deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: NFO_v1x_modified_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 9C 8D 50 }

Detection condition:
$a at pe.entry_point

Full rule:
rule NFO_v1x_modified_additional: PEiD
{
    strings:
        $a = { 60 9C 8D 50 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: BamBam_v001_Bedrock
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1 }

Detection condition:
$a at pe.entry_point

Full rule:
rule BamBam_v001_Bedrock: PEiD
{
    strings:
        $a = { 6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Borland_Delphi_v50_KOL
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 53 8B D8 33 C0 A3 6A ?? E8 FF A3 A1 A3 33 C0 A3 33 C0 A3 }
        $b = { 55 8B EC 83 C4 F0 B8 ?? ?? 40 00 E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF 8B C0 00 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Borland_Delphi_v50_KOL: PEiD
{
    strings:
        $a = { 53 8B D8 33 C0 A3 6A ?? E8 FF A3 A1 A3 33 C0 A3 33 C0 A3 }
        $b = { 55 8B EC 83 C4 F0 B8 ?? ?? 40 00 E8 ?? ?? FF FF E8 ?? ?? FF FF E8 ?? ?? FF FF 8B C0 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: PseudoSigner_02_PE_Intro_10_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_02_PE_Intro_10_Anorganix: PEiD
{
    strings:
        $a = { 8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_01_PENightMare_2_Beta_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_01_PENightMare_2_Beta_Anorganix: PEiD
{
    strings:
        $a = { 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MinGW_v32x_Dll_WinMain_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 00 00 00 5D C2 0C 00 8B 45 0C 57 56 53 8B 5D 10 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MinGW_v32x_Dll_WinMain_additional: PEiD
{
    strings:
        $a = { 55 8B EC A1 ?? ?? ?? ?? 85 C0 74 09 B8 01 00 00 00 5D C2 0C 00 8B 45 0C 57 56 53 8B 5D 10 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_v090_v092
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 C3 9C 60 E8 5D 55 58 81 ED 2B 85 01 85 50 B9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_v090_v092: PEiD
{
    strings:
        $a = { EB 06 68 C3 9C 60 E8 5D 55 58 81 ED 2B 85 01 85 50 B9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_v110_Eng_dulekxt_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 02 ?? ?? EB 02 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_v110_Eng_dulekxt_additional: PEiD
{
    strings:
        $a = { EB 02 ?? ?? EB 02 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: nPack_V115002008_Beta_NEOxnbsp_nbsp_SignByfly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 48 02 00 00 E8 F8 06 00 00 E8 47 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3 56 57 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 56 57 E8 23 FE FF FF 6A ?? 56 57 E8 F4 FC FF FF 83 C4 14 68 ?? ?? ?? ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 5F 5E C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule nPack_V115002008_Beta_NEOxnbsp_nbsp_SignByfly: PEiD
{
    strings:
        $a = { 83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 48 02 00 00 E8 F8 06 00 00 E8 47 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3 56 57 6A ?? 68 ?? ?? ?? ?? 6A ?? 6A ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 56 57 E8 23 FE FF FF 6A ?? 56 57 E8 F4 FC FF FF 83 C4 14 68 ?? ?? ?? ?? 6A ?? 56 FF 15 ?? ?? ?? ?? 5F 5E C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MSLRH_v032a_emadicius_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MSLRH_v032a_emadicius_h: PEiD
{
    strings:
        $a = { E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 81 83 C4 04 E8 0A 00 00 00 E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CAN_Crunched_ANsi_file_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { CA 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CAN_Crunched_ANsi_file_Hint_FILE_START: PEiD
{
    strings:
        $a = { CA 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Unknown_SFX_Archive_aWAW
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 61 57 41 57 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Unknown_SFX_Archive_aWAW: PEiD
{
    strings:
        $a = { 61 57 41 57 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MSLRH_032a_fake_Neolite_20_emadicius_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 56 57 BF 01 00 00 00 8B 75 0C 85 F6 5F 5E 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MSLRH_032a_fake_Neolite_20_emadicius_additional: PEiD
{
    strings:
        $a = { 55 8B EC 56 57 BF 01 00 00 00 8B 75 0C 85 F6 5F 5E 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Libraries_by_John_Socha_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BB ?? ?? 8E DB 2E 89 ?? ?? ?? 8D ?? ?? ?? 25 ?? ?? FA 8E D3 8B E0 FB 26 A1 A3 ?? ?? B4 30 CD 21 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Libraries_by_John_Socha_Hint_DOS_EP: PEiD
{
    strings:
        $a = { BB ?? ?? 8E DB 2E 89 ?? ?? ?? 8D ?? ?? ?? 25 ?? ?? FA 8E D3 8B E0 FB 26 A1 A3 ?? ?? B4 30 CD 21 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MicroJoiner_11_coban2k
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE 0C 70 40 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MicroJoiner_11_coban2k: PEiD
{
    strings:
        $a = { BE 0C 70 40 00 BB F8 11 40 00 33 ED 83 EE 04 39 2E 74 11 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Obsidium_V1361_Obsidium_Softwarenbsp_nbsp_SignByfly_20080521
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? E8 ?? 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 ?? EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? 64 FF 30 EB 04 ?? ?? ?? ?? 64 89 20 EB 01 ?? EB 03 ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 01 ?? E8 ?? FF FF FF EB 01 ?? EB 03 ?? ?? ?? EB 01 ?? EB 03 ?? ?? ?? 64 8F 00 EB 03 ?? ?? ?? 83 C4 04 EB 01 ?? 58 EB 02 ?? ?? E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsidium_V1361_Obsidium_Softwarenbsp_nbsp_SignByfly_20080521: PEiD
{
    strings:
        $a = { EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? E8 ?? 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 ?? EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? 64 FF 30 EB 04 ?? ?? ?? ?? 64 89 20 EB 01 ?? EB 03 ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 01 ?? E8 ?? FF FF FF EB 01 ?? EB 03 ?? ?? ?? EB 01 ?? EB 03 ?? ?? ?? 64 8F 00 EB 03 ?? ?? ?? 83 C4 04 EB 01 ?? 58 EB 02 ?? ?? E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: GHF_Protector_GPcH
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 A0 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 }

Detection condition:
$a at pe.entry_point

Full rule:
rule GHF_Protector_GPcH: PEiD
{
    strings:
        $a = { 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 A0 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Lcc_win_32_13
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 64 A1 00 00 00 00 55 89 E5 6A FF 68 00 00 00 00 68 9A 10 40 00 50 64 89 25 00 00 00 00 83 EC 10 53 56 57 89 65 E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Lcc_win_32_13: PEiD
{
    strings:
        $a = { 64 A1 00 00 00 00 55 89 E5 6A FF 68 00 00 00 00 68 9A 10 40 00 50 64 89 25 00 00 00 00 83 EC 10 53 56 57 89 65 E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Img_Software_Set_graphics_file
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 53 43 4D 49 20 20 20 31 41 54 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Img_Software_Set_graphics_file: PEiD
{
    strings:
        $a = { 53 43 4D 49 20 20 20 31 41 54 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Nullsoft_Install_System_20
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Nullsoft_Install_System_20: PEiD
{
    strings:
        $a = { 83 EC 0C 53 55 56 57 C7 44 24 10 70 92 40 00 33 DB C6 44 24 14 20 FF 15 2C 70 40 00 53 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 2D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: StarForce_V3X_StarForce_Copy_Protection_System
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule StarForce_V3X_StarForce_Copy_Protection_System: PEiD
{
    strings:
        $a = { 68 ?? ?? ?? ?? FF 25 ?? ?? ?? ?? 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: The_WiZ_Cryptor_v100a_by_SP0T_UCL_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? FA 60 56 1E 8E D8 BE ?? ?? BF ?? ?? B8 ?? ?? 87 ?? ?? ?? AB 8C C8 87 ?? ?? ?? AB 1F 68 ?? ?? 9C 58 80 ?? ?? 50 9D FC }

Detection condition:
$a at pe.entry_point

Full rule:
rule The_WiZ_Cryptor_v100a_by_SP0T_UCL_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? FA 60 56 1E 8E D8 BE ?? ?? BF ?? ?? B8 ?? ?? 87 ?? ?? ?? AB 8C C8 87 ?? ?? ?? AB 1F 68 ?? ?? 9C 58 80 ?? ?? 50 9D FC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Manuelbased_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? 0E B8 ?? ?? 50 06 1E 55 E8 ?? ?? 43 60 14 ?? 02 E9 53 0C 00 ?? ?? ?? ?? ?? ?? 5D 83 ?? ?? 8D ?? ?? ?? BF ?? ?? A5 A4 B4 ?? CD 21 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Manuelbased_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? 0E B8 ?? ?? 50 06 1E 55 E8 ?? ?? 43 60 14 ?? 02 E9 53 0C 00 ?? ?? ?? ?? ?? ?? 5D 83 ?? ?? 8D ?? ?? ?? BF ?? ?? A5 A4 B4 ?? CD 21 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPX_040_051_EXE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8C CB B9 00 00 BE 00 00 89 F7 1E A9 B5 80 8D 87 05 00 8E D8 05 00 00 8E C0 FD F3 A5 FC 2E 80 6C 13 10 73 E8 00 00 00 00 00 0E 0E 00 00 00 00 00 00 00 00 00 00 00 00 55 50 58 21 05 00 02 07 }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPX_040_051_EXE: PEiD
{
    strings:
        $a = { 8C CB B9 00 00 BE 00 00 89 F7 1E A9 B5 80 8D 87 05 00 8E D8 05 00 00 8E C0 FD F3 A5 FC 2E 80 6C 13 10 73 E8 00 00 00 00 00 0E 0E 00 00 00 00 00 00 00 00 00 00 00 00 55 50 58 21 05 00 02 07 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Software_Compress_BG_Software_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Software_Compress_BG_Software_additional: PEiD
{
    strings:
        $a = { E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SoftWrap_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 52 53 51 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 36 ?? ?? ?? E8 ?? 01 ?? ?? 60 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F }

Detection condition:
$a at pe.entry_point

Full rule:
rule SoftWrap_additional: PEiD
{
    strings:
        $a = { 52 53 51 56 57 55 E8 ?? ?? ?? ?? 5D 81 ED 36 ?? ?? ?? E8 ?? 01 ?? ?? 60 BA ?? ?? ?? ?? E8 ?? ?? ?? ?? 5F }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CodeCrypt_016b_0163b_defiler
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F }

Detection condition:
$a at pe.entry_point

Full rule:
rule CodeCrypt_016b_0163b_defiler: PEiD
{
    strings:
        $a = { E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_V010_V011_Dwing_Sign_by_fly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 ?? F3 AB C1 E0 ?? B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C ?? 73 ?? B0 ?? 3C ?? 72 02 2C ?? 50 0F B6 5F FF C1 E3 ?? B3 ?? 8D 1C 5B 8D ?? ?? ?? ?? ?? ?? B0 ?? 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_V010_V011_Dwing_Sign_by_fly: PEiD
{
    strings:
        $a = { BE ?? ?? ?? ?? AD 8B F8 95 A5 33 C0 33 C9 AB 48 AB F7 D8 B1 ?? F3 AB C1 E0 ?? B5 ?? F3 AB AD 50 97 51 AD 87 F5 58 8D 54 86 5C FF D5 72 5A 2C ?? 73 ?? B0 ?? 3C ?? 72 02 2C ?? 50 0F B6 5F FF C1 E3 ?? B3 ?? 8D 1C 5B 8D ?? ?? ?? ?? ?? ?? B0 ?? 67 E3 29 8B D7 2B 56 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF D5 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Video_CD_file_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 52 49 46 46 ?? ?? ?? ?? 43 44 58 41 66 6D 74 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Video_CD_file_Hint_FILE_START: PEiD
{
    strings:
        $a = { 52 49 46 46 ?? ?? ?? ?? 43 44 58 41 66 6D 74 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Lotus_Graphics_format_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 01 00 00 00 01 00 08 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Lotus_Graphics_format_Hint_FILE_START: PEiD
{
    strings:
        $a = { 01 00 00 00 01 00 08 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: NTkrnl_Secure_Suite_NTkrnl_team
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 }
        $b = { 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule NTkrnl_Secure_Suite_NTkrnl_team: PEiD
{
    strings:
        $a = { 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 }
        $b = { 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 41 10 00 00 50 10 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: AntiVirus_Vaccine_v103
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FA 33 DB B9 ?? ?? 0E 1F 33 F6 FC AD 35 ?? ?? 03 D8 E2 }

Detection condition:
$a at pe.entry_point

Full rule:
rule AntiVirus_Vaccine_v103: PEiD
{
    strings:
        $a = { FA 33 DB B9 ?? ?? 0E 1F 33 F6 FC AD 35 ?? ?? 03 D8 E2 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: KBys_Packer_028_Beta_Shoooo
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5E 83 EE 0A 8B 06 03 C2 8B 08 89 4E F3 83 EE 0F 56 52 8B F0 AD AD 03 C2 8B D8 6A 04 BF 00 10 00 00 57 57 6A 00 FF 53 08 5A 59 BD 00 80 00 00 55 6A 00 50 51 52 50 89 06 AD AD 03 C2 50 AD 03 C2 FF D0 6A 04 57 AD 50 6A 00 FF 53 }

Detection condition:
$a at pe.entry_point

Full rule:
rule KBys_Packer_028_Beta_Shoooo: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5E 83 EE 0A 8B 06 03 C2 8B 08 89 4E F3 83 EE 0F 56 52 8B F0 AD AD 03 C2 8B D8 6A 04 BF 00 10 00 00 57 57 6A 00 FF 53 08 5A 59 BD 00 80 00 00 55 6A 00 50 51 52 50 89 06 AD AD 03 C2 50 AD 03 C2 FF D0 6A 04 57 AD 50 6A 00 FF 53 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Unnamed_Scrambler_21Beta_211_p0ke
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC B9 15 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? 3A ?? ?? E8 ?? EE FF FF 33 C0 55 68 ?? 43 ?? ?? 64 FF 30 64 89 20 BA ?? 43 ?? ?? B8 E4 64 ?? ?? E8 0F FD FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? EE FF FF BA E8 64 ?? ?? 8B C3 8B 0D E4 64 ?? ?? E8 ?? D7 FF FF B8 F8 ?? ?? ?? BA 04 00 00 00 E8 ?? EF FF FF 33 C0 A3 F8 ?? ?? ?? BB ?? ?? ?? ?? C7 45 EC E8 64 ?? ?? C7 45 E8 ?? ?? ?? ?? C7 45 E4 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? B8 E0 ?? ?? ?? BA 04 00 00 00 E8 ?? EF FF FF 68 F4 01 00 00 E8 ?? EE FF FF 83 7B 04 00 75 0B 83 3B 00 0F 86 ?? 07 00 00 EB 06 0F 8E ?? 07 00 00 8B 03 8B D0 B8 E4 ?? ?? ?? E8 ?? E5 FF FF B8 E4 ?? ?? ?? E8 ?? E3 FF FF 8B D0 8B 45 EC 8B 0B E8 }
        $b = { 55 8B EC B9 15 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? 3A ?? ?? E8 ?? EE FF FF 33 C0 55 68 ?? 43 ?? ?? 64 FF 30 64 89 20 BA ?? 43 ?? ?? B8 E4 64 ?? ?? E8 0F FD FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? EE FF FF BA E8 64 ?? ?? 8B C3 8B 0D E4 64 ?? ?? E8 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Unnamed_Scrambler_21Beta_211_p0ke: PEiD
{
    strings:
        $a = { 55 8B EC B9 15 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? 3A ?? ?? E8 ?? EE FF FF 33 C0 55 68 ?? 43 ?? ?? 64 FF 30 64 89 20 BA ?? 43 ?? ?? B8 E4 64 ?? ?? E8 0F FD FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? EE FF FF BA E8 64 ?? ?? 8B C3 8B 0D E4 64 ?? ?? E8 ?? D7 FF FF B8 F8 ?? ?? ?? BA 04 00 00 00 E8 ?? EF FF FF 33 C0 A3 F8 ?? ?? ?? BB ?? ?? ?? ?? C7 45 EC E8 64 ?? ?? C7 45 E8 ?? ?? ?? ?? C7 45 E4 ?? ?? ?? ?? BE ?? ?? ?? ?? BF ?? ?? ?? ?? B8 E0 ?? ?? ?? BA 04 00 00 00 E8 ?? EF FF FF 68 F4 01 00 00 E8 ?? EE FF FF 83 7B 04 00 75 0B 83 3B 00 0F 86 ?? 07 00 00 EB 06 0F 8E ?? 07 00 00 8B 03 8B D0 B8 E4 ?? ?? ?? E8 ?? E5 FF FF B8 E4 ?? ?? ?? E8 ?? E3 FF FF 8B D0 8B 45 EC 8B 0B E8 }
        $b = { 55 8B EC B9 15 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 ?? 3A ?? ?? E8 ?? EE FF FF 33 C0 55 68 ?? 43 ?? ?? 64 FF 30 64 89 20 BA ?? 43 ?? ?? B8 E4 64 ?? ?? E8 0F FD FF FF 8B D8 85 DB 75 07 6A 00 E8 ?? EE FF FF BA E8 64 ?? ?? 8B C3 8B 0D E4 64 ?? ?? E8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: _PseudoSigner_02_Macromedia_Flash_Projector_60
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_02_Macromedia_Flash_Projector_60: PEiD
{
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Neolite_v20
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9E 37 ?? ?? 48 6F 4C }
        $b = { E9 A6 00 00 00 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Neolite_v20: PEiD
{
    strings:
        $a = { 9E 37 ?? ?? 48 6F 4C }
        $b = { E9 A6 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: CSV_01
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FC BE 00 01 8B FE B9 00 00 51 56 57 B4 18 04 0A AC 90 90 2A C4 32 C4 AA E2 F6 5F 5E 59 03 F1 83 EE 03 A5 A4 B8 00 01 50 33 C0 33 DB 33 C9 33 D2 33 F6 33 FF C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CSV_01: PEiD
{
    strings:
        $a = { FC BE 00 01 8B FE B9 00 00 51 56 57 B4 18 04 0A AC 90 90 2A C4 32 C4 AA E2 F6 5F 5E 59 03 F1 83 EE 03 A5 A4 B8 00 01 50 33 C0 33 DB 33 C9 33 D2 33 F6 33 FF C3 }
    condition:
        $a at pe.entry_point

}