deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: WinZip_SFX
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8A CB D3 E7 4F FF 4D D8 0F B7 08 23 FE 3B F9 75 E4 E9 9F FD FF FF FF 45 EC 8B 45 EC 39 45 E0 0F 8D 7F FD FF FF 83 7D DC 00 74 32 83 7D E0 01 74 2C B8 01 00 00 00 EB 27 83 7D D8 00 74 0E FF B5 38 FF FF FF E8 1D 00 00 00 83 C4 04 68 00 00 40 }

Detection condition:
$a at pe.entry_point

Full rule:
rule WinZip_SFX: PEiD
{
    strings:
        $a = { 8A CB D3 E7 4F FF 4D D8 0F B7 08 23 FE 3B F9 75 E4 E9 9F FD FF FF FF 45 EC 8B 45 EC 39 45 E0 0F 8D 7F FD FF FF 83 7D DC 00 74 32 83 7D E0 01 74 2C B8 01 00 00 00 EB 27 83 7D D8 00 74 0E FF B5 38 FF FF FF E8 1D 00 00 00 83 C4 04 68 00 00 40 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Enigma_protector_110_unregistered_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56 41 87 FC 0F F3 05 40 81 68 4B 93 71 40 BB 87 3C 40 40 8B 88 06 75 70 40 40 8B BB B3 43 C4 8F 93 2B F3 4A 88 06 07 30 F5 EA 2A 35 F0 4B 8A C3 07 C1 C6 02 C4 34 C0 74 74 32 02 C4 45 0B 3C 96 BE 0A 82 C3 DE 36 A9 7E 5A 51 A6 BC 63 A8 66 CB 30 58 20 8C CC 85 53 9F C1 E4 10 80 11 20 1E 48 D2 E8 F7 28 5C 26 89 5C 94 89 5A F8 1C 0B 74 7E 33 4E 9B 29 56 F2 2B 84 42 8A 95 16 76 64 08 7B 70 8F A0 0B A8 3A C1 C7 B5 3E D9 70 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Enigma_protector_110_unregistered_additional: PEiD
{
    strings:
        $a = { 60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56 41 87 FC 0F F3 05 40 81 68 4B 93 71 40 BB 87 3C 40 40 8B 88 06 75 70 40 40 8B BB B3 43 C4 8F 93 2B F3 4A 88 06 07 30 F5 EA 2A 35 F0 4B 8A C3 07 C1 C6 02 C4 34 C0 74 74 32 02 C4 45 0B 3C 96 BE 0A 82 C3 DE 36 A9 7E 5A 51 A6 BC 63 A8 66 CB 30 58 20 8C CC 85 53 9F C1 E4 10 80 11 20 1E 48 D2 E8 F7 28 5C 26 89 5C 94 89 5A F8 1C 0B 74 7E 33 4E 9B 29 56 F2 2B 84 42 8A 95 16 76 64 08 7B 70 8F A0 0B A8 3A C1 C7 B5 3E D9 70 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Erdas_LANGIS_Image_graphics_format_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 48 45 41 44 37 34 00 00 03 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Erdas_LANGIS_Image_graphics_format_Hint_FILE_START: PEiD
{
    strings:
        $a = { 48 45 41 44 37 34 00 00 03 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: VMware_ThinApp_V4012866_VMware_20090124
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 72 13 00 00 2B C3 50 68 00 00 20 46 68 00 60 00 00 68 58 01 00 00 E8 71 FC FF FF E9 DA FC FF FF 55 8B EC 8B 48 3C 83 EC 0C 53 56 57 8D 7C 01 78 8B 0F 85 C9 74 7E 8B 77 04 83 FE 28 72 76 8D 1C 01 8B 53 18 85 D2 74 6C 8B 43 20 3B C1 72 65 8D 14 90 03 F1 3B F2 72 5C 83 65 FC 00 2B C1 03 C3 83 7B 18 00 89 45 F4 76 4B 8B 4D FC 8B 45 F4 8D 04 88 8B 0F 3B 08 77 31 8B 30 FF 75 08 8B C1 89 45 F8 FF 15 2C 30 20 46 8B 4F 04 03 4D F8 8D 44 30 01 3B C1 77 13 2B 75 F8 FF 75 08 03 F3 56 FF 15 28 30 20 46 85 C0 74 12 FF 45 FC 8B 45 FC 3B 43 18 72 B5 33 C0 5F 5E 5B C9 C3 8B 55 FC 39 53 14 76 F1 8B 43 1C 8B 0F 3B C1 72 E8 8D 04 90 8B 57 04 03 D1 8D 70 04 3B D6 72 D9 2B C1 8B 04 18 EB D4 FF 25 5C 14 20 46 00 00 00 00 56 6A 01 FF 74 24 14 6A 00 FF 74 24 18 E8 DC 07 00 00 8B F0 83 C4 10 85 F6 75 04 33 C0 EB 28 68 AB 14 20 46 E8 0B FF FF FF 59 85 C0 74 ED 8B 4C 24 14 68 5C 14 20 46 FF 74 24 10 03 C6 6A 01 C7 01 56 14 20 46 FF D0 5E C2 10 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule VMware_ThinApp_V4012866_VMware_20090124: PEiD
{
    strings:
        $a = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 72 13 00 00 2B C3 50 68 00 00 20 46 68 00 60 00 00 68 58 01 00 00 E8 71 FC FF FF E9 DA FC FF FF 55 8B EC 8B 48 3C 83 EC 0C 53 56 57 8D 7C 01 78 8B 0F 85 C9 74 7E 8B 77 04 83 FE 28 72 76 8D 1C 01 8B 53 18 85 D2 74 6C 8B 43 20 3B C1 72 65 8D 14 90 03 F1 3B F2 72 5C 83 65 FC 00 2B C1 03 C3 83 7B 18 00 89 45 F4 76 4B 8B 4D FC 8B 45 F4 8D 04 88 8B 0F 3B 08 77 31 8B 30 FF 75 08 8B C1 89 45 F8 FF 15 2C 30 20 46 8B 4F 04 03 4D F8 8D 44 30 01 3B C1 77 13 2B 75 F8 FF 75 08 03 F3 56 FF 15 28 30 20 46 85 C0 74 12 FF 45 FC 8B 45 FC 3B 43 18 72 B5 33 C0 5F 5E 5B C9 C3 8B 55 FC 39 53 14 76 F1 8B 43 1C 8B 0F 3B C1 72 E8 8D 04 90 8B 57 04 03 D1 8D 70 04 3B D6 72 D9 2B C1 8B 04 18 EB D4 FF 25 5C 14 20 46 00 00 00 00 56 6A 01 FF 74 24 14 6A 00 FF 74 24 18 E8 DC 07 00 00 8B F0 83 C4 10 85 F6 75 04 33 C0 EB 28 68 AB 14 20 46 E8 0B FF FF FF 59 85 C0 74 ED 8B 4C 24 14 68 5C 14 20 46 FF 74 24 10 03 C6 6A 01 C7 01 56 14 20 46 FF D0 5E C2 10 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Themida_1201_Oreans_Technologies
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? 35 09 89 95 ?? ?? 35 09 89 B5 ?? ?? 35 09 89 85 ?? ?? 35 09 83 BD ?? ?? 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 }
        $b = { 8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? 35 09 89 95 ?? ?? 35 09 89 B5 ?? ?? 35 09 89 85 ?? ?? 35 09 83 BD ?? ?? 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 11 02 00 00 00 00 00 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Themida_1201_Oreans_Technologies: PEiD
{
    strings:
        $a = { 8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? 35 09 89 95 ?? ?? 35 09 89 B5 ?? ?? 35 09 89 85 ?? ?? 35 09 83 BD ?? ?? 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 }
        $b = { 8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? 35 09 89 95 ?? ?? 35 09 89 B5 ?? ?? 35 09 89 85 ?? ?? 35 09 83 BD ?? ?? 35 09 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? 35 09 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 11 02 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Microsoft_Visual_Basic_v60_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FF 25 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? FF FF FF ?? ?? ?? ?? ?? ?? 30 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_Visual_Basic_v60_additional: PEiD
{
    strings:
        $a = { FF 25 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? FF FF FF ?? ?? ?? ?? ?? ?? 30 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: HideProtect_V10X_SoftWar_Company
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
        $b = { 90 90 90 E9 D8 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule HideProtect_V10X_SoftWar_Company: PEiD
{
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
        $b = { 90 90 90 E9 D8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: ASProtect_v11_BRS
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 01 }
        $b = { 60 E9 ?? 05 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule ASProtect_v11_BRS: PEiD
{
    strings:
        $a = { 68 01 }
        $b = { 60 E9 ?? 05 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: EXE2COM_Method_1
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8C DB BE ?? ?? 8B C6 B1 ?? D3 E8 03 C3 03 ?? ?? A3 ?? ?? 8C C8 05 ?? ?? A3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXE2COM_Method_1: PEiD
{
    strings:
        $a = { 8C DB BE ?? ?? 8B C6 B1 ?? D3 E8 03 C3 03 ?? ?? A3 ?? ?? 8C C8 05 ?? ?? A3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Windows_Write_file_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE 00 00 00 AB 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Windows_Write_file_Hint_FILE_START: PEiD
{
    strings:
        $a = { BE 00 00 00 AB 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PKZIP_SFX_v11_1989_90_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FC 2E 8C 0E ?? ?? A1 ?? ?? 8C CB 81 C3 ?? ?? 3B C3 72 ?? 2D ?? ?? 2D ?? ?? FA BC ?? ?? 8E D0 FB }

Detection condition:
$a at pe.entry_point

Full rule:
rule PKZIP_SFX_v11_1989_90_Hint_DOS_EP: PEiD
{
    strings:
        $a = { FC 2E 8C 0E ?? ?? A1 ?? ?? 8C CB 81 C3 ?? ?? 3B C3 72 ?? 2D ?? ?? 2D ?? ?? FA BC ?? ?? 8E D0 FB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: tELock_051
Repository: Yara-Rules/rules

Pattern signatures:
$a = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 00 00 59 EB 01 EB AC 54 E8 03 00 00 00 5C EB 08 8D 64 24 04 FF 64 24 FC 6A 05 D0 2C 24 72 01 E8 01 24 24 5C F7 DC EB 02 CD 20 8D 64 24 FE F7 DC EB 02 CD 20 }

Detection condition:
$a at pe.entry_point

Full rule:
rule tELock_051: PEiD
{
    strings:
        $a = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 00 00 59 EB 01 EB AC 54 E8 03 00 00 00 5C EB 08 8D 64 24 04 FF 64 24 FC 6A 05 D0 2C 24 72 01 E8 01 24 24 5C F7 DC EB 02 CD 20 8D 64 24 FE F7 DC EB 02 CD 20 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RLPack_117p
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? 00 00 8D 9D ?? ?? 00 00 33 FF E8 ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 37 FF D3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RLPack_117p: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? 00 00 8D 9D ?? ?? 00 00 33 FF E8 ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 37 FF D3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: yodas_Protector_10_beta_Ashkbiz_Danehkar
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule yodas_Protector_10_beta_Ashkbiz_Danehkar: PEiD
{
    strings:
        $a = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: DBPE_v210_Ding_Boy
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 20 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? EB 58 75 73 65 72 33 32 2E 64 6C 6C ?? 4D 65 73 73 61 67 65 42 6F 78 41 ?? 6B 65 72 6E 65 6C }

Detection condition:
$a at pe.entry_point

Full rule:
rule DBPE_v210_Ding_Boy: PEiD
{
    strings:
        $a = { EB 20 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? EB 58 75 73 65 72 33 32 2E 64 6C 6C ?? 4D 65 73 73 61 67 65 42 6F 78 41 ?? 6B 65 72 6E 65 6C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Dev_Cpp_4992_Bloodshed_Software_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 57 68 ?? 0D 01 00 68 00 ?? ?? 00 E8 50 ?? FF FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Dev_Cpp_4992_Bloodshed_Software_additional: PEiD
{
    strings:
        $a = { 57 68 ?? 0D 01 00 68 00 ?? ?? 00 E8 50 ?? FF FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_SYP_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 47 8B C2 05 1E 00 52 8B D0 B8 02 3D CD 21 8B D8 5A }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_SYP_additional: PEiD
{
    strings:
        $a = { 47 8B C2 05 1E 00 52 8B D0 B8 02 3D CD 21 8B D8 5A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_v110_Eng_dulekxt_Borland_Cpp_1999
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 02 CD 20 2B C8 68 80 ?? ?? 00 EB 02 1E BB 5E EB 02 CD 20 68 B1 2B 6E 37 40 5B 0F B6 C9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_v110_Eng_dulekxt_Borland_Cpp_1999: PEiD
{
    strings:
        $a = { EB 02 CD 20 2B C8 68 80 ?? ?? 00 EB 02 1E BB 5E EB 02 CD 20 68 B1 2B 6E 37 40 5B 0F B6 C9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Themida_Oreans_Technologies_2004_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Themida_Oreans_Technologies_2004_additional: PEiD
{
    strings:
        $a = { B8 00 00 00 00 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Petite_12_c1998_Ian_Luck_h_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02 02 03 03 03 03 04 04 04 04 05 05 05 05 00 70 70 01 00 02 00 03 00 04 00 05 00 07 00 09 00 0D 00 11 00 19 00 21 00 31 00 41 00 61 00 81 00 C1 00 01 01 81 01 01 02 01 03 01 04 01 06 01 08 01 0C 01 10 01 18 01 20 01 30 01 40 01 60 00 00 00 00 01 01 02 02 03 03 04 04 05 05 06 06 07 07 08 08 09 09 0A 0A 0B 0B 0C 0C 0D 0D 10 11 12 00 08 07 09 06 0A 05 0B 04 0C 03 0D 02 0E 01 0F 58 2C 08 50 8B C8 8B D0 81 C1 ?? D2 00 00 81 C2 ?? ?? 00 00 89 20 8B E1 50 81 2C 24 00 ?? ?? ?? FF 30 50 80 04 24 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Petite_12_c1998_Ian_Luck_h_additional: PEiD
{
    strings:
        $a = { 66 9C 60 E8 CA 00 00 00 03 00 04 00 05 00 06 00 07 00 08 00 09 00 0A 00 0B 00 0D 00 0F 00 11 00 13 00 17 00 1B 00 1F 00 23 00 2B 00 33 00 3B 00 43 00 53 00 63 00 73 00 83 00 A3 00 C3 00 E3 00 02 01 00 00 00 00 00 00 00 00 00 00 00 00 01 01 01 01 02 02 02 02 03 03 03 03 04 04 04 04 05 05 05 05 00 70 70 01 00 02 00 03 00 04 00 05 00 07 00 09 00 0D 00 11 00 19 00 21 00 31 00 41 00 61 00 81 00 C1 00 01 01 81 01 01 02 01 03 01 04 01 06 01 08 01 0C 01 10 01 18 01 20 01 30 01 40 01 60 00 00 00 00 01 01 02 02 03 03 04 04 05 05 06 06 07 07 08 08 09 09 0A 0A 0B 0B 0C 0C 0D 0D 10 11 12 00 08 07 09 06 0A 05 0B 04 0C 03 0D 02 0E 01 0F 58 2C 08 50 8B C8 8B D0 81 C1 ?? D2 00 00 81 C2 ?? ?? 00 00 89 20 8B E1 50 81 2C 24 00 ?? ?? ?? FF 30 50 80 04 24 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FileShield_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 1E EB ?? 90 00 00 8B D8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FileShield_additional: PEiD
{
    strings:
        $a = { 50 1E EB ?? 90 00 00 8B D8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: WWPack32_v1x_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 53 55 8B E8 33 DB EB 60 }

Detection condition:
$a at pe.entry_point

Full rule:
rule WWPack32_v1x_additional: PEiD
{
    strings:
        $a = { 53 55 8B E8 33 DB EB 60 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXECryptor_2117_Strongbit_SoftComplete_Development_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXECryptor_2117_Strongbit_SoftComplete_Development_h: PEiD
{
    strings:
        $a = { BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPX_v103_v104_Laszlo_Markus
Repository: Yara-Rules/rules

Pattern signatures:
$a = { ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 8A 07 72 EB B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPX_v103_v104_Laszlo_Markus: PEiD
{
    strings:
        $a = { ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 8A 07 72 EB B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 ?? 75 ?? 8B 1E 83 EE FC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: InterLok_V551_PACE_Anti_Piracy_SignByfly_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 03 ?? ?? ?? 55 EB 03 ?? ?? ?? EB 04 ?? EB 06 ?? 8B EC EB F9 ?? EB 02 ?? ?? 81 EC A8 00 00 00 EB 02 ?? ?? EB 01 ?? 53 EB 03 ?? ?? ?? EB 05 ?? ?? EB 15 ?? EB 03 ?? ?? ?? 56 EB 04 ?? EB F2 ?? EB 01 ?? EB F8 ?? ?? ?? EB 0F ?? 33 F6 EB 10 ?? ?? ?? EB F7 }

Detection condition:
$a at pe.entry_point

Full rule:
rule InterLok_V551_PACE_Anti_Piracy_SignByfly_additional: PEiD
{
    strings:
        $a = { EB 03 ?? ?? ?? 55 EB 03 ?? ?? ?? EB 04 ?? EB 06 ?? 8B EC EB F9 ?? EB 02 ?? ?? 81 EC A8 00 00 00 EB 02 ?? ?? EB 01 ?? 53 EB 03 ?? ?? ?? EB 05 ?? ?? EB 15 ?? EB 03 ?? ?? ?? 56 EB 04 ?? EB F2 ?? EB 01 ?? EB F8 ?? ?? ?? EB 0F ?? 33 F6 EB 10 ?? ?? ?? EB F7 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_v110_Eng_dulekxt_MASM32_TASM32_Microsoft_Visual_Basic_
Repository: Yara-Rules/rules

Pattern signatures:
$a = { F7 D8 0F BE C2 BE 80 ?? ?? 00 0F BE C9 BF 08 3B 65 07 EB 02 D8 29 BB EC C5 9A F8 EB 01 94 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_v110_Eng_dulekxt_MASM32_TASM32_Microsoft_Visual_Basic_: PEiD
{
    strings:
        $a = { F7 D8 0F BE C2 BE 80 ?? ?? 00 0F BE C9 BF 08 3B 65 07 EB 02 D8 29 BB EC C5 9A F8 EB 01 94 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: tElock_v090_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 02 00 00 00 E8 00 E8 00 00 00 00 5E 2B }

Detection condition:
$a at pe.entry_point

Full rule:
rule tElock_v090_additional: PEiD
{
    strings:
        $a = { E8 02 00 00 00 E8 00 E8 00 00 00 00 5E 2B }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Exe_Shield_v27_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 C3 9C 60 E8 5D 55 5B 81 ED 8B 85 01 85 66 C7 85 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Exe_Shield_v27_additional: PEiD
{
    strings:
        $a = { EB 06 68 C3 9C 60 E8 5D 55 5B 81 ED 8B 85 01 85 66 C7 85 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AHTeam_EP_Protector_03_fake_Spalsher_1x_3x_FEUERRADER
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 9C 60 8B 44 24 24 E8 00 00 00 00 5D 81 ED 00 00 00 00 50 E8 ED 02 00 00 8C C0 0F 84 }

Detection condition:
$a at pe.entry_point

Full rule:
rule AHTeam_EP_Protector_03_fake_Spalsher_1x_3x_FEUERRADER: PEiD
{
    strings:
        $a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 9C 60 8B 44 24 24 E8 00 00 00 00 5D 81 ED 00 00 00 00 50 E8 ED 02 00 00 8C C0 0F 84 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Cracked_by_Autohack_2_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 0E 1F B4 09 BA ?? ?? CD 21 FA 8E 06 ?? ?? BE ?? ?? 8B 0E ?? ?? 83 F9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Cracked_by_Autohack_2_additional: PEiD
{
    strings:
        $a = { 0E 1F B4 09 BA ?? ?? CD 21 FA 8E 06 ?? ?? BE ?? ?? 8B 0E ?? ?? 83 F9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Com4mail_v10_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 42 45 47 49 4E 3D 3D 3D 74 66 75 64 23 6F 66 5F 43 6F 6D 34 4D 61 69 6C 5F 66 69 6C 65 23 0D 0A }

Detection condition:
$a at pe.entry_point

Full rule:
rule Com4mail_v10_additional: PEiD
{
    strings:
        $a = { 42 45 47 49 4E 3D 3D 3D 74 66 75 64 23 6F 66 5F 43 6F 6D 34 4D 61 69 6C 5F 66 69 6C 65 23 0D 0A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Morphine_V33_Holy_Father_Ratter29A_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Morphine_V33_Holy_Father_Ratter29A_additional: PEiD
{
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SVK_Protector_v111_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? 64 A0 23 }

Detection condition:
$a at pe.entry_point

Full rule:
rule SVK_Protector_v111_additional: PEiD
{
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED 06 ?? ?? ?? 64 A0 23 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_v110b3_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 49 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_v110b3_additional: PEiD
{
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 95 60 40 ?? 01 85 03 60 40 ?? 66 C7 85 ?? 60 40 ?? 90 90 BB 49 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AINEXE_v230_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 0E 07 B9 ?? ?? BE ?? ?? 33 FF FC F3 A4 A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule AINEXE_v230_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 0E 07 B9 ?? ?? BE ?? ?? 33 FF FC F3 A4 A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8 }
    condition:
        $a at pe.entry_point

}