deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: BeRoEXEPacker_v100_BeRo_Farbrausch_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC ?? ?? ?? ?? A4 ?? ?? ?? ?? 00 ?? ?? ?? ?? 33 C9 E8 64 00 00 00 73 1C ?? ?? ?? ?? 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 ?? ?? ?? ?? D4 E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule BeRoEXEPacker_v100_BeRo_Farbrausch_additional: PEiD
{
    strings:
        $a = { 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC ?? ?? ?? ?? A4 ?? ?? ?? ?? 00 ?? ?? ?? ?? 33 C9 E8 64 00 00 00 73 1C ?? ?? ?? ?? 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 ?? ?? ?? ?? D4 E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_v110_Eng_dulekxt_MASM32_TASM32_Microsoft_Visual_Basic_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { F7 D0 EB 02 CD 20 BE BB 74 1C FB EB 02 CD 20 BF 3B ?? ?? FB C1 C1 03 33 F7 EB 02 CD 20 68 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_v110_Eng_dulekxt_MASM32_TASM32_Microsoft_Visual_Basic_additional: PEiD
{
    strings:
        $a = { F7 D0 EB 02 CD 20 BE BB 74 1C FB EB 02 CD 20 BF 3B ?? ?? FB C1 C1 03 33 F7 EB 02 CD 20 68 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXECryptor_v153
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80 A1 C1 00 00 00 FE C3 31 C0 64 FF 30 64 89 20 CC C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXECryptor_v153: PEiD
{
    strings:
        $a = { E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80 A1 C1 00 00 00 FE C3 31 C0 64 FF 30 64 89 20 CC C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ORiEN_V1X_V2X_Fisun_AV
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D }

Detection condition:
$a at pe.entry_point

Full rule:
rule ORiEN_V1X_V2X_Fisun_AV: PEiD
{
    strings:
        $a = { 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F 74 65 63 74 69 6F 6E 20 73 79 73 74 65 6D }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _Protector_v1111_DDeM_PE_Engine_v09_DDeM_CI_v092_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 53 51 56 E8 00 00 00 00 5B 81 EB 08 10 00 00 8D B3 34 10 00 00 B9 F3 03 00 00 BA 63 17 2A EE 31 16 83 C6 04 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _Protector_v1111_DDeM_PE_Engine_v09_DDeM_CI_v092_additional: PEiD
{
    strings:
        $a = { 53 51 56 E8 00 00 00 00 5B 81 EB 08 10 00 00 8D B3 34 10 00 00 B9 F3 03 00 00 BA 63 17 2A EE 31 16 83 C6 04 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Themida_1920
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? ?? ?? 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 14 02 00 00 }
        $b = { BE ?? ?? BF ?? ?? B9 ?? ?? 56 FC F3 A5 5F E9 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Themida_1920: PEiD
{
    strings:
        $a = { 8B C5 8B D4 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 89 95 ?? ?? ?? ?? 89 B5 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 83 BD ?? ?? ?? ?? 00 74 0C 8B E8 8B E2 B8 01 00 00 00 C2 0C 00 8B 44 24 24 89 85 ?? ?? ?? ?? 6A 45 E8 A3 00 00 00 68 9A 74 83 07 E8 DF 00 00 00 68 25 4B 89 0A E8 D5 00 00 00 E9 14 02 00 00 }
        $b = { BE ?? ?? BF ?? ?? B9 ?? ?? 56 FC F3 A5 5F E9 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: _PseudoSigner_02_ASProtect
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_02_ASProtect: PEiD
{
    strings:
        $a = { 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASProtect_v21x
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BB E9 60 9C FC BF B9 F3 AA 9D 61 C3 55 8B }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASProtect_v21x: PEiD
{
    strings:
        $a = { BB E9 60 9C FC BF B9 F3 AA 9D 61 C3 55 8B }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: kkryptor_9_kkryptor_a_rsc
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5E B9 47 08 00 00 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 F6 66 B9 1B }

Detection condition:
$a at pe.entry_point

Full rule:
rule kkryptor_9_kkryptor_a_rsc: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5E B9 47 08 00 00 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 F6 66 B9 1B }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PE_Spin_v04x_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PE_Spin_v04x_additional: PEiD
{
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: TrueVision_Targa_Graphics_format_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 02 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule TrueVision_Targa_Graphics_format_Hint_FILE_START: PEiD
{
    strings:
        $a = { 00 00 02 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: US_Patent_Image_graphics_file_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 53 20 50 54 4F 20 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule US_Patent_Image_graphics_file_Hint_FILE_START: PEiD
{
    strings:
        $a = { 55 53 20 50 54 4F 20 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: DrHalo_or_DrGenius_Palette_Graphics_format_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 41 48 E3 00 00 00 0A 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule DrHalo_or_DrGenius_Palette_Graphics_format_Hint_FILE_START: PEiD
{
    strings:
        $a = { 41 48 E3 00 00 00 0A 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Naked_Packer_V1X_BigBoote
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 6A ?? E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF E8 00 00 00 00 EB 01 ?? 89 45 F0 C6 45 FF 00 8D 7D E8 8B F3 8A 0E 8A 17 8A C1 3A CA 75 1E 84 C0 74 16 8A 56 01 8A 4F 01 8A C2 3A D1 75 0E 83 C6 02 83 C7 02 84 C0 75 DC 33 C0 EB 05 }
        $b = { 6A ?? E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Naked_Packer_V1X_BigBoote: PEiD
{
    strings:
        $a = { 6A ?? E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF E8 00 00 00 00 EB 01 ?? 89 45 F0 C6 45 FF 00 8D 7D E8 8B F3 8A 0E 8A 17 8A C1 3A CA 75 1E 84 C0 74 16 8A 56 01 8A 4F 01 8A C2 3A D1 75 0E 83 C6 02 83 C7 02 84 C0 75 DC 33 C0 EB 05 }
        $b = { 6A ?? E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Shegerd_Dongle_V478_MSCo_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 32 00 00 00 B8 ?? ?? ?? ?? 8B 18 C1 CB 05 89 DA 36 8B 4C 24 0C }

Detection condition:
$a at pe.entry_point

Full rule:
rule Shegerd_Dongle_V478_MSCo_additional: PEiD
{
    strings:
        $a = { E8 32 00 00 00 B8 ?? ?? ?? ?? 8B 18 C1 CB 05 89 DA 36 8B 4C 24 0C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: BeRoEXEPacker_V100_BeRo
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BA ?? ?? ?? ?? 8D B2 ?? ?? ?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB 75 02 8B DF 03 DA 03 FA 52 57 50 FF 15 ?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22 0F BA F0 1F 72 04 8D 44 ?? ?? 51 52 57 50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74 0B AB 83 C3 04 EB D8 83 C6 14 EB AA 61 C3 }
        $b = { BA ?? ?? ?? ?? 8D B2 ?? ?? ?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB 75 02 8B DF 03 DA 03 FA 52 57 50 FF 15 ?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22 0F BA F0 1F 72 04 8D 44 ?? ?? 51 52 57 50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule BeRoEXEPacker_V100_BeRo: PEiD
{
    strings:
        $a = { BA ?? ?? ?? ?? 8D B2 ?? ?? ?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB 75 02 8B DF 03 DA 03 FA 52 57 50 FF 15 ?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22 0F BA F0 1F 72 04 8D 44 ?? ?? 51 52 57 50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74 0B AB 83 C3 04 EB D8 83 C6 14 EB AA 61 C3 }
        $b = { BA ?? ?? ?? ?? 8D B2 ?? ?? ?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB 75 02 8B DF 03 DA 03 FA 52 57 50 FF 15 ?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22 0F BA F0 1F 72 04 8D 44 ?? ?? 51 52 57 50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Sentinel_SuperPro_Automatic_Protection_v641_Safenet
Repository: Yara-Rules/rules

Pattern signatures:
$a = { A1 ?? ?? ?? ?? 55 8B ?? ?? ?? 85 C0 74 ?? 85 ED 75 ?? A1 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 55 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 15 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A 00 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 01 00 00 00 5D C2 0C 00 }
        $b = { A1 ?? ?? ?? ?? 55 8B ?? ?? ?? 85 C0 74 ?? 85 ED 75 ?? A1 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 55 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 15 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A 00 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 01 00 00 00 5D C2 0C 00 68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 25 FE FF DF 3F 0D 01 00 20 00 A3 ?? ?? ?? ?? 33 C0 50 C7 04 ?? ?? ?? ?? ?? 00 00 00 00 E8 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Sentinel_SuperPro_Automatic_Protection_v641_Safenet: PEiD
{
    strings:
        $a = { A1 ?? ?? ?? ?? 55 8B ?? ?? ?? 85 C0 74 ?? 85 ED 75 ?? A1 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 55 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 15 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A 00 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 01 00 00 00 5D C2 0C 00 }
        $b = { A1 ?? ?? ?? ?? 55 8B ?? ?? ?? 85 C0 74 ?? 85 ED 75 ?? A1 ?? ?? ?? ?? 50 55 FF 15 ?? ?? ?? ?? 8B 0D ?? ?? ?? ?? 55 51 FF 15 ?? ?? ?? ?? 85 C0 74 ?? 8B 15 ?? ?? ?? ?? 52 FF 15 ?? ?? ?? ?? 6A 00 6A 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? B8 01 00 00 00 5D C2 0C 00 68 ?? ?? ?? ?? 6A 01 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 C9 3D B7 00 00 00 A1 ?? ?? ?? ?? 0F 94 C1 85 C0 89 0D ?? ?? ?? ?? 0F 85 ?? ?? ?? ?? 56 C7 05 ?? ?? ?? ?? 01 00 00 00 FF 15 ?? ?? ?? ?? 01 ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 33 05 ?? ?? ?? ?? 25 FE FF DF 3F 0D 01 00 20 00 A3 ?? ?? ?? ?? 33 C0 50 C7 04 ?? ?? ?? ?? ?? 00 00 00 00 E8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Hardlock_dongle_Alladin
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 5C 5C 2E 5C 48 41 52 44 4C 4F 43 4B 2E 56 58 44 00 00 00 00 5C 5C 2E 5C 46 45 6E 74 65 44 65 76 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Hardlock_dongle_Alladin: PEiD
{
    strings:
        $a = { 5C 5C 2E 5C 48 41 52 44 4C 4F 43 4B 2E 56 58 44 00 00 00 00 5C 5C 2E 5C 46 45 6E 74 65 44 65 76 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_v031_beta_Dwing_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 31 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_v031_beta_Dwing_additional: PEiD
{
    strings:
        $a = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 31 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AHPack_01_FEUERRADER_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 66 9C BB ?? ?? ?? ?? 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 }

Detection condition:
$a at pe.entry_point

Full rule:
rule AHPack_01_FEUERRADER_additional: PEiD
{
    strings:
        $a = { 60 66 9C BB ?? ?? ?? ?? 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPX_v0761_pe_exe_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 BE ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 57 83 ?? ?? 31 DB EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPX_v0761_pe_exe_additional: PEiD
{
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 66 ?? ?? ?? ?? ?? ?? 57 83 ?? ?? 31 DB EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Alex_Protector_10_Alex
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Alex_Protector_10_Alex: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: aPack_090_099_m_EXE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 1E 06 8C C8 8E D8 05 00 00 8E C0 50 BE 00 00 33 FF FC B2 80 BD 00 00 33 C9 50 A4 }

Detection condition:
$a at pe.entry_point

Full rule:
rule aPack_090_099_m_EXE: PEiD
{
    strings:
        $a = { 1E 06 8C C8 8E D8 05 00 00 8E C0 50 BE 00 00 33 FF FC B2 80 BD 00 00 33 C9 50 A4 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PEiD_4250_624_Six_to_Four_v10_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 55 4C 50 83 ?? ?? FC BF ?? ?? BE ?? ?? B5 ?? 57 F3 A5 C3 33 ED }

Detection condition:
$a at pe.entry_point

Full rule:
rule PEiD_4250_624_Six_to_Four_v10_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 50 55 4C 50 83 ?? ?? FC BF ?? ?? BE ?? ?? B5 ?? 57 F3 A5 C3 33 ED }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Unnamed_Scrambler_20_p0ke_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC B9 0A 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 1C 2F 40 00 E8 C8 F1 FF FF 33 C0 55 68 FB 33 40 00 64 FF 30 64 89 20 BA 0C 34 40 00 B8 E4 54 40 00 E8 EF FE FF FF 8B D8 85 DB 75 07 6A 00 E8 5A F2 FF FF BA E8 54 40 00 8B C3 8B 0D E4 54 40 00 E8 74 E2 FF FF C7 05 20 6B 40 00 09 00 00 00 BB 98 69 40 00 C7 45 EC E8 54 40 00 C7 45 E8 31 57 40 00 C7 45 E4 43 60 40 00 BE D3 6A 40 00 BF E0 6A 40 00 83 7B 04 00 75 0B 83 3B 00 0F 86 AA 03 00 00 EB 06 0F 8E A2 03 00 00 8B 03 8B D0 B8 0C 6B 40 00 E8 C1 EE FF FF B8 0C 6B 40 00 E8 6F EE FF FF 8B D0 8B 45 EC 8B 0B E8 0B E2 FF FF 6A 00 6A 1E 6A 00 6A 2C A1 0C 6B 40 00 E8 25 ED FF FF 8D 55 E0 E8 15 FE FF FF 8B 55 E0 B9 10 6B 40 00 A1 0C 6B 40 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Unnamed_Scrambler_20_p0ke_additional: PEiD
{
    strings:
        $a = { 55 8B EC B9 0A 00 00 00 6A 00 6A 00 49 75 F9 53 56 57 B8 1C 2F 40 00 E8 C8 F1 FF FF 33 C0 55 68 FB 33 40 00 64 FF 30 64 89 20 BA 0C 34 40 00 B8 E4 54 40 00 E8 EF FE FF FF 8B D8 85 DB 75 07 6A 00 E8 5A F2 FF FF BA E8 54 40 00 8B C3 8B 0D E4 54 40 00 E8 74 E2 FF FF C7 05 20 6B 40 00 09 00 00 00 BB 98 69 40 00 C7 45 EC E8 54 40 00 C7 45 E8 31 57 40 00 C7 45 E4 43 60 40 00 BE D3 6A 40 00 BF E0 6A 40 00 83 7B 04 00 75 0B 83 3B 00 0F 86 AA 03 00 00 EB 06 0F 8E A2 03 00 00 8B 03 8B D0 B8 0C 6B 40 00 E8 C1 EE FF FF B8 0C 6B 40 00 E8 6F EE FF FF 8B D0 8B 45 EC 8B 0B E8 0B E2 FF FF 6A 00 6A 1E 6A 00 6A 2C A1 0C 6B 40 00 E8 25 ED FF FF 8D 55 E0 E8 15 FE FF FF 8B 55 E0 B9 10 6B 40 00 A1 0C 6B 40 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Trainer_Creation_Kit_v5_Trainer_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 40 68 25 45 40 00 E8 3C 02 00 00 50 6A 00 68 40 45 40 00 68 00 10 00 00 68 00 30 40 00 50 E8 54 02 00 00 58 50 E8 17 02 00 00 6A 00 E8 2E 02 00 00 A3 70 45 40 00 68 25 45 40 00 E8 2B 02 00 00 A3 30 45 40 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Trainer_Creation_Kit_v5_Trainer_additional: PEiD
{
    strings:
        $a = { 6A 00 68 80 00 00 00 6A 02 6A 00 6A 00 68 00 00 00 40 68 25 45 40 00 E8 3C 02 00 00 50 6A 00 68 40 45 40 00 68 00 10 00 00 68 00 30 40 00 50 E8 54 02 00 00 58 50 E8 17 02 00 00 6A 00 E8 2E 02 00 00 A3 70 45 40 00 68 25 45 40 00 E8 2B 02 00 00 A3 30 45 40 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_CAB_SFX_module
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 EC 44 56 FF 15 94 13 42 ?? 8B F0 B1 22 8A 06 3A C1 75 13 8A 46 01 46 3A C1 74 04 84 C0 75 F4 38 0E 75 0D 46 EB 0A 3C 20 7E }
        $b = { 55 8B EC 83 EC 44 56 FF 15 ?? 10 00 01 8B F0 8A 06 3C 22 75 14 8A 46 01 46 84 C0 74 04 3C 22 75 F4 80 3E 22 75 0D ?? EB 0A 3C 20 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Microsoft_CAB_SFX_module: PEiD
{
    strings:
        $a = { 55 8B EC 83 EC 44 56 FF 15 94 13 42 ?? 8B F0 B1 22 8A 06 3A C1 75 13 8A 46 01 46 3A C1 74 04 84 C0 75 F4 38 0E 75 0D 46 EB 0A 3C 20 7E }
        $b = { 55 8B EC 83 EC 44 56 FF 15 ?? 10 00 01 8B F0 8A 06 3C 22 75 14 8A 46 01 46 84 C0 74 04 3C 22 75 F4 80 3E 22 75 0D ?? EB 0A 3C 20 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: PseudoSigner_01_Borland_Delphi_30_Anorganix_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_01_Borland_Delphi_30_Anorganix_additional: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vprotect_V189_193_CoooLie
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 58 89 03 8B 07 8B 5F 0C 8B 4F 04 8B 57 08 8B 6F 14 8B 77 18 FF 77 24 9D 8B 67 10 50 33 C0 F0 87 47 50 58 8B 7F 1C C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vprotect_V189_193_CoooLie: PEiD
{
    strings:
        $a = { 58 89 03 8B 07 8B 5F 0C 8B 4F 04 8B 57 08 8B 6F 14 8B 77 18 FF 77 24 9D 8B 67 10 50 33 C0 F0 87 47 50 58 8B 7F 1C C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: NoodleCrypt_200_Eng_NoodleSpa
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 01 9A E8 76 00 00 00 EB 01 9A E8 65 00 00 00 EB 01 9A E8 7D 00 00 00 EB 01 9A E8 55 00 00 00 EB 01 9A E8 43 04 00 00 EB 01 9A E8 E1 00 00 00 EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 9A E8 25 00 00 00 EB 01 9A E8 02 }

Detection condition:
$a at pe.entry_point

Full rule:
rule NoodleCrypt_200_Eng_NoodleSpa: PEiD
{
    strings:
        $a = { EB 01 9A E8 76 00 00 00 EB 01 9A E8 65 00 00 00 EB 01 9A E8 7D 00 00 00 EB 01 9A E8 55 00 00 00 EB 01 9A E8 43 04 00 00 EB 01 9A E8 E1 00 00 00 EB 01 9A E8 3D 00 00 00 EB 01 9A E8 EB 01 00 00 EB 01 9A E8 2C 04 00 00 EB 01 9A E8 25 00 00 00 EB 01 9A E8 02 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: eXPressor_13_CGSoftLabs
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E }
        $b = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? 00 2B 05 84 ?? ?? 00 A3 ?? ?? ?? 00 83 3D ?? ?? ?? 00 00 74 16 A1 ?? ?? ?? 00 03 05 80 ?? ?? 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? 00 01 00 00 00 68 04 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule eXPressor_13_CGSoftLabs: PEiD
{
    strings:
        $a = { 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E }
        $b = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? 00 2B 05 84 ?? ?? 00 A3 ?? ?? ?? 00 83 3D ?? ?? ?? 00 00 74 16 A1 ?? ?? ?? 00 03 05 80 ?? ?? 00 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? 00 01 00 00 00 68 04 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: _PseudoSigner_01_Borland_Delphi_30_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_Borland_Delphi_30_Anorganix: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: HACKSTOP_v113_DarkStop_v10
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FA BD ?? ?? D4 85 4E 32 EB EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule HACKSTOP_v113_DarkStop_v10: PEiD
{
    strings:
        $a = { FA BD ?? ?? D4 85 4E 32 EB EB }
    condition:
        $a at pe.entry_point

}