deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: WinZip_32_bit_SFX_v6x_module
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FF 15 ?? ?? ?? 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10 38 08 74 06 40 80 38 00 75 F6 80 38 00 74 01 40 33 C9 ?? ?? ?? ?? FF 15 }

Detection condition:
$a at pe.entry_point

Full rule:
rule WinZip_32_bit_SFX_v6x_module: PEiD
{
    strings:
        $a = { FF 15 ?? ?? ?? 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10 38 08 74 06 40 80 38 00 75 F6 80 38 00 74 01 40 33 C9 ?? ?? ?? ?? FF 15 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Petite_12
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Petite_12: PEiD
{
    strings:
        $a = { 66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Petite_13
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 66 9C 60 50 8D 88 00 F0 00 00 8D 90 04 16 00 00 8B DC 8B E1 }
        $b = { ?? ?? ?? ?? ?? ?? 9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00 00 ?? ?? 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Petite_13: PEiD
{
    strings:
        $a = { 66 9C 60 50 8D 88 00 F0 00 00 8D 90 04 16 00 00 8B DC 8B E1 }
        $b = { ?? ?? ?? ?? ?? ?? 9C 60 50 8D 88 00 ?? ?? ?? 8D 90 ?? ?? 00 00 8B DC 8B E1 68 00 00 ?? ?? 53 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 DA 14 00 00 8B 44 24 18 F6 42 03 80 74 19 FD 80 72 03 80 8B F0 8B F8 03 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Private_exe_Protector_V230_V23X_SetiSoft_Team
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Private_exe_Protector_V230_V23X_SetiSoft_Team: PEiD
{
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_310_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_310_additional: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 E0 97 44 00 68 20 C0 42 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 4C 41 44 00 33 D2 8A D4 89 15 90 A1 44 00 8B C8 81 E1 FF 00 00 00 89 0D 8C A1 44 00 C1 E1 08 03 CA 89 0D 88 A1 44 00 C1 E8 10 A3 84 A1 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_Visual_C_v70_Basic_NET_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_Visual_C_v70_Basic_NET_additional: PEiD
{
    strings:
        $a = { FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Yodas_Protector_v1032_Beta2_Ashkbiz_Danehkar_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Yodas_Protector_v1032_Beta2_Ashkbiz_Danehkar_additional: PEiD
{
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: tElock_098_tHE_EGOiSTE_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule tElock_098_tHE_EGOiSTE_h: PEiD
{
    strings:
        $a = { E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ENcryptCOM_v306_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? B4 30 CD 21 3C 02 77 01 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ENcryptCOM_v306_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? B4 30 CD 21 3C 02 77 01 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PeStubOEP_v1x
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 33 C9 33 D2 B8 ?? ?? ?? 00 B9 FF }
        $b = { B8 ?? ?? ?? 00 FF E0 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule PeStubOEP_v1x: PEiD
{
    strings:
        $a = { 90 33 C9 33 D2 B8 ?? ?? ?? 00 B9 FF }
        $b = { B8 ?? ?? ?? 00 FF E0 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: LARP_V2X_lena151_20080914
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E4 74 04 FF 64 24 FC 81 E8 ?? ?? ?? ?? 81 E8 ?? ?? ?? ?? 84 E8 06 00 00 00 81 84 74 00 81 84 0B E4 74 ?? ?? ?? ?? ?? ?? ?? ?? E4 74 02 FF E0 81 E8 ?? 00 00 00 68 ?? ?? ?? ?? E8 ?? 00 00 00 75 BA F8 72 02 73 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? 00 00 00 81 84 ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 84 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 84 ?? ?? ?? ?? ?? ?? ?? ?? ?? 74 08 8D 95 ?? ?? ?? ?? FF E2 ?? ?? ?? ?? ?? ?? ?? E8 ?? 00 00 00 81 8D ?? ?? ?? ?? ?? ?? ?? ?? 84 C1 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 C1 ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 57 F8 72 08 E8 ?? 00 00 00 81 84 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 84 ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 84 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E0 81 ?? ?? ?? ?? C3 E8 ?? 00 00 00 81 2D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 84 }

Detection condition:
$a at pe.entry_point

Full rule:
rule LARP_V2X_lena151_20080914: PEiD
{
    strings:
        $a = { E4 74 04 FF 64 24 FC 81 E8 ?? ?? ?? ?? 81 E8 ?? ?? ?? ?? 84 E8 06 00 00 00 81 84 74 00 81 84 0B E4 74 ?? ?? ?? ?? ?? ?? ?? ?? E4 74 02 FF E0 81 E8 ?? 00 00 00 68 ?? ?? ?? ?? E8 ?? 00 00 00 75 BA F8 72 02 73 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? 00 00 00 81 84 ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 84 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 84 ?? ?? ?? ?? ?? ?? ?? ?? ?? 74 08 8D 95 ?? ?? ?? ?? FF E2 ?? ?? ?? ?? ?? ?? ?? E8 ?? 00 00 00 81 8D ?? ?? ?? ?? ?? ?? ?? ?? 84 C1 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 C1 ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 57 F8 72 08 E8 ?? 00 00 00 81 84 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 84 ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 84 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E0 81 ?? ?? ?? ?? C3 E8 ?? 00 00 00 81 2D ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 84 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_v301_v305
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F }
        $b = { 60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 33 C9 75 02 EB 15 EB 33 C9 75 18 7A 0C 70 0E EB 0D E8 72 0E 79 F1 FF 15 00 79 09 74 F0 EB 87 DB 7A F0 A0 33 61 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 A0 8B 04 24 EB 03 7A 29 E9 C6 00 90 C3 E8 70 F0 87 D2 71 07 E9 00 40 8B DB 7A 11 EB 08 E9 E

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Armadillo_v301_v305: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F }
        $b = { 60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 33 C9 75 02 EB 15 EB 33 C9 75 18 7A 0C 70 0E EB 0D E8 72 0E 79 F1 FF 15 00 79 09 74 F0 EB 87 DB 7A F0 A0 33 61 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 A0 8B 04 24 EB 03 7A 29 E9 C6 00 90 C3 E8 70 F0 87 D2 71 07 E9 00 40 8B DB 7A 11 EB 08 E9 EB F7 EB C3 E8 7A E9 70 DA 7B D1 71 F3 E9 7B }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Kbys_Packer_028_Beta_shoooo314
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 85 AE 01 01 E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Kbys_Packer_028_Beta_shoooo314: PEiD
{
    strings:
        $a = { 68 85 AE 01 01 E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXE_Packer_v70_by_TurboPower_Software_Hint_DOS_EP_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB ?? 1E 06 8C C3 83 ?? ?? 0E 1F 01 ?? ?? ?? 01 ?? ?? ?? BE ?? ?? B9 ?? ?? FC AD 3B C1 74 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXE_Packer_v70_by_TurboPower_Software_Hint_DOS_EP_additional: PEiD
{
    strings:
        $a = { EB ?? 1E 06 8C C3 83 ?? ?? 0E 1F 01 ?? ?? ?? 01 ?? ?? ?? BE ?? ?? B9 ?? ?? FC AD 3B C1 74 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_v131_Eng_dulekxt_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BB ?? ?? BA ?? ?? 81 C3 07 00 B8 40 B4 B1 04 D3 E8 03 C3 8C D9 49 8E C1 26 03 0E 03 00 2B }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_v131_Eng_dulekxt_additional: PEiD
{
    strings:
        $a = { BB ?? ?? BA ?? ?? 81 C3 07 00 B8 40 B4 B1 04 D3 E8 03 C3 8C D9 49 8E C1 26 03 0E 03 00 2B }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: The_Guard_Library_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 E8 ?? ?? ?? ?? 58 25 ?? F0 FF FF 8B C8 83 C1 60 51 83 C0 40 83 EA 06 52 FF 20 9D C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule The_Guard_Library_additional: PEiD
{
    strings:
        $a = { 50 E8 ?? ?? ?? ?? 58 25 ?? F0 FF FF 8B C8 83 C1 60 51 83 C0 40 83 EA 06 52 FF 20 9D C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CodeSafe_v20_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C FE 03 ?? 60 BE ?? ?? 41 ?? 8D BE ?? 10 FF FF 57 83 CD FF EB 10 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CodeSafe_v20_additional: PEiD
{
    strings:
        $a = { 9C FE 03 ?? 60 BE ?? ?? 41 ?? 8D BE ?? 10 FF FF 57 83 CD FF EB 10 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: COMPACK_v51
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BD ?? ?? 50 06 8C CB 03 DD 8C D2 4B 8E DB BE ?? ?? BF ?? ?? 8E C2 B9 ?? ?? F3 A5 4A 4D 75 ?? 8B F7 8E DA 0E 07 06 16 }

Detection condition:
$a at pe.entry_point

Full rule:
rule COMPACK_v51: PEiD
{
    strings:
        $a = { BD ?? ?? 50 06 8C CB 03 DD 8C D2 4B 8E DB BE ?? ?? BF ?? ?? 8E C2 B9 ?? ?? F3 A5 4A 4D 75 ?? 8B F7 8E DA 0E 07 06 16 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PC_PE_Encryptor_Alpha_preview_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 ?? 2B 8D EE 32 40 00 83 E9 0B 89 8D F2 32 40 ?? 80 BD D1 32 40 ?? 01 0F 84 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PC_PE_Encryptor_Alpha_preview_additional: PEiD
{
    strings:
        $a = { 53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 ?? 2B 8D EE 32 40 00 83 E9 0B 89 8D F2 32 40 ?? 80 BD D1 32 40 ?? 01 0F 84 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: DiskDupe_c_MSD_Configuration_file_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 4D 53 44 20 44 61 74 61 20 56 65 72 73 }

Detection condition:
$a at pe.entry_point

Full rule:
rule DiskDupe_c_MSD_Configuration_file_additional: PEiD
{
    strings:
        $a = { 4D 53 44 20 44 61 74 61 20 56 65 72 73 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RCryptor_v16_Vaska
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 33 D0 68 ?? ?? ?? ?? FF D2 }
        $b = { 33 D0 68 ?? ?? ?? ?? FF D2 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule RCryptor_v16_Vaska: PEiD
{
    strings:
        $a = { 33 D0 68 ?? ?? ?? ?? FF D2 }
        $b = { 33 D0 68 ?? ?? ?? ?? FF D2 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: AntiDote_v14_osCE_Sing_by_osCppCoDeR
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 95 01 00 00 E8 D0 FD FF FF 68 95 01 00 00 E8 C3 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 4F 68 04 01 00 00 68 10 22 60 00 6A 00 FF 15 08 10 60 00 68 90 03 00 00 E8 68 FD FF FF 68 69 D6 00 00 E8 5E FD FF FF 50 E8 58 FD FF FF 50 E8 52 FD FF FF E8 DD FE FF FF 50 68 A4 10 60 00 68 94 10 60 00 68 10 22 60 00 E8 58 FD FF FF 83 C4 20 33 C0 C2 10 00 }
        $b = { 68 95 01 00 00 E8 D0 FD FF FF 68 95 01 00 00 E8 C3 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule AntiDote_v14_osCE_Sing_by_osCppCoDeR: PEiD
{
    strings:
        $a = { 68 95 01 00 00 E8 D0 FD FF FF 68 95 01 00 00 E8 C3 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 4F 68 04 01 00 00 68 10 22 60 00 6A 00 FF 15 08 10 60 00 68 90 03 00 00 E8 68 FD FF FF 68 69 D6 00 00 E8 5E FD FF FF 50 E8 58 FD FF FF 50 E8 52 FD FF FF E8 DD FE FF FF 50 68 A4 10 60 00 68 94 10 60 00 68 10 22 60 00 E8 58 FD FF FF 83 C4 20 33 C0 C2 10 00 }
        $b = { 68 95 01 00 00 E8 D0 FD FF FF 68 95 01 00 00 E8 C3 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Safeguard_10_Simonzh
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 00 00 00 00 EB 29 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Safeguard_10_Simonzh: PEiD
{
    strings:
        $a = { E8 00 00 00 00 EB 29 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: NoName_Packer
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED 2E 34 46 00 B9 55 4A 46 00 81 E9 26 37 46 00 89 EA 81 C2 26 37 46 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E 64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C }

Detection condition:
$a at pe.entry_point

Full rule:
rule NoName_Packer: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 2E 34 46 00 B9 55 4A 46 00 81 E9 26 37 46 00 89 EA 81 C2 26 37 46 00 8D 3A 89 FE 31 C0 E9 D3 02 00 00 CC CC CC CC E9 CA 02 00 00 43 3A 5C 57 69 6E 64 6F 77 73 5C 53 6F 66 74 57 61 72 65 50 72 6F 74 65 63 74 6F 72 5C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_v029_Beta_v031_Beta
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE 88 01 ?? ?? AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_v029_Beta_v031_Beta: PEiD
{
    strings:
        $a = { BE 88 01 ?? ?? AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MS_Run_Time_Library_1988_04
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 1E B8 ?? ?? 8E D8 B4 30 CD 21 3C 02 73 ?? BA ?? ?? E8 ?? ?? 06 33 C0 50 CB }

Detection condition:
$a at pe.entry_point

Full rule:
rule MS_Run_Time_Library_1988_04: PEiD
{
    strings:
        $a = { 1E B8 ?? ?? 8E D8 B4 30 CD 21 3C 02 73 ?? BA ?? ?? E8 ?? ?? 06 33 C0 50 CB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: aPack_096_m
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8C C8 05 00 00 8E C0 59 8E D0 51 BE 00 01 BF 00 01 50 57 FC B2 80 BD 00 01 50 A4 FF D5 73 FB FF D5 B1 01 73 13 FF D5 BB 10 00 72 25 FF D5 12 DB 73 FA 75 00 93 AA EB E3 B7 01 FF D5 12 FF 72 00 FF D5 72 F6 FF D5 13 C9 FF D5 72 F8 80 EF 03 72 }

Detection condition:
$a at pe.entry_point

Full rule:
rule aPack_096_m: PEiD
{
    strings:
        $a = { 8C C8 05 00 00 8E C0 59 8E D0 51 BE 00 01 BF 00 01 50 57 FC B2 80 BD 00 01 50 A4 FF D5 73 FB FF D5 B1 01 73 13 FF D5 BB 10 00 72 25 FF D5 12 DB 73 FA 75 00 93 AA EB E3 B7 01 FF D5 12 FF 72 00 FF D5 72 F6 FF D5 13 C9 FF D5 72 F8 80 EF 03 72 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PrivateEXE_v20a_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 06 60 C8 ?? ?? ?? 0E 68 ?? ?? 9A ?? ?? ?? ?? 3D ?? ?? 0F ?? ?? ?? 50 50 0E 68 ?? ?? 9A ?? ?? ?? ?? 0E }

Detection condition:
$a at pe.entry_point

Full rule:
rule PrivateEXE_v20a_additional: PEiD
{
    strings:
        $a = { 06 60 C8 ?? ?? ?? 0E 68 ?? ?? 9A ?? ?? ?? ?? 3D ?? ?? 0F ?? ?? ?? 50 50 0E 68 ?? ?? 9A ?? ?? ?? ?? 0E }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: nbuild_v10_soft_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B9 ?? ?? BB ?? ?? C0 ?? ?? 80 ?? ?? 43 E2 }

Detection condition:
$a at pe.entry_point

Full rule:
rule nbuild_v10_soft_additional: PEiD
{
    strings:
        $a = { B9 ?? ?? BB ?? ?? C0 ?? ?? 80 ?? ?? 43 E2 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PE_Armor_046_Hying
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PE_Armor_046_Hying: PEiD
{
    strings:
        $a = { E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RLPack_V118_LZMA_430_ap0x_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RLPack_V118_LZMA_430_ap0x_additional: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AppLok_95_20
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 F4 E8 2D 36 FD FF E8 EC 4B FD FF E8 27 7B FD FF E8 EA E4 FD FF E8 21 E6 FD FF E8 6C 05 FE FF E8 73 7C FE FF E8 4E 49 FF FF E8 DD 81 FF FF E8 AC AB FF FF A1 24 16 43 00 E8 92 3F FF FF BA 34 FE 42 00 A1 24 16 43 00 E8 AF 3C FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule AppLok_95_20: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 F4 E8 2D 36 FD FF E8 EC 4B FD FF E8 27 7B FD FF E8 EA E4 FD FF E8 21 E6 FD FF E8 6C 05 FE FF E8 73 7C FE FF E8 4E 49 FF FF E8 DD 81 FF FF E8 AC AB FF FF A1 24 16 43 00 E8 92 3F FF FF BA 34 FE 42 00 A1 24 16 43 00 E8 AF 3C FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CodeVeil_V12_V13_XHEO_20080409
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D 64 24 00 55 8B EC 53 56 57 8B 4D 10 83 81 B8 00 00 00 05 83 A1 C0 00 00 00 DF 33 C0 5F 5E 5B C9 C3 8B FF 60 E8 01 00 00 00 B8 5E E8 01 00 00 00 B8 58 2D 31 01 00 00 8B 00 2B F0 81 E6 00 00 FF FF 03 76 3C 33 C9 66 8B 4E 14 8D 74 31 18 8B 5E 0C 03 DE 81 E3 00 F0 FF FF 8B 56 08 E8 05 00 00 00 E9 ?? 00 00 00 55 8B EC 83 C4 F0 B9 E9 00 00 00 8B F3 03 DA E8 01 00 00 00 B8 58 2D 77 01 00 00 8B 00 03 C6 89 45 F4 E8 01 00 00 00 B8 5A 81 EA 86 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CodeVeil_V12_V13_XHEO_20080409: PEiD
{
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D 64 24 00 55 8B EC 53 56 57 8B 4D 10 83 81 B8 00 00 00 05 83 A1 C0 00 00 00 DF 33 C0 5F 5E 5B C9 C3 8B FF 60 E8 01 00 00 00 B8 5E E8 01 00 00 00 B8 58 2D 31 01 00 00 8B 00 2B F0 81 E6 00 00 FF FF 03 76 3C 33 C9 66 8B 4E 14 8D 74 31 18 8B 5E 0C 03 DE 81 E3 00 F0 FF FF 8B 56 08 E8 05 00 00 00 E9 ?? 00 00 00 55 8B EC 83 C4 F0 B9 E9 00 00 00 8B F3 03 DA E8 01 00 00 00 B8 58 2D 77 01 00 00 8B 00 03 C6 89 45 F4 E8 01 00 00 00 B8 5A 81 EA 86 }
    condition:
        $a at pe.entry_point

}