deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: ASProtect_11_MTE_Solodovnikov_Alexey
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E9 ?? ?? ?? ?? 91 78 79 79 79 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASProtect_11_MTE_Solodovnikov_Alexey: PEiD
{
    strings:
        $a = { 60 E9 ?? ?? ?? ?? 91 78 79 79 79 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_02_VBOX_43_MTE_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_02_VBOX_43_MTE_Anorganix: PEiD
{
    strings:
        $a = { 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 0B C0 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PackerMASMTASM_Lenguaje_Compilador_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 6A 00 E8 ?? ?? 00 00 A3 ?? ?? 40 00 ?? ?? ?? ?0 ?0 ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?0 ?? ?? ?0 ?0 ?? ?? ?? ?0 ?? ?? ?? ?0 ?0 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PackerMASMTASM_Lenguaje_Compilador_additional: PEiD
{
    strings:
        $a = { 6A 00 E8 ?? ?? 00 00 A3 ?? ?? 40 00 ?? ?? ?? ?0 ?0 ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?0 ?? ?? ?0 ?0 ?? ?? ?? ?0 ?? ?? ?? ?0 ?0 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SLVc0deProtector_11x_SLV_ICU_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 01 00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A 40 00 8B C0 8B D2 2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2 FF FF FF F3 B9 05 00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6 }

Detection condition:
$a at pe.entry_point

Full rule:
rule SLVc0deProtector_11x_SLV_ICU_additional: PEiD
{
    strings:
        $a = { E8 01 00 00 00 A0 5D EB 01 69 81 ED 5F 1A 40 00 8D 85 92 1A 40 00 F3 8D 95 83 1A 40 00 8B C0 8B D2 2B C2 83 E8 05 89 42 01 E8 FB FF FF FF 69 83 C4 08 E8 06 00 00 00 69 E8 F2 FF FF FF F3 B9 05 00 00 00 51 8D B5 BF 1A 40 00 8B FE B9 58 15 00 00 AC 32 C1 F6 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Solidshield_Protector_V1X_Solidshield_Technologies
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 00 60 89 00 0A 00 00 00 46 33 00 00 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Solidshield_Protector_V1X_Solidshield_Technologies: PEiD
{
    strings:
        $a = { 68 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 00 60 89 00 0A 00 00 00 46 33 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: yodas_Protector_v101_Ashkbiz_Danehkar
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 }
        $b = { 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED A5 E5 41 00 8B D5 81 C2 F3 E5 41 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? B9 F0 FE 41 00 81 E9 93 E6 41 00 8B D5 81 C2 93 E6 41 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 33 C0 64 FF 30 64 89 20 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule yodas_Protector_v101_Ashkbiz_Danehkar: PEiD
{
    strings:
        $a = { 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 }
        $b = { 55 8B EC 53 56 57 E8 03 00 00 00 EB 01 ?? E8 86 00 00 00 E8 03 00 00 00 EB 01 ?? E8 79 00 00 00 E8 03 00 00 00 EB 01 ?? E8 A4 00 00 00 E8 03 00 00 00 EB 01 ?? E8 97 00 00 00 E8 03 00 00 00 EB 01 ?? E8 2D 00 00 00 E8 03 00 00 00 EB 01 ?? 60 E8 00 00 00 00 5D 81 ED A5 E5 41 00 8B D5 81 C2 F3 E5 41 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? B9 F0 FE 41 00 81 E9 93 E6 41 00 8B D5 81 C2 93 E6 41 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 33 C0 64 FF 30 64 89 20 CC C3 90 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? AA E2 9C }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: PseudoSigner_02_Lockless_Intro_Pack
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_02_Lockless_Intro_Pack: PEiD
{
    strings:
        $a = { 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Sierras_audio_file_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8D 0C 53 4F 4C 00 22 56 0D }

Detection condition:
$a at pe.entry_point

Full rule:
rule Sierras_audio_file_Hint_FILE_START: PEiD
{
    strings:
        $a = { 8D 0C 53 4F 4C 00 22 56 0D }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PolyEnE_V001p_Lennart_Hedlund_
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 6F 6C 79 45 6E 45 00 4D 65 73 73 61 67 65 42 6F 78 41 00 55 53 45 52 33 32 2E 64 6C 6C }

Detection condition:
$a at pe.entry_point

Full rule:
rule PolyEnE_V001p_Lennart_Hedlund_: PEiD
{
    strings:
        $a = { 50 6F 6C 79 45 6E 45 00 4D 65 73 73 61 67 65 42 6F 78 41 00 55 53 45 52 33 32 2E 64 6C 6C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RLP_V073beta_ap0x_Sign_by_fly_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RLP_V073beta_ap0x_Sign_by_fly_additional: PEiD
{
    strings:
        $a = { 60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MESS_v120_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FA B9 ?? ?? F3 ?? ?? E3 ?? EB ?? EB ?? B6 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MESS_v120_Hint_DOS_EP: PEiD
{
    strings:
        $a = { FA B9 ?? ?? F3 ?? ?? E3 ?? EB ?? EB ?? B6 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASPack_108_Solodovnikov_Alexey
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 75 01 FF E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASPack_108_Solodovnikov_Alexey: PEiD
{
    strings:
        $a = { 90 75 01 FF E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Borland_Cpp_1994_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8C CA 2E 89 ?? ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA A3 ?? ?? 8C }

Detection condition:
$a at pe.entry_point

Full rule:
rule Borland_Cpp_1994_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 8C CA 2E 89 ?? ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA A3 ?? ?? 8C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: WATCOM_CCpp_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41 }

Detection condition:
$a at pe.entry_point

Full rule:
rule WATCOM_CCpp_additional: PEiD
{
    strings:
        $a = { E9 ?? ?? ?? ?? ?? ?? ?? ?? 57 41 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: The_Best_Cryptor_FsK
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 56 52 55 4C 5A 00 90 90 90 90 90 90 90 90 }

Detection condition:
$a at pe.entry_point

Full rule:
rule The_Best_Cryptor_FsK: PEiD
{
    strings:
        $a = { EB 06 56 52 55 4C 5A 00 90 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FreeJoiner_152_Stub_engine_16_GlOFF
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 46 FD FF FF 50 E8 0C 00 00 00 FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FreeJoiner_152_Stub_engine_16_GlOFF: PEiD
{
    strings:
        $a = { E8 46 FD FF FF 50 E8 0C 00 00 00 FF 25 08 20 40 00 FF 25 0C 20 40 00 FF 25 10 20 40 00 FF 25 14 20 40 00 FF 25 18 20 40 00 FF 25 1C 20 40 00 FF 25 20 20 40 00 FF 25 24 20 40 00 FF 25 28 20 40 00 FF 25 00 20 40 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: NsPacK_V31_LiuXingPing
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? ?? ?? 8A 03 3C 00 74 }

Detection condition:
$a at pe.entry_point

Full rule:
rule NsPacK_V31_LiuXingPing: PEiD
{
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? ?? ?? 8A 03 3C 00 74 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: yodas_Protector_102_Ashkibiz_Danehlar
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 }
        $b = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3A 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 C3 1F 00 00 33 C0 64 FF 3

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule yodas_Protector_102_Ashkibiz_Danehlar: PEiD
{
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 }
        $b = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 23 3F 42 00 8B D5 81 C2 72 3F 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3A 66 42 00 81 E9 1D 40 42 00 8B D5 81 C2 1D 40 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 C3 1F 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Armadillo_500_Dll_Silicon_Realms_Toolworks_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE FF FF 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 E5 24 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 8F 15 00 00 C7 00 0C 00 00 00 57 57 57 57 57 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_500_Dll_Silicon_Realms_Toolworks_additional: PEiD
{
    strings:
        $a = { 83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE FF FF 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 E5 24 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 8F 15 00 00 C7 00 0C 00 00 00 57 57 57 57 57 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPX_v0896_v102_v105_v124_Markus_Laszlo_overlay
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 EB 0B 90 8A 06 46 88 07 47 01 DB 75 ?? 8B 1E 83 ?? ?? 11 DB 72 ?? B8 01 00 00 00 01 DB 75 }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPX_v0896_v102_v105_v124_Markus_Laszlo_overlay: PEiD
{
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 EB 0B 90 8A 06 46 88 07 47 01 DB 75 ?? 8B 1E 83 ?? ?? 11 DB 72 ?? B8 01 00 00 00 01 DB 75 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: hyings_PE_Armor_049_Hying
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 56 52 51 53 55 E8 15 01 00 00 32 ?? ?? 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule hyings_PE_Armor_049_Hying: PEiD
{
    strings:
        $a = { 56 52 51 53 55 E8 15 01 00 00 32 ?? ?? 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: nPack_V111502006Beta_NEOx
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule nPack_V111502006Beta_NEOx: PEiD
{
    strings:
        $a = { 83 3D ?? ?? ?? ?? ?? 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B 35 ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Borland_Pascal_v70
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? 8E D8 8C ?? ?? ?? 8C D3 8C C0 2B D8 8B C4 05 ?? ?? C1 ?? ?? 03 D8 B4 ?? CD 21 0E }

Detection condition:
$a at pe.entry_point

Full rule:
rule Borland_Pascal_v70: PEiD
{
    strings:
        $a = { B8 ?? ?? 8E D8 8C ?? ?? ?? 8C D3 8C C0 2B D8 8B C4 05 ?? ?? C1 ?? ?? 03 D8 B4 ?? CD 21 0E }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: dePACK_V10_deNULL
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? 00 00 E8 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? D2 }

Detection condition:
$a at pe.entry_point

Full rule:
rule dePACK_V10_deNULL: PEiD
{
    strings:
        $a = { EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? 00 00 E8 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? D2 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SuckStop_v111
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB ?? ?? ?? BE ?? ?? B4 30 CD 21 EB ?? 9B }

Detection condition:
$a at pe.entry_point

Full rule:
rule SuckStop_v111: PEiD
{
    strings:
        $a = { EB ?? ?? ?? BE ?? ?? B4 30 CD 21 EB ?? 9B }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: XPack_152_164_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B EC FA 33 C0 8E D0 BC ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule XPack_152_164_additional: PEiD
{
    strings:
        $a = { 8B EC FA 33 C0 8E D0 BC ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_Armadillo_300_Anorganix_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_Armadillo_300_Anorganix_additional: PEiD
{
    strings:
        $a = { 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: WWPACK_v305c4_Extractable_Hint_DOS_EP_4_
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 03 05 00 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule WWPACK_v305c4_Extractable_Hint_DOS_EP_4_: PEiD
{
    strings:
        $a = { 03 05 00 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPX_SCRAMBLER_306
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 00 00 00 00 59 83 C1 07 51 C3 C3 BE ?? ?? ?? ?? 83 EC 04 89 34 24 B9 80 00 00 00 81 36 ?? ?? ?? ?? 50 B8 04 00 00 00 50 03 34 24 58 58 83 E9 03 E2 E9 EB D6 }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPX_SCRAMBLER_306: PEiD
{
    strings:
        $a = { E8 00 00 00 00 59 83 C1 07 51 C3 C3 BE ?? ?? ?? ?? 83 EC 04 89 34 24 B9 80 00 00 00 81 36 ?? ?? ?? ?? 50 B8 04 00 00 00 50 03 34 24 58 58 83 E9 03 E2 E9 EB D6 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ZCode_Win32PE_Protector_101_Giuliano_Bertoletti
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 12 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 FB FF FF FF C3 68 ?? ?? ?? ?? 64 FF 35 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ZCode_Win32PE_Protector_101_Giuliano_Bertoletti: PEiD
{
    strings:
        $a = { E9 12 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E9 FB FF FF FF C3 68 ?? ?? ?? ?? 64 FF 35 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: May_be_Pklite_Header_Version_v6v2_extra_0_v5_2_Hint_HDR_END
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 6B }

Detection condition:
$a at pe.entry_point

Full rule:
rule May_be_Pklite_Header_Version_v6v2_extra_0_v5_2_Hint_HDR_END: PEiD
{
    strings:
        $a = { 50 6B }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPXLock_v10_CyberDoom
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 60 E8 2B 03 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPXLock_v10_CyberDoom: PEiD
{
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 60 E8 2B 03 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_120_Eng_dulekxt_Borland_Cpp_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_120_Eng_dulekxt_Borland_Cpp_additional: PEiD
{
    strings:
        $a = { 03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_v1242_v1243_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 09 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_v1242_v1243_additional: PEiD
{
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 ?? 87 DD 8B 85 A6 70 40 ?? 01 85 03 70 40 ?? 66 C7 85 70 40 90 ?? 90 01 85 9E 70 40 BB ?? D2 09 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_Microsoft_Visual_Basic_60_DLL
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 5A 68 90 90 90 90 68 90 90 90 90 52 E9 90 90 FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_Microsoft_Visual_Basic_60_DLL: PEiD
{
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 5A 68 90 90 90 90 68 90 90 90 90 52 E9 90 90 FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: JAR_Archive_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 1A 4A 61 72 1B }

Detection condition:
$a at pe.entry_point

Full rule:
rule JAR_Archive_additional: PEiD
{
    strings:
        $a = { 1A 4A 61 72 1B }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXECryptor_v1401
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXECryptor_v1401: PEiD
{
    strings:
        $a = { E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: GOES_graphics_file
Repository: Yara-Rules/rules

Pattern signatures:
$a = { C8 C4 D9 40 C1 D9 C5 C1 }

Detection condition:
$a at pe.entry_point

Full rule:
rule GOES_graphics_file: PEiD
{
    strings:
        $a = { C8 C4 D9 40 C1 D9 C5 C1 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: DiskDupe_c_MSD_Users_file_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 4D 53 44 20 55 73 65 72 73 20 56 65 72 73 69 6F 6E }

Detection condition:
$a at pe.entry_point

Full rule:
rule DiskDupe_c_MSD_Users_file_Hint_FILE_START: PEiD
{
    strings:
        $a = { 4D 53 44 20 55 73 65 72 73 20 56 65 72 73 69 6F 6E }
    condition:
        $a at pe.entry_point

}