deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: ASProtect_v12_Alexey_Solodovnikov
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 60 E8 1B 00 00 00 E9 FC 8D B5 0F 06 00 00 8B FE B9 97 00 00 00 AD 35 78 56 34 12 AB 49 75 F6 EB 04 5D 45 55 C3 E9 ?? ?? ?? 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASProtect_v12_Alexey_Solodovnikov: PEiD
{
    strings:
        $a = { 90 60 E8 1B 00 00 00 E9 FC 8D B5 0F 06 00 00 8B FE B9 97 00 00 00 AD 35 78 56 34 12 AB 49 75 F6 EB 04 5D 45 55 C3 E9 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FishPE_V10X_hellfish
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 ?? ?? ?? ?? C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 ?? ?? 00 00 ?? ?? ?? ?? 00 00 02 00 00 00 A0 00 00 18 01 00 00 ?? ?? ?? ?? 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 C0 00 00 40 39 00 00 ?? ?? ?? ?? 00 00 08 00 00 00 00 01 00 C8 06 00 00 }
        $b = { 60 E8 ?? ?? ?? ?? C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 ?? ?? 00 00 ?? ?? ?? ?? 00 00 02 00 00 00 A0 00 00 18 01 00 00 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule FishPE_V10X_hellfish: PEiD
{
    strings:
        $a = { 60 E8 ?? ?? ?? ?? C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 ?? ?? 00 00 ?? ?? ?? ?? 00 00 02 00 00 00 A0 00 00 18 01 00 00 ?? ?? ?? ?? 00 00 0C 00 00 00 B0 00 00 38 0A 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 C0 00 00 40 39 00 00 ?? ?? ?? ?? 00 00 08 00 00 00 00 01 00 C8 06 00 00 }
        $b = { 60 E8 ?? ?? ?? ?? C3 90 09 00 00 00 2C 00 00 00 ?? ?? ?? ?? C4 03 00 00 BC A0 00 00 00 40 01 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 99 00 00 00 00 8A 00 00 00 10 00 00 ?? ?? 00 00 ?? ?? ?? ?? 00 00 02 00 00 00 A0 00 00 18 01 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: MEW_11_SE_v12_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MEW_11_SE_v12_additional: PEiD
{
    strings:
        $a = { E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_301_305_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_301_305_additional: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_v160a
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 98 71 40 00 68 48 2D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_v160a: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 98 71 40 00 68 48 2D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Special_EXE_Password_Protector_v10_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Special_EXE_Password_Protector_v10_additional: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: VProtect2070724Cloud_CoooLie
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8D BF EC FF FF FF 66 F7 D5 8A D2 66 F7 D5 8D BF 14 00 00 00 60 61 60 61 9C 66 8B DB 9D 66 F7 D2 8D 89 E5 FF FF FF 8D B6 E2 FF FF FF 56 5E 8D B6 1E 00 00 00 8D 89 1B 00 00 00 66 F7 D2 66 52 66 5A 55 8D AD F9 FF FF FF 66 F7 D2 8D BF FC FF FF FF 8D BF 04 00 00 00 66 F7 D2 8D AD 07 00 00 00 5D 8B 67 28 66 55 66 5D 61 60 61 8D 9B F0 FF FF FF 8D 80 F6 FF FF FF 66 52 F7 D1 F7 D1 66 5A 8D 80 0A 00 00 00 8D 9B 10 00 00 00 66 87 D1 52 86 FB 86 FB 5A 66 87 D1 66 55 8D 92 E8 FF FF FF 8B DB 8D 92 18 00 00 00 66 5D 9D 56 5E F6 D0 F6 D0 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule VProtect2070724Cloud_CoooLie: PEiD
{
    strings:
        $a = { 8D BF EC FF FF FF 66 F7 D5 8A D2 66 F7 D5 8D BF 14 00 00 00 60 61 60 61 9C 66 8B DB 9D 66 F7 D2 8D 89 E5 FF FF FF 8D B6 E2 FF FF FF 56 5E 8D B6 1E 00 00 00 8D 89 1B 00 00 00 66 F7 D2 66 52 66 5A 55 8D AD F9 FF FF FF 66 F7 D2 8D BF FC FF FF FF 8D BF 04 00 00 00 66 F7 D2 8D AD 07 00 00 00 5D 8B 67 28 66 55 66 5D 61 60 61 8D 9B F0 FF FF FF 8D 80 F6 FF FF FF 66 52 F7 D1 F7 D1 66 5A 8D 80 0A 00 00 00 8D 9B 10 00 00 00 66 87 D1 52 86 FB 86 FB 5A 66 87 D1 66 55 8D 92 E8 FF FF FF 8B DB 8D 92 18 00 00 00 66 5D 9D 56 5E F6 D0 F6 D0 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UNITA3_tm_by_Sanitary_Equipment_Research_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? 4D 5A 3E }

Detection condition:
$a at pe.entry_point

Full rule:
rule UNITA3_tm_by_Sanitary_Equipment_Research_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E8 ?? ?? 4D 5A 3E }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: NET_executable_
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule NET_executable_: PEiD
{
    strings:
        $a = { FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Virogens_PE_Shrinker_v014_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 55 E8 ?? ?? ?? ?? 87 D5 5D 60 87 D5 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 57 56 AD 0B C0 74 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Virogens_PE_Shrinker_v014_additional: PEiD
{
    strings:
        $a = { 9C 55 E8 ?? ?? ?? ?? 87 D5 5D 60 87 D5 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 57 56 AD 0B C0 74 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MSLRH_v032a_fake_PE_Lock_NT_204_emadicius
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 EB EB 03 CD 20 03 61 9D 83 C4 04 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule MSLRH_v032a_fake_PE_Lock_NT_204_emadicius: PEiD
{
    strings:
        $a = { EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 EB EB 03 CD 20 03 61 9D 83 C4 04 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ComprEXE_10_EXE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FC 1E 06 8C DD 83 C5 10 89 E8 BA 00 00 8B 1E 02 00 29 D3 53 8E D8 8E C3 31 F6 31 FF B9 08 00 F3 A5 40 43 4A 75 EE B8 2B 00 50 CB 0E 1F BE 00 00 B3 01 8E C5 31 FF 81 FF 00 80 72 0B 8C C0 05 00 08 8E C0 81 EF 00 80 E8 8A 00 74 08 B7 08 E8 9D }

Detection condition:
$a at pe.entry_point

Full rule:
rule ComprEXE_10_EXE: PEiD
{
    strings:
        $a = { FC 1E 06 8C DD 83 C5 10 89 E8 BA 00 00 8B 1E 02 00 29 D3 53 8E D8 8E C3 31 F6 31 FF B9 08 00 F3 A5 40 43 4A 75 EE B8 2B 00 50 CB 0E 1F BE 00 00 B3 01 8E C5 31 FF 81 FF 00 80 72 0B 8C C0 05 00 08 8E C0 81 EF 00 80 E8 8A 00 74 08 B7 08 E8 9D }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_Visual_Basic_v60_DLL_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 83 EC 08 83 C4 F4 6A 02 A1 C8 ?? ?? ?? FF D0 E8 ?? ?? ?? ?? C9 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_Visual_Basic_v60_DLL_additional: PEiD
{
    strings:
        $a = { 55 89 E5 83 EC 08 83 C4 F4 6A 02 A1 C8 ?? ?? ?? FF D0 E8 ?? ?? ?? ?? C9 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Diet_144_145_COM
Repository: Yara-Rules/rules

Pattern signatures:
$a = { F9 9C EB 0A 00 00 0C 00 00 00 9D 89 F8 9C 55 06 1E 57 56 52 51 53 50 E8 00 00 59 B1 04 D3 E9 8C C8 03 C1 8E D8 8E C0 BE 00 00 BF 00 00 B9 00 00 FD F3 A5 FC 8B F7 33 FF AD AD 8B E8 B2 10 E9 00 00 64 6C 7A }

Detection condition:
$a at pe.entry_point

Full rule:
rule Diet_144_145_COM: PEiD
{
    strings:
        $a = { F9 9C EB 0A 00 00 0C 00 00 00 9D 89 F8 9C 55 06 1E 57 56 52 51 53 50 E8 00 00 59 B1 04 D3 E9 8C C8 03 C1 8E D8 8E C0 BE 00 00 BF 00 00 B9 00 00 FD F3 A5 FC 8B F7 33 FF AD AD 8B E8 B2 10 E9 00 00 64 6C 7A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Excalibur_V103_forgot
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Excalibur_V103_forgot: PEiD
{
    strings:
        $a = { E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 EB 39 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Protect_40_COM
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 00 00 5D 81 ED 13 01 33 C0 8E D8 8B F0 BF 70 00 B9 08 00 FC F3 A5 FD 87 FE 8C C0 8E D8 33 C0 8E C0 4F 4F 8B C2 AB B8 AE 02 03 C5 AB 8B C2 AB B8 BB 01 03 C5 AB 8B C2 AB E4 21 A2 6B 00 B8 EF 01 03 C5 AB 8B C2 AB B8 F8 01 03 C5 AB 1E 07 B0 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Protect_40_COM: PEiD
{
    strings:
        $a = { E8 00 00 5D 81 ED 13 01 33 C0 8E D8 8B F0 BF 70 00 B9 08 00 FC F3 A5 FD 87 FE 8C C0 8E D8 33 C0 8E C0 4F 4F 8B C2 AB B8 AE 02 03 C5 AB 8B C2 AB B8 BB 01 03 C5 AB 8B C2 AB E4 21 A2 6B 00 B8 EF 01 03 C5 AB 8B C2 AB B8 F8 01 03 C5 AB 1E 07 B0 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_V029_V031_Dwing_20080321
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE ?? ?? ?? ?? AD 8B F8 95 AD 91 F3 A5 AD ?? ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF ?? ?? ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 24 B1 30 8B 5D 0C 03 D1 FF 16 73 4B 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 20 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 14 FF 56 0C 5B 91 FF 66 3C 07 B0 07 72 02 B0 0A 50 87 5D 10 87 5D 14 89 5D 18 8B D5 03 56 18 FF 56 0C 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D 9C 85 7C 03 00 00 FF 56 04 3C 04 8B D8 72 5F 33 DB D1 E8 13 DB 48 43 91 43 D3 E3 80 F9 05 8D 94 9D 7C 01 00 00 76 2E 80 E9 04 33 C0 8B 55 00 D1 6D 08 8B 12 0F CA 2B 55 04 03 C0 3B 55 08 72 07 8B 55 08 40 01 55 04 FF 56 10 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_V029_V031_Dwing_20080321: PEiD
{
    strings:
        $a = { BE ?? ?? ?? ?? AD 8B F8 95 AD 91 F3 A5 AD ?? ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF ?? ?? ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 24 B1 30 8B 5D 0C 03 D1 FF 16 73 4B 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 20 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 14 FF 56 0C 5B 91 FF 66 3C 07 B0 07 72 02 B0 0A 50 87 5D 10 87 5D 14 89 5D 18 8B D5 03 56 18 FF 56 0C 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D 9C 85 7C 03 00 00 FF 56 04 3C 04 8B D8 72 5F 33 DB D1 E8 13 DB 48 43 91 43 D3 E3 80 F9 05 8D 94 9D 7C 01 00 00 76 2E 80 E9 04 33 C0 8B 55 00 D1 6D 08 8B 12 0F CA 2B 55 04 03 C0 3B 55 08 72 07 8B 55 08 40 01 55 04 FF 56 10 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: DataBeam_Graphics_format_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 30 31 2E 30 31 00 00 04 }

Detection condition:
$a at pe.entry_point

Full rule:
rule DataBeam_Graphics_format_Hint_FILE_START: PEiD
{
    strings:
        $a = { 30 31 2E 30 31 00 00 04 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASProtect_11_Solodovnikov_Alexey
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E9 ?? 04 00 00 E9 ?? ?? ?? ?? ?? ?? ?? EE }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASProtect_11_Solodovnikov_Alexey: PEiD
{
    strings:
        $a = { 60 E9 ?? 04 00 00 E9 ?? ?? ?? ?? ?? ?? ?? EE }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AHTeam_EP_Protector_03_fake_Borland_Delphi_60_70_FEUERRADER
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 53 8B D8 33 C0 A3 00 00 00 00 6A 00 E8 00 00 00 FF A3 00 00 00 00 A1 00 00 00 00 A3 00 00 00 00 33 C0 A3 00 00 00 00 33 C0 A3 00 00 00 00 E8 }
        $b = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 53 8B D8 33 C0 A3 00 00 00 00 6A 00 E8 00 00 00 FF A3 00 00 00 00 A1 00 00 00 00 A3 00 00 00 00 33 C0 A3 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule AHTeam_EP_Protector_03_fake_Borland_Delphi_60_70_FEUERRADER: PEiD
{
    strings:
        $a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 53 8B D8 33 C0 A3 00 00 00 00 6A 00 E8 00 00 00 FF A3 00 00 00 00 A1 00 00 00 00 A3 00 00 00 00 33 C0 A3 00 00 00 00 33 C0 A3 00 00 00 00 E8 }
        $b = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 53 8B D8 33 C0 A3 00 00 00 00 6A 00 E8 00 00 00 FF A3 00 00 00 00 A1 00 00 00 00 A3 00 00 00 00 33 C0 A3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: AntiDote_V10_SIS_Team
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 DC 01 4D 65 73 73 61 67 65 42 6F 78 41 00 26 00 43 68 61 72 4C 6F 77 65 72 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 C5 02 73 74 72 73 74 72 00 00 91 02 6D 61 6C 6C 6F 63 00 00 5E 02 66 72 65 65 00 00 4C 02 66 63 6C 6F 73 65 00 00 DA 00 5F 66 69 6C 62 75 66 00 64 02 66 74 65 6C 6C 00 62 02 66 73 65 

Detection condition:
$a at pe.entry_point

Full rule:
rule AntiDote_V10_SIS_Team: PEiD
{
    strings:
        $a = { 00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 DC 01 4D 65 73 73 61 67 65 42 6F 78 41 00 26 00 43 68 61 72 4C 6F 77 65 72 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 00 C5 02 73 74 72 73 74 72 00 00 91 02 6D 61 6C 6C 6F 63 00 00 5E 02 66 72 65 65 00 00 4C 02 66 63 6C 6F 73 65 00 00 DA 00 5F 66 69 6C 62 75 66 00 64 02 66 74 65 6C 6C 00 62 02 66 73 65 65 6B 00 57 02 66 6F 70 65 6E 00 49 00 5F 5F 43 78 78 46 72 61 6D 65 48 61 6E 64 6C 65 72 00 4D 53 56 43 52 54 2E 64 6C 6C 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_2x_Bitsum_Technologies
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? ?? 02 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_2x_Bitsum_Technologies: PEiD
{
    strings:
        $a = { B8 ?? ?? ?? 02 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Crypt_17_EXE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 0E 17 9C 58 F6 C4 01 74 03 E9 98 00 1E B0 02 E6 21 8C DA 83 C2 10 8E DA 8E C2 BB 00 00 BA 00 00 85 D2 74 29 B4 01 33 FF 33 F6 B9 00 F0 AC 32 C4 C0 C4 03 02 E1 2E 00 06 22 01 AA E2 F0 8C D8 05 00 0F 8E D8 8E C0 4A 85 D2 74 02 EB D7 60 B4 30 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Crypt_17_EXE: PEiD
{
    strings:
        $a = { 0E 17 9C 58 F6 C4 01 74 03 E9 98 00 1E B0 02 E6 21 8C DA 83 C2 10 8E DA 8E C2 BB 00 00 BA 00 00 85 D2 74 29 B4 01 33 FF 33 F6 B9 00 F0 AC 32 C4 C0 C4 03 02 E1 2E 00 06 22 01 AA E2 F0 8C D8 05 00 0F 8E D8 8E C0 4A 85 D2 74 02 EB D7 60 B4 30 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Immun_12_registered_EXE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 53 51 52 56 57 1E 06 2E 8B 0E D3 07 E3 1E 1E 06 D1 E1 8C C8 8E D8 8E C0 BE D5 07 BF 6D 08 8B D1 4A D1 E2 03 F2 03 FA FD F3 A5 07 1F B4 30 CD 21 2E A2 63 01 3C 03 72 54 1E 33 C0 8E D8 80 3E FD 04 49 C6 06 FD 04 00 1F 74 42 8E 1E 2C 00 8C }

Detection condition:
$a at pe.entry_point

Full rule:
rule Immun_12_registered_EXE: PEiD
{
    strings:
        $a = { 50 53 51 52 56 57 1E 06 2E 8B 0E D3 07 E3 1E 1E 06 D1 E1 8C C8 8E D8 8E C0 BE D5 07 BF 6D 08 8B D1 4A D1 E2 03 F2 03 FA FD F3 A5 07 1F B4 30 CD 21 2E A2 63 01 3C 03 72 54 1E 33 C0 8E D8 80 3E FD 04 49 C6 06 FD 04 00 1F 74 42 8E 1E 2C 00 8C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: XJ_XPAL_LiNSoN_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 ?? ?? 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 44 53 56 57 66 9C }

Detection condition:
$a at pe.entry_point

Full rule:
rule XJ_XPAL_LiNSoN_additional: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 44 53 56 57 66 9C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FucknJoy_v10c_UsAr
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00 }
        $b = { 60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00 00 0B C0 0F 84 EC 00 00 00 89 85 4D 08 40 00 8D 85 51 08 40 00 50 FF B5 6C 08 40 00 E8 AF 02 00 00 0B C0 0F 84 CC 00 00 00 89 85 5C 08 40 00 8D 85 67 07 40 00 E8 7B 02 00 00 8D B5 C4 07 40 00 56 6A 64 FF 95 74 07 40 00 46 80 3E 00 75 FA C7 06 74 6D 70 2E 83 C6 04 C7 06 65 78 65 00 8D 85 36 07 40 00 E8 4C 02 00 00 33 DB 53 53 6A 02 53 53 68 00 00 00 40 8D 85 C4 07 40 00 50 FF 95 74 07 40 00 89 85 78 07 40 00 8D 85 51 07 40 00 E8 21 02 00 00 6A 00 8D 85 7C 07 40 0

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule FucknJoy_v10c_UsAr: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00 }
        $b = { 60 E8 00 00 00 00 5D 81 ED D8 05 40 00 FF 74 24 20 E8 8C 02 00 00 0B C0 0F 84 2C 01 00 00 89 85 6C 08 40 00 8D 85 2F 08 40 00 50 FF B5 6C 08 40 00 E8 EF 02 00 00 0B C0 0F 84 0C 01 00 00 89 85 3B 08 40 00 8D 85 3F 08 40 00 50 FF B5 6C 08 40 00 E8 CF 02 00 00 0B C0 0F 84 EC 00 00 00 89 85 4D 08 40 00 8D 85 51 08 40 00 50 FF B5 6C 08 40 00 E8 AF 02 00 00 0B C0 0F 84 CC 00 00 00 89 85 5C 08 40 00 8D 85 67 07 40 00 E8 7B 02 00 00 8D B5 C4 07 40 00 56 6A 64 FF 95 74 07 40 00 46 80 3E 00 75 FA C7 06 74 6D 70 2E 83 C6 04 C7 06 65 78 65 00 8D 85 36 07 40 00 E8 4C 02 00 00 33 DB 53 53 6A 02 53 53 68 00 00 00 40 8D 85 C4 07 40 00 50 FF 95 74 07 40 00 89 85 78 07 40 00 8D 85 51 07 40 00 E8 21 02 00 00 6A 00 8D 85 7C 07 40 00 50 68 00 ?? ?? 00 8D 85 F2 09 40 00 50 FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}