deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: MicroDog_Win32Shell_V4093_SafeNet_SignByfly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 55 8B EC 81 EC 34 04 00 00 53 56 57 C6 85 B8 FE FF FF 00 C6 85 B9 FE FF FF 00 C6 85 BA FE FF FF 00 C6 85 BB FE FF FF 00 8D BD BC FE FF FF 33 C0 B9 3F 00 00 00 F3 AB C6 85 E8 FC FF FF 00 C6 85 E9 FC FF FF 00 C6 85 EA FC FF FF 00 C6 85 EB FC FF FF 00 8D BD EC FC FF FF 33 C0 B9 3F 00 00 00 F3 AB C7 85 10 FE FF FF A5 A5 00 00 66 C7 85 08 FE FF FF 0A 00 E9 13 09 00 00 90 68 00 10 00 00 E8 B8 F5 FF FF 83 C4 04 89 45 D0 83 7D D0 00 75 05 E9 C1 11 00 00 68 00 10 00 00 A1 ?? ?? ?? ?? 50 8B 45 D0 50 E8 FF F6 FF FF 83 C4 0C A1 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 89 85 34 FE FF FF 8B 85 34 FE FF FF 89 45 CC E9 CE 0E 00 00 E9 36 11 00 00 E9 3D 11 00 00 E9 38 11 00 00 66 C7 45 EC 00 00 EB 04 66 FF 45 EC 8B 45 EC 25 FF FF 00 00 83 F8 03 0F 8D DF 00 00 00 8B 45 EC 25 FF FF 00 00 8B 4D EC 81 E1 FF FF 00 00 0F AF C1 8B 4D EC 81 E1 FF FF 00 00 0F AF C1 8B 4D EC 81 E1 FF FF 00 00 0F AF C1 83 C0 07 89 85 EC FB FF FF EB 7E }
        $b = { 60 55 8B EC 81 EC 34 04 00 00 53 56 57 C6 85 B8 FE FF FF 00 C6 8

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule MicroDog_Win32Shell_V4093_SafeNet_SignByfly: PEiD
{
    strings:
        $a = { 60 55 8B EC 81 EC 34 04 00 00 53 56 57 C6 85 B8 FE FF FF 00 C6 85 B9 FE FF FF 00 C6 85 BA FE FF FF 00 C6 85 BB FE FF FF 00 8D BD BC FE FF FF 33 C0 B9 3F 00 00 00 F3 AB C6 85 E8 FC FF FF 00 C6 85 E9 FC FF FF 00 C6 85 EA FC FF FF 00 C6 85 EB FC FF FF 00 8D BD EC FC FF FF 33 C0 B9 3F 00 00 00 F3 AB C7 85 10 FE FF FF A5 A5 00 00 66 C7 85 08 FE FF FF 0A 00 E9 13 09 00 00 90 68 00 10 00 00 E8 B8 F5 FF FF 83 C4 04 89 45 D0 83 7D D0 00 75 05 E9 C1 11 00 00 68 00 10 00 00 A1 ?? ?? ?? ?? 50 8B 45 D0 50 E8 FF F6 FF FF 83 C4 0C A1 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 89 85 34 FE FF FF 8B 85 34 FE FF FF 89 45 CC E9 CE 0E 00 00 E9 36 11 00 00 E9 3D 11 00 00 E9 38 11 00 00 66 C7 45 EC 00 00 EB 04 66 FF 45 EC 8B 45 EC 25 FF FF 00 00 83 F8 03 0F 8D DF 00 00 00 8B 45 EC 25 FF FF 00 00 8B 4D EC 81 E1 FF FF 00 00 0F AF C1 8B 4D EC 81 E1 FF FF 00 00 0F AF C1 8B 4D EC 81 E1 FF FF 00 00 0F AF C1 83 C0 07 89 85 EC FB FF FF EB 7E }
        $b = { 60 55 8B EC 81 EC 34 04 00 00 53 56 57 C6 85 B8 FE FF FF 00 C6 85 B9 FE FF FF 00 C6 85 BA FE FF FF 00 C6 85 BB FE FF FF 00 8D BD BC FE FF FF 33 C0 B9 3F 00 00 00 F3 AB C6 85 E8 FC FF FF 00 C6 85 E9 FC FF FF 00 C6 85 EA FC FF FF 00 C6 85 EB FC FF FF 00 8D }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: PKLITE32_v11_Hint_WIN_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 44 24 0C 50 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PKLITE32_v11_Hint_WIN_EP: PEiD
{
    strings:
        $a = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 2B 44 24 0C 50 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Enigma_Protector_131_Build_20070615_Dll_Sukhov_Vladimir_Serge_N_Markin_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 81 ED ?? ?? ?? ?? E9 49 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Enigma_Protector_131_Build_20070615_Dll_Sukhov_Vladimir_Serge_N_Markin_additional: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 81 ED ?? ?? ?? ?? E9 49 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_430a_Silicon_Realms_Toolworks_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_430a_Silicon_Realms_Toolworks_additional: PEiD
{
    strings:
        $a = { 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 41 4E 53 49 29 2C 20 61 70 70 20 73 74 72 69 6E 67 73 20 61 72 65 20 27 25 73 27 20 61 6E 64 20 27 25 73 27 00 00 00 44 64 65 44 61 74 61 20 69 6E 69 74 69 61 6C 69 7A 65 64 20 28 55 4E 49 43 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: COP_v10_c_1988_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BF ?? ?? BE ?? ?? B9 ?? ?? AC 32 ?? ?? ?? AA E2 ?? 8B ?? ?? ?? EB ?? 90 }

Detection condition:
$a at pe.entry_point

Full rule:
rule COP_v10_c_1988_Hint_DOS_EP: PEiD
{
    strings:
        $a = { BF ?? ?? BE ?? ?? B9 ?? ?? AC 32 ?? ?? ?? AA E2 ?? 8B ?? ?? ?? EB ?? 90 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Ding_Boys_PE_lock_Phantasm_v08_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 0D 39 40 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Ding_Boys_PE_lock_Phantasm_v08_additional: PEiD
{
    strings:
        $a = { 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 0D 39 40 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CRC2COM_v124_unpacked_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB ?? C8 ?? ?? ?? E8 ?? ?? 0E 07 C6 ?? ?? ?? E8 ?? ?? E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CRC2COM_v124_unpacked_Hint_DOS_EP: PEiD
{
    strings:
        $a = { EB ?? C8 ?? ?? ?? E8 ?? ?? 0E 07 C6 ?? ?? ?? E8 ?? ?? E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PEiD_5258_3DMark_Database_file_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 33 44 4D 61 72 6B 20 44 61 74 61 62 61 73 65 20 46 69 6C 65 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PEiD_5258_3DMark_Database_file_additional: PEiD
{
    strings:
        $a = { 33 44 4D 61 72 6B 20 44 61 74 61 62 61 73 65 20 46 69 6C 65 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_PENinja_131_Anorganix_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_PENinja_131_Anorganix_additional: PEiD
{
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Obsidium_V1354_Obsidium_Software_200800207
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 03 ?? ?? ?? E8 2D 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 25 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 02 ?? ?? 58 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 5B 28 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsidium_V1354_Obsidium_Software_200800207: PEiD
{
    strings:
        $a = { EB 03 ?? ?? ?? E8 2D 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 25 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 01 ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 02 ?? ?? 58 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 04 ?? ?? ?? ?? E8 5B 28 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPX_290_LZMA
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB }
        $b = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 ?? ?? ?? ?? 90 90 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule UPX_290_LZMA: PEiD
{
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB }
        $b = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 ?? ?? ?? ?? 90 90 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: UPX_v0761_pe_exe_Hint_WIN_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 BE ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 57 83 ?? ?? 31 DB EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPX_v0761_pe_exe_Hint_WIN_EP: PEiD
{
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 57 83 ?? ?? 31 DB EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPXShit_006_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? 43 00 B9 15 00 00 00 80 34 08 ?? E2 FA E9 D6 FF FF FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPXShit_006_additional: PEiD
{
    strings:
        $a = { B8 ?? ?? 43 00 B9 15 00 00 00 80 34 08 ?? E2 FA E9 D6 FF FF FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_TrojanSurprice_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? BF ?? ?? 8B ?? ?? 8D ?? ?? ?? B9 ?? ?? 81 ?? ?? ?? AD E2 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_TrojanSurprice_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? BF ?? ?? 8B ?? ?? 8D ?? ?? ?? B9 ?? ?? 81 ?? ?? ?? AD E2 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: XorCopy_v10_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? B8 ?? ?? BB ?? ?? BA ?? ?? 31 07 43 40 39 D3 75 ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? 31 C0 31 DB 31 D2 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule XorCopy_v10_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? B8 ?? ?? BB ?? ?? BA ?? ?? 31 07 43 40 39 D3 75 ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? C6 ?? ?? ?? ?? 31 C0 31 DB 31 D2 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PIRIT_v15_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B4 4D CD 21 E8 ?? ?? FD E8 ?? ?? B4 51 CD 21 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PIRIT_v15_additional: PEiD
{
    strings:
        $a = { B4 4D CD 21 E8 ?? ?? FD E8 ?? ?? B4 51 CD 21 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PEShit_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 33 D2 EB 01 0F 56 EB 01 0F E8 03 00 00 00 EB 01 0F EB 01 0F 5E EB 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PEShit_additional: PEiD
{
    strings:
        $a = { B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 33 D2 EB 01 0F 56 EB 01 0F E8 03 00 00 00 EB 01 0F EB 01 0F 5E EB 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: WinUpack_v030_beta_By_Dwing_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule WinUpack_v030_beta_By_Dwing_h: PEiD
{
    strings:
        $a = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXECryptor_2117_StrongbitSoftComplete_Development
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 }
        $b = { BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 D0 03 45 F4 8B 18 8B 7E 10 01 D7 03 7D F4 09 DB 0F 84 ?? 00 00 00 F7 C3 00 00 00 80 0F 85 04 00 00 00 8D 5C 13 02 81 E3 FF FF FF 7F 53 FF 75 F8 FF 15 9C ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 07 83 45 F4 04 E9 A6 FF FF FF }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule EXECryptor_2117_StrongbitSoftComplete_Development: PEiD
{
    strings:
        $a = { BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 }
        $b = { BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 D0 03 45 F4 8B 18 8B 7E 10 01 D7 03 7D F4 09 DB 0F 84 ?? 00 00 00 F7 C3 00 00 00 80 0F 85 04 00 00 00 8D 5C 13 02 81 E3 FF FF FF 7F 53 FF 75 F8 FF 15 9C ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 07 83 45 F4 04 E9 A6 FF FF FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Turbo_Pascal_v40_Unit_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 54 50 55 30 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Turbo_Pascal_v40_Unit_Hint_FILE_START: PEiD
{
    strings:
        $a = { 54 50 55 30 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FishPE_V10X_hellfish_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 ?? ?? ?? ?? C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 ?? ?? 00 00 ?? ?? ?? ?? 00 00 02 00 00 00 A0 00 00 18 01 00 00 ?? ?? ?? ?? 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 C0 00 00 40 39 00 00 ?? ?? ?? ?? 00 00 08 00 00 00 00 01 00 C8 06 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FishPE_V10X_hellfish_additional: PEiD
{
    strings:
        $a = { 60 E8 ?? ?? ?? ?? C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 ?? ?? 00 00 ?? ?? ?? ?? 00 00 02 00 00 00 A0 00 00 18 01 00 00 ?? ?? ?? ?? 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 C0 00 00 40 39 00 00 ?? ?? ?? ?? 00 00 08 00 00 00 00 01 00 C8 06 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: HSC_music_file
Repository: Yara-Rules/rules

Pattern signatures:
$a = { C8 E2 04 20 }

Detection condition:
$a at pe.entry_point

Full rule:
rule HSC_music_file: PEiD
{
    strings:
        $a = { C8 E2 04 20 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: COMPACK_v51_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BD ?? ?? 50 06 8C CB 03 DD 8C D2 4B 8E DB BE ?? ?? BF ?? ?? 8E C2 B9 ?? ?? F3 A5 4A 4D 75 ?? 8B F7 8E DA 0E 07 06 16 }

Detection condition:
$a at pe.entry_point

Full rule:
rule COMPACK_v51_additional: PEiD
{
    strings:
        $a = { BD ?? ?? 50 06 8C CB 03 DD 8C D2 4B 8E DB BE ?? ?? BF ?? ?? 8E C2 B9 ?? ?? F3 A5 4A 4D 75 ?? 8B F7 8E DA 0E 07 06 16 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_120_Eng_dulekxt_MASM32_TASM32_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_120_Eng_dulekxt_MASM32_TASM32_additional: PEiD
{
    strings:
        $a = { 0F B6 D0 E8 01 00 00 00 0C 5A B8 80 ?? ?? 00 EB 02 00 DE 8D 35 F4 00 00 00 F7 D2 EB 02 0E EA 8B 38 EB 01 A0 C1 F3 11 81 EF 84 88 F4 4C EB 02 CD 20 83 F7 22 87 D3 33 FE C1 C3 19 83 F7 26 E8 02 00 00 00 BC DE 5A 81 EF F7 EF 6F 18 EB 02 CD 20 83 EF 7F EB 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Pohernah_100_by_Kas_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 58 60 E8 00 00 00 00 5D 81 ED 20 25 40 00 8B BD 86 25 40 00 8B 8D 8E 25 40 00 6B C0 05 83 F0 04 89 85 92 25 40 00 83 F9 00 74 2D 81 7F 1C AB 00 00 00 75 1E 8B 77 0C 03 B5 8A 25 40 00 31 C0 3B 47 10 74 0E 50 8B 85 92 25 40 00 30 06 58 40 46 EB ED 83 C7 28 49 EB CE 8B 85 82 25 40 00 89 44 24 1C 61 FF E0 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Pohernah_100_by_Kas_additional: PEiD
{
    strings:
        $a = { 58 60 E8 00 00 00 00 5D 81 ED 20 25 40 00 8B BD 86 25 40 00 8B 8D 8E 25 40 00 6B C0 05 83 F0 04 89 85 92 25 40 00 83 F9 00 74 2D 81 7F 1C AB 00 00 00 75 1E 8B 77 0C 03 B5 8A 25 40 00 31 C0 3B 47 10 74 0E 50 8B 85 92 25 40 00 30 06 58 40 46 EB ED 83 C7 28 49 EB CE 8B 85 82 25 40 00 89 44 24 1C 61 FF E0 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXE_Stealth_v276_WebToolMaster
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 65 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 59 4F 55 52 20 41 44 20 48 45 52 45 21 50 69 52 41 43 59 20 69 53 20 41 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXE_Stealth_v276_WebToolMaster: PEiD
{
    strings:
        $a = { EB 65 45 78 65 53 74 65 61 6C 74 68 20 56 32 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D 20 59 4F 55 52 20 41 44 20 48 45 52 45 21 50 69 52 41 43 59 20 69 53 20 41 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PKLite_114_COM
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 00 00 BA 00 00 3B C4 73 67 8B C4 2D 44 03 25 F0 FF 8B F8 B9 A2 00 BE 7C 01 FC F3 A5 8B D8 B1 04 D3 EB 8C D9 03 D9 53 33 DB 53 CB 0E 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PKLite_114_COM: PEiD
{
    strings:
        $a = { B8 00 00 BA 00 00 3B C4 73 67 8B C4 2D 44 03 25 F0 FF 8B F8 B9 A2 00 BE 7C 01 FC F3 A5 8B D8 B1 04 D3 EB 8C D9 03 D9 53 33 DB 53 CB 0E 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Exe_Shield_vxx
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 65 78 65 73 68 6C 2E 64 6C 6C C0 5D 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Exe_Shield_vxx: PEiD
{
    strings:
        $a = { 65 78 65 73 68 6C 2E 64 6C 6C C0 5D 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RLPack_V115_V117_aPlib_043_ap0x
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule RLPack_V115_V117_aPlib_043_ap0x: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 45 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PCPEC_alpha_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 8B CD 81 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 83 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PCPEC_alpha_additional: PEiD
{
    strings:
        $a = { 53 51 52 56 57 55 E8 ?? ?? ?? ?? 5D 8B CD 81 ?? ?? ?? ?? ?? 2B ?? ?? ?? ?? ?? 83 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Amiga_IFFILBM_Graphics_format_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 46 4F 52 4D ?? ?? ?? ?? 49 4C 42 4D 42 4D 48 44 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Amiga_IFFILBM_Graphics_format_additional: PEiD
{
    strings:
        $a = { 46 4F 52 4D ?? ?? ?? ?? 49 4C 42 4D 42 4D 48 44 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXEPACK_v405_v406_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 06 ?? ?? 8E C0 8B 0E ?? ?? 8B F9 4F 8B F7 FD F3 A4 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXEPACK_v405_v406_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 06 ?? ?? 8E C0 8B 0E ?? ?? 8B F9 4F 8B F7 FD F3 A4 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: yodas_Protector_v101_Ashkbiz_Danehkar_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED A5 E5 41 00 8B D5 81 C2 F3 E5 41 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? B9 F0 FE 41 00 81 E9 93 E6 41 00 8B D5 81 C2 93 E6 41 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 33 C0 64 FF 30 64 89 20 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA }

Detection condition:
$a at pe.entry_point

Full rule:
rule yodas_Protector_v101_Ashkbiz_Danehkar_additional: PEiD
{
    strings:
        $a = { 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED A5 E5 41 00 8B D5 81 C2 F3 E5 41 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? B9 F0 FE 41 00 81 E9 93 E6 41 00 8B D5 81 C2 93 E6 41 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 33 C0 64 FF 30 64 89 20 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA }
    condition:
        $a at pe.entry_point

}