deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: PowerBASICCC_30x
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 53 56 57 BB 00 ?? ?? 00 66 2E F7 05 ?? ?? ?? 00 04 00 0F 85 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PowerBASICCC_30x: PEiD
{
    strings:
        $a = { 55 8B EC 53 56 57 BB 00 ?? ?? 00 66 2E F7 05 ?? ?? ?? 00 04 00 0F 85 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FreeCryptor_01_build_002_GlOFF
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 90 68 27 ?? ?? 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FreeCryptor_01_build_002_GlOFF: PEiD
{
    strings:
        $a = { 8B 04 24 40 90 83 C0 07 80 38 90 90 74 02 EB FF 90 68 27 ?? ?? 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 FF E4 90 8B 04 24 64 A3 00 00 00 00 8B 64 24 08 90 83 C4 08 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PROTECT_EXECOM_v60_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 1E B4 30 CD 21 3C 02 73 ?? CD 20 BE ?? ?? E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PROTECT_EXECOM_v60_additional: PEiD
{
    strings:
        $a = { 1E B4 30 CD 21 3C 02 73 ?? CD 20 BE ?? ?? E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_20betastudent_version_Jeremy_Collake
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? ?? EE 05 12 13 13 12 50 64 FF 35 00 00 00 00 64 89 25 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_20betastudent_version_Jeremy_Collake: PEiD
{
    strings:
        $a = { B8 ?? ?? ?? EE 05 12 13 13 12 50 64 FF 35 00 00 00 00 64 89 25 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AntiDote_14_SE_SIS_Team_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 90 03 00 00 E8 C6 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 4F 68 04 01 00 00 68 10 22 60 }

Detection condition:
$a at pe.entry_point

Full rule:
rule AntiDote_14_SE_SIS_Team_additional: PEiD
{
    strings:
        $a = { 68 90 03 00 00 E8 C6 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 4F 68 04 01 00 00 68 10 22 60 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_VCL_encrypted_Hint_DOS_EP_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 01 B9 ?? ?? 81 35 ?? ?? 47 47 E2 F8 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_VCL_encrypted_Hint_DOS_EP_additional: PEiD
{
    strings:
        $a = { 01 B9 ?? ?? 81 35 ?? ?? 47 47 E2 F8 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Thinstall_Embedded_2312_Jitit
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 6A 00 FF 15 ?? ?? ?? ?? E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Thinstall_Embedded_2312_Jitit: PEiD
{
    strings:
        $a = { 6A 00 FF 15 ?? ?? ?? ?? E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPX_com
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B9 ?? ?? BE ?? ?? BF C0 FF FD }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPX_com: PEiD
{
    strings:
        $a = { B9 ?? ?? BE ?? ?? BF C0 FF FD }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PKZIP_Archive
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 4B 03 04 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PKZIP_Archive: PEiD
{
    strings:
        $a = { 50 4B 03 04 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: LHA_Archive_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 6C 68 35 }

Detection condition:
$a at pe.entry_point

Full rule:
rule LHA_Archive_Hint_FILE_START: PEiD
{
    strings:
        $a = { 6C 68 35 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Thinstall_Embedded_V2545_Jitit_Sign_by_fly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 F2 FF FF FF 50 68 ?? ?? ?? ?? 68 40 1B 00 00 E8 42 FF FF FF E9 9D FF FF FF 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Thinstall_Embedded_V2545_Jitit_Sign_by_fly: PEiD
{
    strings:
        $a = { E8 F2 FF FF FF 50 68 ?? ?? ?? ?? 68 40 1B 00 00 E8 42 FF FF FF E9 9D FF FF FF 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MicroDog_Win32Shell_V4093_Dll_SafeNet
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 80 7C 24 08 01 0F 85 19 FF FF FF E9 AF EC FF FF 90 90 90 90 90 55 8B EC 83 EC 18 53 56 57 8B 45 08 8B 00 C1 E8 10 89 45 FC 8B 45 08 8B 00 25 FF FF 00 00 89 45 F8 C7 45 F4 5A 01 00 00 C7 45 EC 35 4E 00 00 8B 45 F4 0F AF 45 F8 25 FF FF 00 00 89 45 F0 83 7D }

Detection condition:
$a at pe.entry_point

Full rule:
rule MicroDog_Win32Shell_V4093_Dll_SafeNet: PEiD
{
    strings:
        $a = { 80 7C 24 08 01 0F 85 19 FF FF FF E9 AF EC FF FF 90 90 90 90 90 55 8B EC 83 EC 18 53 56 57 8B 45 08 8B 00 C1 E8 10 89 45 FC 8B 45 08 8B 00 25 FF FF 00 00 89 45 F8 C7 45 F4 5A 01 00 00 C7 45 EC 35 4E 00 00 8B 45 F4 0F AF 45 F8 25 FF FF 00 00 89 45 F0 83 7D }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: tElock_v071b7_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 48 11 00 00 C3 83 }

Detection condition:
$a at pe.entry_point

Full rule:
rule tElock_v071b7_additional: PEiD
{
    strings:
        $a = { 60 E8 48 11 00 00 C3 83 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ACProtect_v135_risco_software_Inc_Anticrack_Software_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 47 65 74 50 72 6F 63 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ACProtect_v135_risco_software_Inc_Anticrack_Software_h: PEiD
{
    strings:
        $a = { 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 47 65 74 50 72 6F 63 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXE_v10_
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 08 4B 40 00 68 36 3A 40 00 64 A1 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXE_v10_: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 08 4B 40 00 68 36 3A 40 00 64 A1 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Windows_Group_file
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 4D 43 43 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Windows_Group_file: PEiD
{
    strings:
        $a = { 50 4D 43 43 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Exe_Shield_v27
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 F4 86 06 00 C3 9C 60 E8 02 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Exe_Shield_v27: PEiD
{
    strings:
        $a = { EB 06 68 F4 86 06 00 C3 9C 60 E8 02 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AHTeam_EP_Protector_03_fake_ASPack_212_FEUERRADER
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule AHTeam_EP_Protector_03_fake_ASPack_212_FEUERRADER: PEiD
{
    strings:
        $a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_CodeSafe_20_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_CodeSafe_20_Anorganix: PEiD
{
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 10 53 56 57 E8 C4 01 00 85 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: WWPACK_v305c4_Extractable_p_Password_checking
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 03 05 80 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule WWPACK_v305c4_Extractable_p_Password_checking: PEiD
{
    strings:
        $a = { 03 05 80 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: A3E_TXT2COM
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 1E 33 C0 50 BE ?? ?? 81 C6 ?? ?? B8 ?? ?? 8E C0 BF ?? ?? B9 ?? ?? F3 A5 CB }

Detection condition:
$a at pe.entry_point

Full rule:
rule A3E_TXT2COM: PEiD
{
    strings:
        $a = { 1E 33 C0 50 BE ?? ?? 81 C6 ?? ?? B8 ?? ?? 8E C0 BF ?? ?? B9 ?? ?? F3 A5 CB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RPolyCrypt_v_10_personal_polycryptor_sign_from_pinch_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 58 97 97 60 61 8B 04 24 80 78 F3 6A E8 00 00 00 00 58 E8 00 00 00 00 58 91 91 EB 00 0F 85 6B F4 76 6F E8 00 00 00 00 83 C4 04 E8 00 00 00 00 58 90 E8 00 00 00 00 83 C4 04 8B 04 24 80 78 F1 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RPolyCrypt_v_10_personal_polycryptor_sign_from_pinch_additional: PEiD
{
    strings:
        $a = { 50 58 97 97 60 61 8B 04 24 80 78 F3 6A E8 00 00 00 00 58 E8 00 00 00 00 58 91 91 EB 00 0F 85 6B F4 76 6F E8 00 00 00 00 83 C4 04 E8 00 00 00 00 58 90 E8 00 00 00 00 83 C4 04 8B 04 24 80 78 F1 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Exact_Audio_Copy
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? 5E FC 83 ?? ?? 81 ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E B8 FE 4B CD 21 81 FF BB 55 ?? ?? 07 ?? ?? ?? 07 B4 49 CD 21 BB FF FF B4 48 CD 21 }
        $b = { E8 ?? ?? ?? 00 31 ED 55 89 E5 81 EC ?? 00 00 00 8D BD ?? FF FF FF B9 ?? 00 00 00 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Exact_Audio_Copy: PEiD
{
    strings:
        $a = { E8 ?? ?? 5E FC 83 ?? ?? 81 ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E B8 FE 4B CD 21 81 FF BB 55 ?? ?? 07 ?? ?? ?? 07 B4 49 CD 21 BB FF FF B4 48 CD 21 }
        $b = { E8 ?? ?? ?? 00 31 ED 55 89 E5 81 EC ?? 00 00 00 8D BD ?? FF FF FF B9 ?? 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: WWPACK_v302_v302a_v304_Relocations_pack
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE ?? ?? BF ?? ?? B9 ?? ?? 8C CD 81 ED ?? ?? 8B DD 81 EB ?? ?? 8B D3 FC FA 1E 8E DB 01 15 33 C0 2E AC }

Detection condition:
$a at pe.entry_point

Full rule:
rule WWPACK_v302_v302a_v304_Relocations_pack: PEiD
{
    strings:
        $a = { BE ?? ?? BF ?? ?? B9 ?? ?? 8C CD 81 ED ?? ?? 8B DD 81 EB ?? ?? 8B D3 FC FA 1E 8E DB 01 15 33 C0 2E AC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXEStealth_v275a_WebtoolMaster_h_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 90 60 90 E8 00 00 00 00 5D 81 ED F7 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 74 28 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 C5 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXEStealth_v275a_WebtoolMaster_h_additional: PEiD
{
    strings:
        $a = { EB 58 53 68 61 72 65 77 61 72 65 2D 56 65 72 73 69 6F 6E 20 45 78 65 53 74 65 61 6C 74 68 2C 20 63 6F 6E 74 61 63 74 20 73 75 70 70 6F 72 74 40 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 00 90 60 90 E8 00 00 00 00 5D 81 ED F7 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 74 28 40 00 8B F7 AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 C5 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: TMT_Pascal_v040_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 0E 1F 06 8C 06 ?? ?? 26 A1 ?? ?? A3 ?? ?? 8E C0 66 33 FF 66 33 C9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule TMT_Pascal_v040_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 0E 1F 06 8C 06 ?? ?? 26 A1 ?? ?? A3 ?? ?? 8E C0 66 33 FF 66 33 C9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_v265b1_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 38 ?? ?? ?? 68 40 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 F4 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_v265b1_additional: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 38 ?? ?? ?? 68 40 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 F4 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Obsiduim_1304_Obsiduim_Software_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsiduim_1304_Obsiduim_Software_additional: PEiD
{
    strings:
        $a = { EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PENinja_modified_pDZA
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 5D 8B C5 81 ED B2 2C 40 00 2B 85 94 3E 40 00 2D 71 02 00 00 89 85 98 3E 40 00 0F B6 B5 9C 3E 40 00 8B FD }

Detection condition:
$a at pe.entry_point

Full rule:
rule PENinja_modified_pDZA: PEiD
{
    strings:
        $a = { 5D 8B C5 81 ED B2 2C 40 00 2B 85 94 3E 40 00 2D 71 02 00 00 89 85 98 3E 40 00 0F B6 B5 9C 3E 40 00 8B FD }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPX_Alternative_stub_Laszlo_Markus
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 02 EB EA EB FC 8A 06 }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPX_Alternative_stub_Laszlo_Markus: PEiD
{
    strings:
        $a = { EB 02 EB EA EB FC 8A 06 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_C_198889
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B4 30 CD 21 3C 02 73 02 CD 20 BF 00 00 8B 36 02 00 2B F7 81 FE 00 10 72 03 BE 00 10 FA 8E D7 81 C4 00 00 FB 73 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_C_198889: PEiD
{
    strings:
        $a = { B4 30 CD 21 3C 02 73 02 CD 20 BF 00 00 8B 36 02 00 2B F7 81 FE 00 10 72 03 BE 00 10 FA 8E D7 81 C4 00 00 FB 73 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: TPCs_COM_Scrambler_v100_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB ?? 2E ?? ?? ?? ?? 8E C0 8C D8 BE ?? ?? BF ?? ?? 2E ?? ?? ?? ?? 26 ?? ?? ?? 26 ?? ?? ?? ?? 26 ?? ?? ?? 26 ?? ?? ?? ?? ?? ?? 0E 07 B9 ?? ?? FC F3 A4 CC }

Detection condition:
$a at pe.entry_point

Full rule:
rule TPCs_COM_Scrambler_v100_Hint_DOS_EP: PEiD
{
    strings:
        $a = { EB ?? 2E ?? ?? ?? ?? 8E C0 8C D8 BE ?? ?? BF ?? ?? 2E ?? ?? ?? ?? 26 ?? ?? ?? 26 ?? ?? ?? ?? 26 ?? ?? ?? 26 ?? ?? ?? ?? ?? ?? 0E 07 B9 ?? ?? FC F3 A4 CC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: DIET_v100d_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FC 06 1E 0E 8C C8 01 ?? ?? ?? BA ?? ?? 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule DIET_v100d_additional: PEiD
{
    strings:
        $a = { FC 06 1E 0E 8C C8 01 ?? ?? ?? BA ?? ?? 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: WinRAR_32_bit_SFX_Module
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? 00 00 00 00 00 00 90 90 90 ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule WinRAR_32_bit_SFX_Module: PEiD
{
    strings:
        $a = { E9 ?? ?? 00 00 00 00 00 00 90 90 90 ?? ?? ?? ?? ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_Microsoft_Visual_Basic_50_60_Anorganix_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_Microsoft_Visual_Basic_50_60_Anorganix_additional: PEiD
{
    strings:
        $a = { 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MetaWare_High_C_Run_Time_Library_p_Phar_Lap_DOS_Extender_1983_89
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? 50 B8 ?? ?? 50 CB }

Detection condition:
$a at pe.entry_point

Full rule:
rule MetaWare_High_C_Run_Time_Library_p_Phar_Lap_DOS_Extender_1983_89: PEiD
{
    strings:
        $a = { B8 ?? ?? 50 B8 ?? ?? 50 CB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PEiD_813_32Lite_v003a_Oleg_Prokhorov
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 06 FC 1E 07 BE ?? ?? ?? ?? 6A 04 68 00 10 ?? ?? 68 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PEiD_813_32Lite_v003a_Oleg_Prokhorov: PEiD
{
    strings:
        $a = { 60 06 FC 1E 07 BE ?? ?? ?? ?? 6A 04 68 00 10 ?? ?? 68 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RLPack_V120_Dll_LZMA_430_ap0x
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 80 7C 24 08 01 0F 85 AA 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 01 00 00 EB 20 60 8B 85 9C 0C 00 00 FF B5 94 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD A8 0C 00 00 00 74 0E 83 BD AC 0C 00 00 00 74 05 E8 F2 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 2D 0C 00 00 89 85 C0 0C 00 00 5B 60 FF B5 94 0C 00 00 56 FF B5 C0 0C 00 00 FF D3 61 8B B5 C0 0C 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 9C 0C 00 00 83 C0 04 89 85 BC 0C 00 00 EB 72 56 FF 95 25 0C 00 00 0B C0 75 05 E8 E6 02 00 00 85 C0 0F 84 AB 00 00 00 89 85 B8 0C 00 00 8B C6 EB 2E 8B 85 BC 0C 00 00 8B 00 50 FF B5 B8 0C 00 00 E8 2E 02 00 00 85 C0 0F 84 85 00 00 00 89 07 83 85 BC 0C 00 00 04 83 C7 04 8B 85 BC 0C 00 00 83 38 00 75 

Detection condition:
$a at pe.entry_point

Full rule:
rule RLPack_V120_Dll_LZMA_430_ap0x: PEiD
{
    strings:
        $a = { 80 7C 24 08 01 0F 85 AA 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 01 00 00 EB 20 60 8B 85 9C 0C 00 00 FF B5 94 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD A8 0C 00 00 00 74 0E 83 BD AC 0C 00 00 00 74 05 E8 F2 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 2D 0C 00 00 89 85 C0 0C 00 00 5B 60 FF B5 94 0C 00 00 56 FF B5 C0 0C 00 00 FF D3 61 8B B5 C0 0C 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 9C 0C 00 00 83 C0 04 89 85 BC 0C 00 00 EB 72 56 FF 95 25 0C 00 00 0B C0 75 05 E8 E6 02 00 00 85 C0 0F 84 AB 00 00 00 89 85 B8 0C 00 00 8B C6 EB 2E 8B 85 BC 0C 00 00 8B 00 50 FF B5 B8 0C 00 00 E8 2E 02 00 00 85 C0 0F 84 85 00 00 00 89 07 83 85 BC 0C 00 00 04 83 C7 04 8B 85 BC 0C 00 00 83 38 00 75 CD EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD 9C 0C 00 00 83 C0 04 89 85 BC 0C 00 00 80 3E 01 75 89 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 C0 0C 00 00 FF 95 31 0C 00 00 68 00 80 00 00 6A 00 FF B5 C0 0C 00 00 FF 95 31 0C 00 00 68 00 80 00 00 6A 00 FF B5 94 0C 00 00 FF 95 31 0C 00 00 E8 61 00 00 00 E8 5C 01 00 00 61 E9 ?? ?? ?? ?? 61 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Grazie883_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 1E 0E 1F 50 06 BF 70 03 B4 1A BA 70 03 CD 21 B4 47 B2 00 BE 32 04 CD 21 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Grazie883_additional: PEiD
{
    strings:
        $a = { 1E 0E 1F 50 06 BF 70 03 B4 1A BA 70 03 CD 21 B4 47 B2 00 BE 32 04 CD 21 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASProtect_23_SKE_build_0426_Beta_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 01 60 40 00 E8 01 00 00 00 C3 C3 0D 6C 65 3E 09 84 BB 91 89 38 D0 5A 1D 60 6D AF D5 51 2D A9 2F E1 62 D8 C1 5A 8D 6B 6E 94 A7 F9 1D 26 8C 8E FB 08 A8 7E 9D 3B 0C DF 14 5E 62 14 7D 78 D0 6E }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASProtect_23_SKE_build_0426_Beta_additional: PEiD
{
    strings:
        $a = { 68 01 60 40 00 E8 01 00 00 00 C3 C3 0D 6C 65 3E 09 84 BB 91 89 38 D0 5A 1D 60 6D AF D5 51 2D A9 2F E1 62 D8 C1 5A 8D 6B 6E 94 A7 F9 1D 26 8C 8E FB 08 A8 7E 9D 3B 0C DF 14 5E 62 14 7D 78 D0 6E }
    condition:
        $a at pe.entry_point

}