? 33 FF 57 BE ?? ?? FC F3 A5 CB B4 09 BA ?? ?? CD 21 CD 20 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: NoobyProtect_SE_Public_V1110_Nooby_20081228
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 18 00 00 00 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E 31 2E 31 2E 30 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule NoobyProtect_SE_Public_V1110_Nooby_20081228: PEiD
{
    strings:
        $a = { E9 18 00 00 00 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E 31 2E 31 2E 30 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXE_Stealth_v27
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED D3 26 40 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXE_Stealth_v27: PEiD
{
    strings:
        $a = { EB 00 60 EB 00 E8 00 00 00 00 5D 81 ED D3 26 40 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXE_Stealth_v25
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC }
        $b = { 60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule EXE_Stealth_v25: PEiD
{
    strings:
        $a = { 60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC }
        $b = { 60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 CC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: AntiDote_V12Demo_SIS_Team
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 F7 FE FF FF 05 CB 22 00 00 FF E0 E8 EB FE FF FF 05 BB 19 00 00 FF E0 E8 BD 00 00 00 08 B2 62 00 01 52 17 0C 0F 2C 2B 20 7F 52 79 01 30 07 17 29 4F 01 3C 30 2B 5A 3D C7 26 11 26 06 59 0E 78 2E 10 14 0B 13 1A 1A 3F 64 1D 71 33 57 21 09 24 8B 1B 09 37 08 }

Detection condition:
$a at pe.entry_point

Full rule:
rule AntiDote_V12Demo_SIS_Team: PEiD
{
    strings:
        $a = { E8 F7 FE FF FF 05 CB 22 00 00 FF E0 E8 EB FE FF FF 05 BB 19 00 00 FF E0 E8 BD 00 00 00 08 B2 62 00 01 52 17 0C 0F 2C 2B 20 7F 52 79 01 30 07 17 29 4F 01 3C 30 2B 5A 3D C7 26 11 26 06 59 0E 78 2E 10 14 0B 13 1A 1A 3F 64 1D 71 33 57 21 09 24 8B 1B 09 37 08 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: IBM_IOCA_Graphics_format
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 11 D3 A6 FB }

Detection condition:
$a at pe.entry_point

Full rule:
rule IBM_IOCA_Graphics_format: PEiD
{
    strings:
        $a = { 00 11 D3 A6 FB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FreeJoiner_Small_build_014_020_GlOFF
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FreeJoiner_Small_build_014_020_GlOFF: PEiD
{
    strings:
        $a = { E8 ?? ?? FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXE2COM_Method_3_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? 8C DA 83 ?? ?? 8E DA 4A E8 ?? ?? 81 C3 ?? ?? A1 ?? ?? 2E ?? ?? A1 ?? ?? 03 C2 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXE2COM_Method_3_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? 8C DA 83 ?? ?? 8E DA 4A E8 ?? ?? 81 C3 ?? ?? A1 ?? ?? 2E ?? ?? A1 ?? ?? 03 C2 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXE_joiner_Amok_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { A1 14 A1 40 00 C1 E0 02 A3 18 A1 40 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXE_joiner_Amok_additional: PEiD
{
    strings:
        $a = { A1 14 A1 40 00 C1 E0 02 A3 18 A1 40 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MPRESS_V085_V092_MATCODE_Software_20080414
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 58 05 48 01 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 2B C0 3B FE 73 28 AC 0A C0 74 23 8A C8 24 3F C1 E0 10 66 AD 80 E1 40 74 0F 8B D6 8B CF 03 F0 E8 5F 00 00 00 03 F8 EB D8 8B C8 F3 A4 EB D2 5E 5A 83 EA 05 2B C9 3B CA 73 25 8B D9 AC 41 24 FE 3C E8 75 F2 83 C1 04 AD 0B C0 78 06 3B C2 73 E6 EB 06 03 C3 78 E0 03 C2 2B C3 89 46 FC EB D7 E8 00 00 00 00 5F 81 C7 6A FF FF FF B0 E9 AA B8 44 01 00 00 AB E8 00 00 00 00 58 05 A3 00 00 00 E9 93 00 00 00 53 56 57 8B F9 8B F2 8B DA 03 D8 51 55 33 C0 8B EB 8B DE 2B D2 2B C9 EB 4F 3B DD 73 6C 2B C9 66 8B 03 8D 5B 02 8A CC 80 E4 0F 0B C0 75 02 B4 10 C0 E9 04 80 C1 03 80 F9 12 72 19 8A 0B 66 83 C1 12 43 66 81 F9 11 01 72 0B 66 8B 0B 81 C1 11 01 00 00 43 43 8B F7 2B F0 F3 A4 12 D2 74 0A 72 B9 8A 03 43 88 07 47 EB F2 3B DD 73 1D 0A 13 F9 74 03 43 EB E6 8B 43 01 89 07 8B 43 05 89 47 04 8D 5B 09 8D 7F 08 33 C0 EB DF 5D 8B C7 59 2B C1 5F 5E 5B C3 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MPRESS_V085_V092_MATCODE_Software_20080414: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 58 05 48 01 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 2B C0 3B FE 73 28 AC 0A C0 74 23 8A C8 24 3F C1 E0 10 66 AD 80 E1 40 74 0F 8B D6 8B CF 03 F0 E8 5F 00 00 00 03 F8 EB D8 8B C8 F3 A4 EB D2 5E 5A 83 EA 05 2B C9 3B CA 73 25 8B D9 AC 41 24 FE 3C E8 75 F2 83 C1 04 AD 0B C0 78 06 3B C2 73 E6 EB 06 03 C3 78 E0 03 C2 2B C3 89 46 FC EB D7 E8 00 00 00 00 5F 81 C7 6A FF FF FF B0 E9 AA B8 44 01 00 00 AB E8 00 00 00 00 58 05 A3 00 00 00 E9 93 00 00 00 53 56 57 8B F9 8B F2 8B DA 03 D8 51 55 33 C0 8B EB 8B DE 2B D2 2B C9 EB 4F 3B DD 73 6C 2B C9 66 8B 03 8D 5B 02 8A CC 80 E4 0F 0B C0 75 02 B4 10 C0 E9 04 80 C1 03 80 F9 12 72 19 8A 0B 66 83 C1 12 43 66 81 F9 11 01 72 0B 66 8B 0B 81 C1 11 01 00 00 43 43 8B F7 2B F0 F3 A4 12 D2 74 0A 72 B9 8A 03 43 88 07 47 EB F2 3B DD 73 1D 0A 13 F9 74 03 43 EB E6 8B 43 01 89 07 8B 43 05 89 47 04 8D 5B 09 8D 7F 08 33 C0 EB DF 5D 8B C7 59 2B C1 5F 5E 5B C3 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_01_Microsoft_Visual_Cpp_60_Debug_Version
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 10 01 90 90 90 90 90 90 90 90 E8 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 E9 }
        $b = { 55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule PseudoSigner_01_Microsoft_Visual_Cpp_60_Debug_Version: PEiD
{
    strings:
        $a = { 55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 10 01 90 90 90 90 90 90 90 90 E8 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 E9 }
        $b = { 55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: ARC_SFX_Archive_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8C C8 8C DB 8E D8 8E C0 89 ?? ?? ?? 2B C3 A3 ?? ?? 89 ?? ?? ?? BE ?? ?? B9 ?? ?? BF ?? ?? BA ?? ?? FC AC 32 C2 8A D8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ARC_SFX_Archive_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 8C C8 8C DB 8E D8 8E C0 89 ?? ?? ?? 2B C3 A3 ?? ?? 89 ?? ?? ?? BE ?? ?? B9 ?? ?? BF ?? ?? BA ?? ?? FC AC 32 C2 8A D8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MicroJoiner_17_coban2k
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BF 00 10 40 00 8D 5F 21 6A 0A 58 6A 04 59 60 57 E8 8E 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MicroJoiner_17_coban2k: PEiD
{
    strings:
        $a = { BF 00 10 40 00 8D 5F 21 6A 0A 58 6A 04 59 60 57 E8 8E 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASProtect_SKE_21x_exe_Alexey_Solodovnikov_h_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASProtect_SKE_21x_exe_Alexey_Solodovnikov_h_additional: PEiD
{
    strings:
        $a = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_02_VOB_ProtectCD_5_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 36 3E 26 8A C0 60 E8 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_02_VOB_ProtectCD_5_Anorganix: PEiD
{
    strings:
        $a = { 36 3E 26 8A C0 60 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Gentee_Installer_Custom_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 81 EC 14 04 00 00 53 56 57 6A 00 FF 15 08 41 40 00 68 00 50 40 00 FF 15 04 41 40 00 85 C0 74 29 6A 00 A1 00 20 40 00 ?? ?? ?? ?? 41 40 00 8B F0 6A 06 56 FF 15 1C 41 40 00 6A 03 56 FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule Gentee_Installer_Custom_additional: PEiD
{
    strings:
        $a = { 55 8B EC 81 EC 14 04 00 00 53 56 57 6A 00 FF 15 08 41 40 00 68 00 50 40 00 FF 15 04 41 40 00 85 C0 74 29 6A 00 A1 00 20 40 00 ?? ?? ?? ?? 41 40 00 8B F0 6A 06 56 FF 15 1C 41 40 00 6A 03 56 FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RAR_Archive
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 52 61 72 21 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RAR_Archive: PEiD
{
    strings:
        $a = { 52 61 72 21 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Kofax_Group_4_graphics_file_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 2E 4B 46 68 80 00 01 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Kofax_Group_4_graphics_file_Hint_FILE_START: PEiD
{
    strings:
        $a = { 2E 4B 46 68 80 00 01 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: JDProtectV20081208demo_DLL_20090119
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B 44 24 08 83 F8 01 75 1F E8 92 FE FF FF E8 3D 01 00 00 8B 44 24 0C 8B 4C 24 04 50 6A 01 51 E8 5C 57 00 00 83 C4 0C C3 85 C0 75 1E 8B 54 24 0C 52 50 8B 44 24 0C 50 E8 44 57 00 00 83 C4 0C E8 7C 46 00 00 B8 01 00 00 00 C3 8B 4C 24 0C 8B 54 24 04 51 50 52 E8 26 57 00 00 83 C4 0C C3 90 90 E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule JDProtectV20081208demo_DLL_20090119: PEiD
{
    strings:
        $a = { 8B 44 24 08 83 F8 01 75 1F E8 92 FE FF FF E8 3D 01 00 00 8B 44 24 0C 8B 4C 24 04 50 6A 01 51 E8 5C 57 00 00 83 C4 0C C3 85 C0 75 1E 8B 54 24 0C 52 50 8B 44 24 0C 50 E8 44 57 00 00 83 C4 0C E8 7C 46 00 00 B8 01 00 00 00 C3 8B 4C 24 0C 8B 54 24 04 51 50 52 E8 26 57 00 00 83 C4 0C C3 90 90 E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PE_Diminisher_v01
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PE_Diminisher_v01: PEiD
{
    strings:
        $a = { 53 51 52 56 57 55 E8 00 00 00 00 5D 8B D5 81 ED A2 30 40 00 2B 95 91 33 40 00 81 EA 0B 00 00 00 89 95 9A 33 40 00 80 BD 99 33 40 00 00 74 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Petite_14
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC }
        $b = { ?? ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Petite_14: PEiD
{
    strings:
        $a = { 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC }
        $b = { ?? ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}