deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Obsidium_V1258_V133X_Obsidium_Software_Sign_by_fly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 01 ?? E8 ?? 00 00 00 EB 02 ?? ?? EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsidium_V1258_V133X_Obsidium_Software_Sign_by_fly: PEiD
{
    strings:
        $a = { EB 01 ?? E8 ?? 00 00 00 EB 02 ?? ?? EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: NsPack_31_by_North_Star_Liu_Xing_Ping
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 }

Detection condition:
$a at pe.entry_point

Full rule:
rule NsPack_31_by_North_Star_Liu_Xing_Ping: PEiD
{
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RPolyCryptor_V142_Vaska_SignByfly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RPolyCryptor_V142_Vaska_SignByfly: PEiD
{
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PE_Protect_09_by_Cristoph_Gabler_1998_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PE_Protect_09_by_Cristoph_Gabler_1998_additional: PEiD
{
    strings:
        $a = { 50 45 2D 50 52 4F 54 45 43 54 20 30 2E 39 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Visual_Cpp_31
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 64 A1 00 00 00 00 55 8B EC 6A FF 68 00 00 40 00 68 00 00 40 00 50 64 89 25 00 00 00 00 83 EC 10 53 56 57 89 65 E8 FF 15 00 00 00 00 33 D2 8B C8 8A D4 81 E1 FF 00 00 00 C1 E8 10 89 15 00 00 40 00 89 0D 00 00 40 00 A3 00 00 40 00 C1 E1 08 03 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Visual_Cpp_31: PEiD
{
    strings:
        $a = { 64 A1 00 00 00 00 55 8B EC 6A FF 68 00 00 40 00 68 00 00 40 00 50 64 89 25 00 00 00 00 83 EC 10 53 56 57 89 65 E8 FF 15 00 00 00 00 33 D2 8B C8 8A D4 81 E1 FF 00 00 00 C1 E8 10 89 15 00 00 40 00 89 0D 00 00 40 00 A3 00 00 40 00 C1 E1 08 03 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_QBasic_v30_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? 8C C8 8E D8 E8 ?? ?? 8A 17 0A D2 74 ?? B4 ?? CD 21 43 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_QBasic_v30_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? 8C C8 8E D8 E8 ?? ?? 8A 17 0A D2 74 ?? B4 ?? CD 21 43 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EncryptPE_V22006710_V220070411_WFS
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 00 }
        $b = { 60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule EncryptPE_V22006710_V220070411_WFS: PEiD
{
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 00 }
        $b = { 60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: EncryptPE_12003518_WFS
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 9C 64 FF 35 00 00 00 00 E8 79 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EncryptPE_12003518_WFS: PEiD
{
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 00 E8 79 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Thinstall_Embedded_2422_2428_Jitit
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D 9B 1A 00 00 B9 84 1A 00 00 BA 14 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD E0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Thinstall_Embedded_2422_2428_Jitit: PEiD
{
    strings:
        $a = { 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D 9B 1A 00 00 B9 84 1A 00 00 BA 14 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD E0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SelfEnc_10
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BB 0F 01 B9 8F 18 33 C0 2E 80 2F 00 43 E2 F9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule SelfEnc_10: PEiD
{
    strings:
        $a = { BB 0F 01 B9 8F 18 33 C0 2E 80 2F 00 43 E2 F9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Encapsulated_Postscript_graphics_file_v20_EPSF_12
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 25 21 50 53 2D 41 64 6F 62 65 2D 32 2E 30 20 45 50 53 46 2D 31 2E 32 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Encapsulated_Postscript_graphics_file_v20_EPSF_12: PEiD
{
    strings:
        $a = { 25 21 50 53 2D 41 64 6F 62 65 2D 32 2E 30 20 45 50 53 46 2D 31 2E 32 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MASMTASM_sig1h_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { CC FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MASMTASM_sig1h_additional: PEiD
{
    strings:
        $a = { CC FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RLPack_FullEdition_V120_V121_LZMA_430_ap0x
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 10 00 00 08 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RLPack_FullEdition_V120_V121_LZMA_430_ap0x: PEiD
{
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 10 00 00 08 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_Windows_Help_file
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 3F 5F 03 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_Windows_Help_file: PEiD
{
    strings:
        $a = { 3F 5F 03 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AinEXE_21
Repository: Yara-Rules/rules

Pattern signatures:
$a = { A1 02 00 2D E1 0B 8E D0 BC 00 BE 8C D8 36 A3 00 BE 05 10 00 36 A3 02 BE 2E A1 0E 00 8A D4 B1 04 D2 EA FE C9 D3 E0 8C D3 36 8B 2E 02 BE 2E 03 2E 0E 00 FD 81 ED 00 10 80 EF 10 8E DD 8E C3 BE FE FF 8B FE FE CA 78 07 B9 00 80 F3 A5 EB E5 8B C8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule AinEXE_21: PEiD
{
    strings:
        $a = { A1 02 00 2D E1 0B 8E D0 BC 00 BE 8C D8 36 A3 00 BE 05 10 00 36 A3 02 BE 2E A1 0E 00 8A D4 B1 04 D2 EA FE C9 D3 E0 8C D3 36 8B 2E 02 BE 2E 03 2E 0E 00 FD 81 ED 00 10 80 EF 10 8E DD 8E C3 BE FE FF 8B FE FE CA 78 07 B9 00 80 F3 A5 EB E5 8B C8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: LHARC_SFX_Archive_v1131c_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB ?? ?? ?? ?? ?? 24 4C 48 61 72 ?? 27 73 ?? 53 46 58 }

Detection condition:
$a at pe.entry_point

Full rule:
rule LHARC_SFX_Archive_v1131c_Hint_DOS_EP: PEiD
{
    strings:
        $a = { EB ?? ?? ?? ?? ?? 24 4C 48 61 72 ?? 27 73 ?? 53 46 58 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Free_Pascal_v1010_win32_console_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { C6 05 ?? ?? ?? 00 01 E8 ?? ?? 00 00 C6 05 ?? ?? ?? 00 00 E8 ?? ?? 00 00 50 E8 00 00 00 00 FF 25 ?? ?? ?? 00 55 89 E5 ?? EC }

Detection condition:
$a at pe.entry_point

Full rule:
rule Free_Pascal_v1010_win32_console_additional: PEiD
{
    strings:
        $a = { C6 05 ?? ?? ?? 00 01 E8 ?? ?? 00 00 C6 05 ?? ?? ?? 00 00 E8 ?? ?? 00 00 50 E8 00 00 00 00 FF 25 ?? ?? ?? 00 55 89 E5 ?? EC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Trivial173_by_SMTSMF
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB ?? ?? 28 54 72 69 76 69 61 6C 31 37 33 20 62 79 20 53 4D 54 2F 53 4D 46 29 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Trivial173_by_SMTSMF: PEiD
{
    strings:
        $a = { EB ?? ?? 28 54 72 69 76 69 61 6C 31 37 33 20 62 79 20 53 4D 54 2F 53 4D 46 29 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXELOCK_666_105
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BA 7E 08 BF 27 01 EB 01 EA E8 FB FE 48 79 7A 7F 2C 7E 2A 1C FA 48 78 F5 E3 AE 45 14 04 5A E9 F8 9E 89 18 96 01 5A B1 E0 08 E6 F2 8E FB 4A B1 9C 1D 9C 08 84 11 B1 F1 1F 1C F6 E5 22 CB 23 44 A0 CC 1B D9 BD D2 78 B6 B7 74 A6 E6 AF C4 71 62 AE }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXELOCK_666_105: PEiD
{
    strings:
        $a = { BA 7E 08 BF 27 01 EB 01 EA E8 FB FE 48 79 7A 7F 2C 7E 2A 1C FA 48 78 F5 E3 AE 45 14 04 5A E9 F8 9E 89 18 96 01 5A B1 E0 08 E6 F2 8E FB 4A B1 9C 1D 9C 08 84 11 B1 F1 1F 1C F6 E5 22 CB 23 44 A0 CC 1B D9 BD D2 78 B6 B7 74 A6 E6 AF C4 71 62 AE }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXELOCK_666_104
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BA 20 08 BF E3 00 EB 01 EA E8 3F FF 7C 29 79 2F 1F F7 9C 75 F6 E6 A9 40 17 F9 A5 14 FB 9B 8E 1D EB 0D 55 BC E3 0D E1 F7 8D E6 55 AC FD 19 9B 0D E5 1D BE FC 1C 19 F1 E0 21 F6 1C 79 A3 C9 A7 DC BE DF 77 BB B4 71 A1 E3 AC D9 6E 7F AD AD 6A AE }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXELOCK_666_104: PEiD
{
    strings:
        $a = { BA 20 08 BF E3 00 EB 01 EA E8 3F FF 7C 29 79 2F 1F F7 9C 75 F6 E6 A9 40 17 F9 A5 14 FB 9B 8E 1D EB 0D 55 BC E3 0D E1 F7 8D E6 55 AC FD 19 9B 0D E5 1D BE FC 1C 19 F1 E0 21 F6 1C 79 A3 C9 A7 DC BE DF 77 BB B4 71 A1 E3 AC D9 6E 7F AD AD 6A AE }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Pe123_2006412
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B C0 60 9C E8 01 00 00 00 C3 53 E8 72 00 00 00 50 E8 1C 03 00 00 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B }

Detection condition:
$a at pe.entry_point

Full rule:
rule Pe123_2006412: PEiD
{
    strings:
        $a = { 8B C0 60 9C E8 01 00 00 00 C3 53 E8 72 00 00 00 50 E8 1C 03 00 00 8B D8 FF D3 5B C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B C0 55 8B EC 60 8B 4D 10 8B 7D 0C 8B 75 08 F3 A4 61 5D C2 0C 00 E8 00 00 00 00 58 83 E8 05 C3 8B C0 E8 00 00 00 00 58 83 C0 05 C3 8B }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXELOCK_666_103
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BA 6C 07 BF 20 01 EB 01 EA E8 02 FF 7C 29 79 2F 1F F7 51 75 F6 E6 A9 40 17 F9 A5 14 FB 9B 8E 1D 7C 0D 55 BC E3 0D E1 F7 8D E6 55 AC 66 19 9B 0D 6E 1D BE FC 1C 19 F1 E0 21 F6 1C 79 A3 C9 A7 DC BE DF 77 BB B4 71 A1 E3 AC D9 6E 7F AD AD 6A AE }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXELOCK_666_103: PEiD
{
    strings:
        $a = { BA 6C 07 BF 20 01 EB 01 EA E8 02 FF 7C 29 79 2F 1F F7 51 75 F6 E6 A9 40 17 F9 A5 14 FB 9B 8E 1D 7C 0D 55 BC E3 0D E1 F7 8D E6 55 AC 66 19 9B 0D 6E 1D BE FC 1C 19 F1 E0 21 F6 1C 79 A3 C9 A7 DC BE DF 77 BB B4 71 A1 E3 AC D9 6E 7F AD AD 6A AE }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PCShrink_v040b_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 60 BD ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 6A ?? FF ?? ?? ?? ?? ?? 50 50 2D }

Detection condition:
$a at pe.entry_point

Full rule:
rule PCShrink_v040b_additional: PEiD
{
    strings:
        $a = { 9C 60 BD ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? FF ?? ?? ?? ?? ?? 6A ?? FF ?? ?? ?? ?? ?? 50 50 2D }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXEStealth_275_WebtoolMaster_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 33 C9 B4 4E CD 21 73 02 FF ?? BA ?? 00 B8 ?? 3D CD 21 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXEStealth_275_WebtoolMaster_additional: PEiD
{
    strings:
        $a = { 33 C9 B4 4E CD 21 73 02 FF ?? BA ?? 00 B8 ?? 3D CD 21 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PESpin_13x_Cyberbob_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule PESpin_13x_Cyberbob_additional: PEiD
{
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Thinstall_3035_Jtit_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Thinstall_3035_Jtit_additional: PEiD
{
    strings:
        $a = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB 37 1F 00 00 2B C3 50 68 ?? ?? ?? ?? 68 00 28 00 00 68 04 01 00 00 E8 BA FE FF FF E9 90 FF FF FF CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RLPack_Full_Edition_117_iBox_aPLib_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 79 29 00 00 8D 9D 2C 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RLPack_Full_Edition_117_iBox_aPLib_additional: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 79 29 00 00 8D 9D 2C 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Packanoid_V10_Arkanoid
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BF ?? ?? ?? ?? BE ?? ?? ?? ?? E8 9D 00 00 00 B8 ?? ?? ?? ?? 8B 30 8B 78 04 BB ?? ?? ?? ?? 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Packanoid_V10_Arkanoid: PEiD
{
    strings:
        $a = { BF ?? ?? ?? ?? BE ?? ?? ?? ?? E8 9D 00 00 00 B8 ?? ?? ?? ?? 8B 30 8B 78 04 BB ?? ?? ?? ?? 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_v110b2_Jeremy_Collake
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 94 60 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_v110b2_Jeremy_Collake: PEiD
{
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 ?? 87 DD 8B 85 94 60 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Unknown_SFX_Archive_IDSKA32_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 69 64 73 6B 61 33 32 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Unknown_SFX_Archive_IDSKA32_Hint_FILE_START: PEiD
{
    strings:
        $a = { 69 64 73 6B 61 33 32 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FreeBASIC_016b
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 88 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 68 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 90 90 90 90 90 90 90 90 90 90 }
        $b = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 88 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 68 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule FreeBASIC_016b: PEiD
{
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 88 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 68 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D C3 90 90 90 90 90 90 90 90 90 90 }
        $b = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 88 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 68 FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: AZProtect_0001_by_AlexZ_aka_AZCRC_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FC 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 8B C2 C1 C0 10 66 8B C1 C3 F0 DA 55 8B EC 53 56 33 C9 33 DB 8B 4D 0C 8B 55 10 8B 75 08 4E 4A 83 }

Detection condition:
$a at pe.entry_point

Full rule:
rule AZProtect_0001_by_AlexZ_aka_AZCRC_additional: PEiD
{
    strings:
        $a = { FC 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 D8 73 09 66 35 20 83 66 81 F3 B8 ED FE CE 75 EB 33 C8 33 D3 4F 75 D5 F7 D2 F7 D1 8B C2 C1 C0 10 66 8B C1 C3 F0 DA 55 8B EC 53 56 33 C9 33 DB 8B 4D 0C 8B 55 10 8B 75 08 4E 4A 83 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Launcher_Generator_103
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 00 20 40 00 68 10 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 68 F0 22 40 00 6A 00 E8 93 00 00 00 85 C0 0F 84 7E 00 00 00 B8 00 00 00 00 3B 05 68 20 40 00 74 13 6A ?? 68 60 23 40 00 68 20 23 40 00 6A 00 E8 83 00 00 00 A1 58 20 40 00 3B 05 6C 20 40 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Launcher_Generator_103: PEiD
{
    strings:
        $a = { 68 00 20 40 00 68 10 20 40 00 6A 00 6A 00 6A 20 6A 00 6A 00 6A 00 68 F0 22 40 00 6A 00 E8 93 00 00 00 85 C0 0F 84 7E 00 00 00 B8 00 00 00 00 3B 05 68 20 40 00 74 13 6A ?? 68 60 23 40 00 68 20 23 40 00 6A 00 E8 83 00 00 00 A1 58 20 40 00 3B 05 6C 20 40 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_01_NorthStar_PE_Shrinker_13_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_01_NorthStar_PE_Shrinker_13_Anorganix: PEiD
{
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 00 00 00 00 E9 }
    condition:
        $a at pe.entry_point

}