deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Petite_12_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Petite_12_additional: PEiD
{
    strings:
        $a = { 66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _VMProtect_v125_PolyTech
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9 A5 06 00 00 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9 }
        $b = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 56 52 56 51 9C 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 A7 72 45 00 C3 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule _VMProtect_v125_PolyTech: PEiD
{
    strings:
        $a = { 8B 45 00 83 C5 02 66 8B 00 66 89 45 00 E9 A5 06 00 00 8B 45 00 66 8B 55 04 83 C5 06 66 89 10 E9 }
        $b = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 50 53 56 52 56 51 9C 55 57 68 00 00 00 00 8B 74 24 2C 89 E5 81 EC C0 00 00 00 89 E7 03 75 00 8A 06 46 0F B6 C0 FF 34 85 A7 72 45 00 C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Native_UD_Packer_11_Modded_Poison_Ivy_Shellcode_okkixot
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 31 C0 31 DB 31 C9 EB 0E 6A 00 6A 00 6A 00 6A 00 FF 15 28 41 40 00 FF 15 94 40 40 00 89 C7 68 88 13 00 00 FF 15 98 40 40 00 FF 15 94 40 40 00 81 C7 88 13 00 00 39 F8 73 05 E9 84 00 00 00 6A 40 68 00 10 00 00 FF 35 04 30 40 00 6A 00 FF 15 A4 40 40 00 89 C7 FF 35 04 30 40 00 68 CA 10 40 00 50 FF 15 A8 40 40 00 6A 40 68 00 10 00 00 FF 35 08 30 40 00 6A 00 FF 15 A4 40 40 00 89 C6 68 00 30 40 00 FF 35 04 30 40 00 57 FF 35 08 30 40 00 50 6A 02 FF 15 4E 41 40 00 6A 00 6A 00 6A 00 56 6A 00 6A 00 FF 15 9C 40 40 00 50 6A 00 6A 00 6A 11 50 FF 15 4A 41 40 00 58 6A FF 50 FF 15 AC 40 40 00 6A 00 FF 15 A0 40 }
        $b = { 31 C0 31 DB 31 C9 EB 0E 6A 00 6A 00 6A 00 6A 00 FF 15 28 41 40 00 FF 15 94 40 40 00 89 C7 68 88 13 00 00 FF 15 98 40 40 00 FF 15 94 40 40 00 81 C7 88 13 00 00 39 F8 73 05 E9 84 00 00 00 6A 40 68 00 10 00 00 FF 35 04 30 40 00 6A 00 FF 15 A4 40 40 00 89 C7 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Native_UD_Packer_11_Modded_Poison_Ivy_Shellcode_okkixot: PEiD
{
    strings:
        $a = { 31 C0 31 DB 31 C9 EB 0E 6A 00 6A 00 6A 00 6A 00 FF 15 28 41 40 00 FF 15 94 40 40 00 89 C7 68 88 13 00 00 FF 15 98 40 40 00 FF 15 94 40 40 00 81 C7 88 13 00 00 39 F8 73 05 E9 84 00 00 00 6A 40 68 00 10 00 00 FF 35 04 30 40 00 6A 00 FF 15 A4 40 40 00 89 C7 FF 35 04 30 40 00 68 CA 10 40 00 50 FF 15 A8 40 40 00 6A 40 68 00 10 00 00 FF 35 08 30 40 00 6A 00 FF 15 A4 40 40 00 89 C6 68 00 30 40 00 FF 35 04 30 40 00 57 FF 35 08 30 40 00 50 6A 02 FF 15 4E 41 40 00 6A 00 6A 00 6A 00 56 6A 00 6A 00 FF 15 9C 40 40 00 50 6A 00 6A 00 6A 11 50 FF 15 4A 41 40 00 58 6A FF 50 FF 15 AC 40 40 00 6A 00 FF 15 A0 40 }
        $b = { 31 C0 31 DB 31 C9 EB 0E 6A 00 6A 00 6A 00 6A 00 FF 15 28 41 40 00 FF 15 94 40 40 00 89 C7 68 88 13 00 00 FF 15 98 40 40 00 FF 15 94 40 40 00 81 C7 88 13 00 00 39 F8 73 05 E9 84 00 00 00 6A 40 68 00 10 00 00 FF 35 04 30 40 00 6A 00 FF 15 A4 40 40 00 89 C7 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Upack_Patch_Sign_by_hot_UNP_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 81 3A 00 00 00 02 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_Patch_Sign_by_hot_UNP_additional: PEiD
{
    strings:
        $a = { 81 3A 00 00 00 02 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CERBERUS_v20_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 2B ED 8C ?? ?? 8C ?? ?? FA E4 ?? 88 ?? ?? 16 07 BF ?? ?? 8E DD 9B F5 B9 ?? ?? FC F3 A5 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CERBERUS_v20_additional: PEiD
{
    strings:
        $a = { 9C 2B ED 8C ?? ?? 8C ?? ?? FA E4 ?? 88 ?? ?? 16 07 BF ?? ?? 8E DD 9B F5 B9 ?? ?? FC F3 A5 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: tElock_v04x_v05x
Repository: Yara-Rules/rules

Pattern signatures:
$a = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 ?? 8B FE 68 79 01 ?? ?? 59 EB 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule tElock_v04x_v05x: PEiD
{
    strings:
        $a = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 ?? 8B FE 68 79 01 ?? ?? 59 EB 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Virtual_Image_Maker_Graphics_file
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 53 4F 4D 56 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Virtual_Image_Maker_Graphics_file: PEiD
{
    strings:
        $a = { 53 4F 4D 56 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CorelDraw_CMX_Graphics_format_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 52 49 46 46 ?? ?? ?? ?? 43 4D 58 31 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CorelDraw_CMX_Graphics_format_Hint_FILE_START: PEiD
{
    strings:
        $a = { 52 49 46 46 ?? ?? ?? ?? 43 4D 58 31 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Horse1776
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? 5D 83 ?? ?? 06 1E 26 ?? ?? ?? ?? BF ?? ?? 1E 0E 1F 8B F7 01 EE B9 ?? ?? FC F3 A6 1F 1E 07 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Horse1776: PEiD
{
    strings:
        $a = { E8 ?? ?? 5D 83 ?? ?? 06 1E 26 ?? ?? ?? ?? BF ?? ?? 1E 0E 1F 8B F7 01 EE B9 ?? ?? FC F3 A6 1F 1E 07 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: INCrypter_03_INinY_by_z3e_NiFe_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8D 58 20 C7 03 00 00 00 00 E8 00 00 00 00 5D 81 ED 4D 16 40 00 8B 9D 0E 17 40 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 83 F8 01 75 05 03 DB C1 CB 10 8B 8D 12 17 40 00 8B B5 06 17 40 00 51 81 3E 2E 72 73 72 74 65 8B 85 16 17 40 00 E8 23 00 00 00 8B 85 1A 17 40 00 E8 18 00 00 00 8B 85 1E 17 40 00 E8 0D 00 00 00 8B 85 22 17 40 00 E8 02 00 00 00 EB 18 8B D6 3B 46 0C 72 0A 83 F9 01 74 0B 3B 46 34 72 06 BA 00 00 00 00 C3 58 83 FA 00 75 1A 8B 4E 10 8B 7E 0C 03 BD 02 17 40 00 83 F9 00 74 09 F6 17 31 0F 31 1F 47 E2 F7 59 83 C6 28 49 83 F9 00 75 88 8B 85 0A 17 40 00 89 44 24 1C 61 50 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule INCrypter_03_INinY_by_z3e_NiFe_additional: PEiD
{
    strings:
        $a = { 60 64 A1 30 00 00 00 8B 40 0C 8B 40 0C 8D 58 20 C7 03 00 00 00 00 E8 00 00 00 00 5D 81 ED 4D 16 40 00 8B 9D 0E 17 40 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 83 F8 01 75 05 03 DB C1 CB 10 8B 8D 12 17 40 00 8B B5 06 17 40 00 51 81 3E 2E 72 73 72 74 65 8B 85 16 17 40 00 E8 23 00 00 00 8B 85 1A 17 40 00 E8 18 00 00 00 8B 85 1E 17 40 00 E8 0D 00 00 00 8B 85 22 17 40 00 E8 02 00 00 00 EB 18 8B D6 3B 46 0C 72 0A 83 F9 01 74 0B 3B 46 34 72 06 BA 00 00 00 00 C3 58 83 FA 00 75 1A 8B 4E 10 8B 7E 0C 03 BD 02 17 40 00 83 F9 00 74 09 F6 17 31 0F 31 1F 47 E2 F7 59 83 C6 28 49 83 F9 00 75 88 8B 85 0A 17 40 00 89 44 24 1C 61 50 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Zortech_C_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FA FC B8 ?? ?? ?? 8C C8 8E D8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Zortech_C_additional: PEiD
{
    strings:
        $a = { FA FC B8 ?? ?? ?? 8C C8 8E D8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_v251
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 B8 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_v251: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 B8 ?? ?? ?? 68 D0 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 20 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_v250
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_v250: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 B8 ?? ?? ?? 68 F8 ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 20 ?? ?? ?? 33 D2 8A D4 89 15 D0 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_v253
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 40 ?? ?? ?? 68 54 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_v253: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 40 ?? ?? ?? 68 54 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 58 ?? ?? ?? 33 D2 8A D4 89 15 EC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_v252
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? E0 ?? ?? ?? ?? 68 D4 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 38 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_v252: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? E0 ?? ?? ?? ?? 68 D4 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 38 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PESHiELD_v02_v02b_v02b2_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 ?? ?? ?? ?? 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PESHiELD_v02_v02b_v02b2_additional: PEiD
{
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RLPack_Full_Edition_V11X_ap0x
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 10 }
        $b = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule RLPack_Full_Edition_V11X_ap0x: PEiD
{
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 10 }
        $b = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: N0Ps_Shit_Protector_0002b
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 58 25 FF FE 50 9D 8B D4 8C D3 8E D3 BC 03 00 8B E2 8E D3 9C 58 A9 00 01 75 01 2E E8 00 00 5D 81 ED B2 07 B8 A8 07 03 C5 2E 81 B6 B8 07 FF FE 50 58 8B F4 2E 8B BE C3 07 81 EF 4E 58 2B F7 8B 1C 83 C3 32 FF E3 2E 33 FF 8E DF 8E C7 8B F7 FA }

Detection condition:
$a at pe.entry_point

Full rule:
rule N0Ps_Shit_Protector_0002b: PEiD
{
    strings:
        $a = { 9C 58 25 FF FE 50 9D 8B D4 8C D3 8E D3 BC 03 00 8B E2 8E D3 9C 58 A9 00 01 75 01 2E E8 00 00 5D 81 ED B2 07 B8 A8 07 03 C5 2E 81 B6 B8 07 FF FE 50 58 8B F4 2E 8B BE C3 07 81 EF 4E 58 2B F7 8B 1C 83 C3 32 FF E3 2E 33 FF 8E DF 8E C7 8B F7 FA }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_01_Morphine_12_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 E2 90 90 90 EB 08 82 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 01 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_01_Morphine_12_Anorganix: PEiD
{
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 E2 90 90 90 EB 08 82 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 01 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: yodas_Protector_102_103_Ashkbiz_Danehkar_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 }

Detection condition:
$a at pe.entry_point

Full rule:
rule yodas_Protector_102_103_Ashkbiz_Danehkar_additional: PEiD
{
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASPack_211_Solodovnikov_Alexey
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E9 3D 04 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASPack_211_Solodovnikov_Alexey: PEiD
{
    strings:
        $a = { 60 E9 3D 04 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RLPack_V118_Dll_LZMA_430_ap0x_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 80 7C 24 08 01 0F 85 5C 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RLPack_V118_Dll_LZMA_430_ap0x_additional: PEiD
{
    strings:
        $a = { 80 7C 24 08 01 0F 85 5C 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_v0977_Jeremy_Collake
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB A0 86 40 ?? 87 DD 8B 85 2A 87 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_v0977_Jeremy_Collake: PEiD
{
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB A0 86 40 ?? 87 DD 8B 85 2A 87 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CrypKey_V56X_Kenonic_Controls_Ltd
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 00 75 07 6A 00 E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CrypKey_V56X_Kenonic_Controls_Ltd: PEiD
{
    strings:
        $a = { E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 83 F8 00 75 07 6A 00 E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: BGI_Device_Driver
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 70 6B 08 08 42 47 49 20 }

Detection condition:
$a at pe.entry_point

Full rule:
rule BGI_Device_Driver: PEiD
{
    strings:
        $a = { 70 6B 08 08 42 47 49 20 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Symantec_WinFax_PRO_83_Coverpage_Quick_CoverPage_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FF FF ?? ?? ?? ?? ?? 43 6F 76 65 72 44 61 74 61 62 61 73 65 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Symantec_WinFax_PRO_83_Coverpage_Quick_CoverPage_Hint_FILE_START: PEiD
{
    strings:
        $a = { FF FF ?? ?? ?? ?? ?? 43 6F 76 65 72 44 61 74 61 62 61 73 65 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: HackStop_100_EXE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B4 30 CD 21 86 E0 3D 00 03 73 06 B0 FF B4 4C CD 21 50 B8 EB 04 58 EB FB 9A B8 00 33 CD 21 50 E8 1F 04 8D B2 00 B8 01 33 CD 21 50 B8 EB 06 58 EB FB 66 38 12 E8 0A 04 8D EB 02 CA 92 50 55 52 8C D2 FA 50 B8 EB 04 58 EB FB 9A 8C C8 8E D0 EB 02 }

Detection condition:
$a at pe.entry_point

Full rule:
rule HackStop_100_EXE: PEiD
{
    strings:
        $a = { B4 30 CD 21 86 E0 3D 00 03 73 06 B0 FF B4 4C CD 21 50 B8 EB 04 58 EB FB 9A B8 00 33 CD 21 50 E8 1F 04 8D B2 00 B8 01 33 CD 21 50 B8 EB 06 58 EB FB 66 38 12 E8 0A 04 8D EB 02 CA 92 50 55 52 8C D2 FA 50 B8 EB 04 58 EB FB 9A 8C C8 8E D0 EB 02 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Nullsoft_Install_System_v20a7_Nullsoft
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 EC 0C 53 56 57 FF 15 BC 80 40 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Nullsoft_Install_System_v20a7_Nullsoft: PEiD
{
    strings:
        $a = { 83 EC 0C 53 56 57 FF 15 BC 80 40 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_Visual_Cpp_v71_DLL_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 E4 53 56 57 89 65 E8 C7 45 E4 01 00 00 00 C7 45 FC }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_Visual_Cpp_v71_DLL_additional: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 E4 53 56 57 89 65 E8 C7 45 E4 01 00 00 00 C7 45 FC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_Visual_Cpp_V80
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 6A 14 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BB 94 00 00 00 53 6A 00 8B ?? ?? ?? ?? ?? FF D7 50 FF ?? ?? ?? ?? ?? 8B F0 85 F6 75 0A 6A 12 E8 ?? ?? ?? ?? 59 EB 18 89 1E 56 FF ?? ?? ?? ?? ?? 56 85 C0 75 14 50 FF D7 50 FF ?? ?? ?? ?? ?? B8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_Visual_Cpp_V80: PEiD
{
    strings:
        $a = { 6A 14 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BB 94 00 00 00 53 6A 00 8B ?? ?? ?? ?? ?? FF D7 50 FF ?? ?? ?? ?? ?? 8B F0 85 F6 75 0A 6A 12 E8 ?? ?? ?? ?? 59 EB 18 89 1E 56 FF ?? ?? ?? ?? ?? 56 85 C0 75 14 50 FF D7 50 FF ?? ?? ?? ?? ?? B8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AINEXE_v21_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8 36 A3 ?? ?? 05 ?? ?? 36 A3 ?? ?? 2E A1 ?? ?? 8A D4 B1 04 D2 EA FE C9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule AINEXE_v21_Hint_DOS_EP: PEiD
{
    strings:
        $a = { A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8 36 A3 ?? ?? 05 ?? ?? 36 A3 ?? ?? 2E A1 ?? ?? 8A D4 B1 04 D2 EA FE C9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PE_Lock_v106_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 4B 45 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PE_Lock_v106_additional: PEiD
{
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 4B 45 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Ding_Boys_PE_lock_v007
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 23 35 40 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Ding_Boys_PE_lock_v007: PEiD
{
    strings:
        $a = { 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 23 35 40 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_02_VOB_ProtectCD_5
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 36 3E 26 8A C0 60 E8 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_02_VOB_ProtectCD_5: PEiD
{
    strings:
        $a = { 36 3E 26 8A C0 60 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_v110_Eng_dulekxt_MASM32
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 01 DB E8 02 00 00 00 86 43 5E 8D 1D D0 75 CF 83 C1 EE 1D 68 50 ?? 8F 83 EB 02 3D 0F 5A }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_v110_Eng_dulekxt_MASM32: PEiD
{
    strings:
        $a = { EB 01 DB E8 02 00 00 00 86 43 5E 8D 1D D0 75 CF 83 C1 EE 1D 68 50 ?? 8F 83 EB 02 3D 0F 5A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_FSG_131_Anorganix_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_FSG_131_Anorganix_additional: PEiD
{
    strings:
        $a = { BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_v253b3_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 D8 ?? ?? ?? 68 14 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_v253b3_additional: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 D8 ?? ?? ?? 68 14 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 }
    condition:
        $a at pe.entry_point

}