deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: aPack_096
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE 0D 01 BF 00 70 8B CF FC 57 F3 A4 C3 BF 00 01 57 }

Detection condition:
$a at pe.entry_point

Full rule:
rule aPack_096: PEiD
{
    strings:
        $a = { BE 0D 01 BF 00 70 8B CF FC 57 F3 A4 C3 BF 00 01 57 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Thinstall_Embedded_V2312_Jitit_Sign_by_fly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 6A 00 FF 15 ?? ?? ?? ?? E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Thinstall_Embedded_V2312_Jitit_Sign_by_fly: PEiD
{
    strings:
        $a = { 6A 00 FF 15 ?? ?? ?? ?? E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 14 80 00 00 00 C2 04 00 55 8B EC 53 56 57 33 C0 33 FF 39 45 0C 8B F1 76 0C 8B 4D 08 03 3C 81 40 3B 45 0C 72 F4 8B CE E8 43 00 00 00 8B 46 14 33 D2 F7 F7 8B 5E 10 33 D2 8B F8 8B C3 F7 F7 89 7E 18 89 45 0C 33 C0 33 C9 8B 55 08 03 0C 82 40 39 4D 0C 73 F4 48 8B 14 82 2B CA 0F AF CF 2B D9 0F AF FA 89 7E 14 89 5E 10 5F 5E 5B 5D C2 08 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Maked_by_Grabber_v384_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? FC 8C DB 8C C8 8E D8 8E C0 89 1E ?? ?? E8 ?? ?? E8 ?? ?? E8 ?? ?? E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Maked_by_Grabber_v384_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? FC 8C DB 8C C8 8E D8 8E C0 89 1E ?? ?? E8 ?? ?? E8 ?? ?? E8 ?? ?? E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_Visual_Cpp_v70_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 59 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_Visual_Cpp_v70_additional: PEiD
{
    strings:
        $a = { 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 59 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ENIGMA_Protector_V11_CracKed_By_shoooo_fly_Sukhov_Vladimir
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 83 C5 FA 81 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ENIGMA_Protector_V11_CracKed_By_shoooo_fly_Sukhov_Vladimir: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 83 C5 FA 81 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Unknown_encryptor_2_PK7Tjrvx_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 06 B4 52 CD 21 07 E8 ?? ?? B4 62 CD 21 E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Unknown_encryptor_2_PK7Tjrvx_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 06 B4 52 CD 21 07 E8 ?? ?? B4 62 CD 21 E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: vprotector_12_vcasm_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 E8 05 00 00 00 0F 01 EB 05 E8 EB FB 00 00 83 C4 04 E8 08 00 00 00 0F 01 83 C0 }

Detection condition:
$a at pe.entry_point

Full rule:
rule vprotector_12_vcasm_h: PEiD
{
    strings:
        $a = { EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 33 F6 E8 10 00 00 00 8B 64 24 08 64 8F 05 00 00 00 00 58 EB 13 C7 83 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 AD CD 20 E8 05 00 00 00 0F 01 EB 05 E8 EB FB 00 00 83 C4 04 E8 08 00 00 00 0F 01 83 C0 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Naked_Packer_V10_BigBoote_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 FC 0F B6 05 ?? ?? ?? ?? 85 C0 75 31 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9A 00 00 00 A3 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? 01 83 3D ?? ?? ?? ?? 00 75 07 61 FF 25 ?? ?? ?? ?? 61 FF 74 24 04 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? C3 FF 74 24 04 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Naked_Packer_V10_BigBoote_additional: PEiD
{
    strings:
        $a = { 60 FC 0F B6 05 ?? ?? ?? ?? 85 C0 75 31 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9A 00 00 00 A3 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? 01 83 3D ?? ?? ?? ?? 00 75 07 61 FF 25 ?? ?? ?? ?? 61 FF 74 24 04 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? C3 FF 74 24 04 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_v20_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_v20_additional: PEiD
{
    strings:
        $a = { B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Visual_Cpp_50
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 00 00 00 00 68 00 00 00 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 00 53 56 57 89 65 E8 FF 15 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Visual_Cpp_50: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 00 00 00 00 68 00 00 00 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 00 53 56 57 89 65 E8 FF 15 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MacPaint_Graphics_format
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 00 02 FF FF FF FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule MacPaint_Graphics_format: PEiD
{
    strings:
        $a = { 00 00 00 02 FF FF FF FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_v2xx_CopyMem_II
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 6A ?? 8B B5 ?? ?? ?? ?? C1 E6 04 8B 85 ?? ?? ?? ?? 25 07 ?? ?? 80 79 05 48 83 C8 F8 40 33 C9 8A 88 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 81 E2 07 ?? ?? 80 79 05 4A 83 CA F8 42 33 C0 8A 82 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_v2xx_CopyMem_II: PEiD
{
    strings:
        $a = { 6A ?? 8B B5 ?? ?? ?? ?? C1 E6 04 8B 85 ?? ?? ?? ?? 25 07 ?? ?? 80 79 05 48 83 C8 F8 40 33 C9 8A 88 ?? ?? ?? ?? 8B 95 ?? ?? ?? ?? 81 E2 07 ?? ?? 80 79 05 4A 83 CA F8 42 33 C0 8A 82 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Hymn1865
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? 5E 83 EE 4C FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 ?? ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 50 06 56 1E 0E 1F B8 00 C5 CD 21 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Hymn1865: PEiD
{
    strings:
        $a = { E8 ?? ?? 5E 83 EE 4C FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 ?? ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? 50 06 56 1E 0E 1F B8 00 C5 CD 21 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CrypKey_V56X_DLL_Kenonic_Controls_Ltd
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B 1D ?? ?? ?? ?? 83 FB 00 75 0A E8 ?? ?? ?? ?? E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CrypKey_V56X_DLL_Kenonic_Controls_Ltd: PEiD
{
    strings:
        $a = { 8B 1D ?? ?? ?? ?? 83 FB 00 75 0A E8 ?? ?? ?? ?? E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Packanoid_Arkanoid_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BF 00 10 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Packanoid_Arkanoid_additional: PEiD
{
    strings:
        $a = { BF 00 10 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Inset_Systems_IGF_graphics_file_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 01 80 04 00 01 00 58 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Inset_Systems_IGF_graphics_file_Hint_FILE_START: PEiD
{
    strings:
        $a = { 01 80 04 00 01 00 58 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: NsPack_14_by_North_Star_Liu_Xing_Ping_
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53 }

Detection condition:
$a at pe.entry_point

Full rule:
rule NsPack_14_by_North_Star_Liu_Xing_Ping_: PEiD
{
    strings:
        $a = { 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: eXPressor_v12_CGSoftLabs
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 45 78 50 72 2D 76 2E 31 2E 32 2E }
        $b = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule eXPressor_v12_CGSoftLabs: PEiD
{
    strings:
        $a = { 45 78 50 72 2D 76 2E 31 2E 32 2E }
        $b = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Anti007_V25_V26_LiuXingPing_SignByfly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 57 72 69 74 65 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Anti007_V25_V26_LiuXingPing_SignByfly: PEiD
{
    strings:
        $a = { 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 57 72 69 74 65 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Visual_Cpp_2005_DLL_Microsoft
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B FF 55 8B EC 83 7D 0C 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Visual_Cpp_2005_DLL_Microsoft: PEiD
{
    strings:
        $a = { 8B FF 55 8B EC 83 7D 0C 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_09781
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 49 87 40 00 87 DD 8B 85 CE 87 40 00 01 85 3D 87 40 00 66 C7 85 3A 87 40 00 90 90 BB A6 09 00 00 03 9D D2 87 40 00 03 9D CE 87 40 00 53 53 53 58 2D A4 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_09781: PEiD
{
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 49 87 40 00 87 DD 8B 85 CE 87 40 00 01 85 3D 87 40 00 66 C7 85 3A 87 40 00 90 90 BB A6 09 00 00 03 9D D2 87 40 00 03 9D CE 87 40 00 53 53 53 58 2D A4 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_09784
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D1 84 40 00 87 DD 8B 85 56 85 40 00 01 85 C5 84 40 00 66 C7 85 C2 84 40 00 90 90 BB A6 09 00 00 03 9D 5A 85 40 00 03 9D 56 85 40 00 53 53 53 58 2D 2C }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_09784: PEiD
{
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D1 84 40 00 87 DD 8B 85 56 85 40 00 01 85 C5 84 40 00 66 C7 85 C2 84 40 00 90 90 BB A6 09 00 00 03 9D 5A 85 40 00 03 9D 56 85 40 00 53 53 53 58 2D 2C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Micrografix_Draw_Graphics_format_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 01 FF 02 04 03 02 00 02 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Micrografix_Draw_Graphics_format_Hint_FILE_START: PEiD
{
    strings:
        $a = { 01 FF 02 04 03 02 00 02 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASPR_Stripper_v2x_unpacked
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BB ?? ?? ?? ?? E9 ?? ?? ?? ?? 60 9C FC BF ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 AA 9D 61 C3 55 8B EC }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASPR_Stripper_v2x_unpacked: PEiD
{
    strings:
        $a = { BB ?? ?? ?? ?? E9 ?? ?? ?? ?? 60 9C FC BF ?? ?? ?? ?? B9 ?? ?? ?? ?? F3 AA 9D 61 C3 55 8B EC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: tElock_099_Special_Build_heXer_forgot
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule tElock_099_Special_Build_heXer_forgot: PEiD
{
    strings:
        $a = { E9 5E DF FF FF 00 00 00 ?? ?? ?? ?? E5 ?? ?? 00 00 00 00 00 00 00 00 00 05 ?? ?? 00 F5 ?? ?? 00 ED ?? ?? 00 00 00 00 00 00 00 00 00 12 ?? ?? 00 FD ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 1D ?? ?? 00 00 00 00 00 30 ?? ?? 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AIN_Archive_Hint_FILE_START_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 21 12 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule AIN_Archive_Hint_FILE_START_additional: PEiD
{
    strings:
        $a = { 21 12 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ORiEN_V212_Fisun_AV
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 5D 01 00 00 CE D1 CE CD 0D }

Detection condition:
$a at pe.entry_point

Full rule:
rule ORiEN_V212_Fisun_AV: PEiD
{
    strings:
        $a = { E9 5D 01 00 00 CE D1 CE CD 0D }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_4000053_Silicon_Realms_Toolworks_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 20 8B 4B 00 68 80 E4 48 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4B 00 33 D2 8A D4 89 15 A4 A1 4B 00 8B C8 81 E1 FF 00 00 00 89 0D A0 A1 4B 00 C1 E1 08 03 CA 89 0D 9C A1 4B 00 C1 E8 10 A3 98 A1 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_4000053_Silicon_Realms_Toolworks_additional: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 20 8B 4B 00 68 80 E4 48 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4B 00 33 D2 8A D4 89 15 A4 A1 4B 00 8B C8 81 E1 FF 00 00 00 89 0D A0 A1 4B 00 C1 E1 08 03 CA 89 0D 9C A1 4B 00 C1 E8 10 A3 98 A1 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Doom666_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? ?? 5E 83 EE ?? B8 CF 7B CD 21 3D CF 7B ?? ?? 0E 1F 81 C6 ?? ?? BF ?? ?? B9 ?? ?? FC F3 A4 06 1F 06 B8 ?? ?? 50 CB B4 48 BB 2C 00 CD 21 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Doom666_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E8 ?? ?? ?? 5E 83 EE ?? B8 CF 7B CD 21 3D CF 7B ?? ?? 0E 1F 81 C6 ?? ?? BF ?? ?? B9 ?? ?? FC F3 A4 06 1F 06 B8 ?? ?? 50 CB B4 48 BB 2C 00 CD 21 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_v13
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 }
        $b = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? ?? 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE ?? 74 EF FE }
        $c = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule FSG_v13: PEiD
{
    strings:
        $a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 }
        $b = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? ?? 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE ?? 74 EF FE }
        $c = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? ?? 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: FSG_v12
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 ?? 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_v12: PEiD
{
    strings:
        $a = { 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 ?? 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_v11
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BB D0 01 40 ?? BF ?? 10 40 ?? BE ?? ?? ?? ?? FC B2 80 8A 06 46 88 07 47 02 D2 75 05 8A 16 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_v11: PEiD
{
    strings:
        $a = { BB D0 01 40 ?? BF ?? 10 40 ?? BE ?? ?? ?? ?? FC B2 80 8A 06 46 88 07 47 02 D2 75 05 8A 16 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_v10
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_v10: PEiD
{
    strings:
        $a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MinGW_32x_WinMain
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 FC 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 FC 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 18 41 40 00 89 EC 5D }

Detection condition:
$a at pe.entry_point

Full rule:
rule MinGW_32x_WinMain: PEiD
{
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 FC 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 FC 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 18 41 40 00 89 EC 5D }
    condition:
        $a at pe.entry_point

}