deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Pelles_C_290_300_400_DLL_X86_CRT_LIB
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 53 56 57 8B 5D 0C 8B 75 10 BF 01 00 00 00 85 DB 75 10 83 3D ?? ?? ?? ?? 00 75 07 31 C0 E9 ?? ?? ?? ?? 83 FB 01 74 05 83 FB 02 75 ?? 85 FF 74 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Pelles_C_290_300_400_DLL_X86_CRT_LIB: PEiD
{
    strings:
        $a = { 55 89 E5 53 56 57 8B 5D 0C 8B 75 10 BF 01 00 00 00 85 DB 75 10 83 3D ?? ?? ?? ?? 00 75 07 31 C0 E9 ?? ?? ?? ?? 83 FB 01 74 05 83 FB 02 75 ?? 85 FF 74 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Ice_v100_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB ?? BE ?? ?? 8B FE 8B ?? ?? ?? 8B ?? ?? ?? B8 ?? ?? 50 FC AD 33 C2 AB 8B D0 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Ice_v100_Hint_DOS_EP: PEiD
{
    strings:
        $a = { EB ?? BE ?? ?? 8B FE 8B ?? ?? ?? 8B ?? ?? ?? B8 ?? ?? 50 FC AD 33 C2 AB 8B D0 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ProtEXE_211_COM
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 9C 58 25 FF 0F 50 9D 9C 58 25 00 F0 3D 00 F0 74 2A 9C 58 25 FF 0F 0D 00 70 50 9D 9C 58 25 00 70 74 19 BA 64 00 B0 AD EB 01 88 EE EB 01 A0 0F 20 00 F8 BA 64 00 B0 AE EB 01 88 EE 9D 1E 06 33 C0 8E D8 FF 36 0C 00 FF 36 0E 00 B8 00 00 A3 0C }

Detection condition:
$a at pe.entry_point

Full rule:
rule ProtEXE_211_COM: PEiD
{
    strings:
        $a = { 9C 9C 58 25 FF 0F 50 9D 9C 58 25 00 F0 3D 00 F0 74 2A 9C 58 25 FF 0F 0D 00 70 50 9D 9C 58 25 00 70 74 19 BA 64 00 B0 AD EB 01 88 EE EB 01 A0 0F 20 00 F8 BA 64 00 B0 AE EB 01 88 EE 9D 1E 06 33 C0 8E D8 FF 36 0C 00 FF 36 0E 00 B8 00 00 A3 0C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ExeShield_v37_ExeShield_Team_h_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F 8C B9 0A FC EC E4 82 97 AE 0F 18 D2 47 1B 65 EA 46 A5 FD 3E 9D 75 2A 62 80 60 F9 B0 0D E1 AC 12 0E 9D 24 D5 43 CE 9A D6 18 BF 22 DA 1F 72 76 B0 98 5B C2 64 BC AE D8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ExeShield_v37_ExeShield_Team_h_additional: PEiD
{
    strings:
        $a = { B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 CE 1E 42 AF F8 D6 CC E9 FB C8 4F 1B 22 7C B4 C8 0D BD 71 A9 C8 1F 5F B1 29 8F 11 73 8F 00 D1 88 87 A9 3F 4D 00 6C 3C BF C0 80 F7 AD 35 23 EB 84 82 6F 8C B9 0A FC EC E4 82 97 AE 0F 18 D2 47 1B 65 EA 46 A5 FD 3E 9D 75 2A 62 80 60 F9 B0 0D E1 AC 12 0E 9D 24 D5 43 CE 9A D6 18 BF 22 DA 1F 72 76 B0 98 5B C2 64 BC AE D8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_Windows_Help_file_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 3F 5F 03 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_Windows_Help_file_Hint_FILE_START: PEiD
{
    strings:
        $a = { 3F 5F 03 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ENIGMA_Protector_V1X_Sukhov_Vladimir_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 45 6E 69 67 6D 61 20 70 72 6F 74 65 63 74 6F 72 20 76 31 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ENIGMA_Protector_V1X_Sukhov_Vladimir_additional: PEiD
{
    strings:
        $a = { 45 6E 69 67 6D 61 20 70 72 6F 74 65 63 74 6F 72 20 76 31 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_02_Yodas_Protector_102_Anorganix_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 03 00 00 00 EB 01 90 90 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_02_Yodas_Protector_102_Anorganix_additional: PEiD
{
    strings:
        $a = { E8 03 00 00 00 EB 01 90 90 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Setup_Factory_v6003_Setup_Launcher
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89 }
        $b = { 55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89 40 00 33 F6 56 E8 E0 00 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 E6 0F 00 00 FF 15 10 61 40 00 A3 40 8E 40 00 E8 A4 0E 00 00 A3 90 89 40 00 E8 4D 0C 00 00 E8 8F 0B 00 00 E8 22 FE FF FF 89 75 D0 8D 45 A4 50 FF 15 0C 61 40 00 E8 20 0B 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 08 61 40 00 50 E8 5A E9 FF FF 89 45 A0 50 E8 10 FE FF FF 8B 45 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Setup_Factory_v6003_Setup_Launcher: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89 }
        $b = { 55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89 40 00 33 F6 56 E8 E0 00 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 E6 0F 00 00 FF 15 10 61 40 00 A3 40 8E 40 00 E8 A4 0E 00 00 A3 90 89 40 00 E8 4D 0C 00 00 E8 8F 0B 00 00 E8 22 FE FF FF 89 75 D0 8D 45 A4 50 FF 15 0C 61 40 00 E8 20 0B 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 08 61 40 00 50 E8 5A E9 FF FF 89 45 A0 50 E8 10 FE FF FF 8B 45 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: RSCs_Process_Patcher_v14_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 00 20 40 00 E8 C3 01 00 00 80 38 00 74 0D 66 81 78 FE 22 20 75 02 EB 03 40 EB EE 8B F8 B8 04 60 40 00 68 C4 20 40 00 68 D4 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 9F 01 00 00 85 C0 0F 84 39 01 00 00 BE 00 60 40 00 8B 06 A3 28 21 40 00 83 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RSCs_Process_Patcher_v14_additional: PEiD
{
    strings:
        $a = { 68 00 20 40 00 E8 C3 01 00 00 80 38 00 74 0D 66 81 78 FE 22 20 75 02 EB 03 40 EB EE 8B F8 B8 04 60 40 00 68 C4 20 40 00 68 D4 20 40 00 6A 00 6A 00 6A 04 6A 00 6A 00 6A 00 57 50 E8 9F 01 00 00 85 C0 0F 84 39 01 00 00 BE 00 60 40 00 8B 06 A3 28 21 40 00 83 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASPack_v108x
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 ?? ?? ?? ?? 5D BB 03 }
        $b = { 60 EB 03 5D FF E5 E8 F8 FF FF FF 81 ED 1B 6A 44 00 BB 10 6A 44 00 03 DD 2B 9D 2A }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule ASPack_v108x: PEiD
{
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D BB 03 }
        $b = { 60 EB 03 5D FF E5 E8 F8 FF FF FF 81 ED 1B 6A 44 00 BB 10 6A 44 00 03 DD 2B 9D 2A }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: UPX_290_LZMA_Markus_Oberhumer_Laszlo_Molnar_John_Reiser
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 ?? ?? ?? ?? 90 90 }
        $b = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule UPX_290_LZMA_Markus_Oberhumer_Laszlo_Molnar_John_Reiser: PEiD
{
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 ?? ?? ?? ?? 90 90 }
        $b = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: SecuROM_V7X_Sony_DADC_SignByfly_20080114_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 9C 83 EC 1C C7 44 24 18 ?? ?? ?? ?? C7 44 24 14 BF 03 01 00 89 74 24 10 BE F0 ?? ?? ?? C1 4C 24 18 18 ?? 89 6C 24 0C 8B 2E 01 6C 24 18 ?? 83 C6 04 66 FF 4C 24 14 52 5A 75 ED 80 64 24 18 FE ?? 8B 74 24 1C C1 E1 00 8B 6C 24 18 89 74 24 18 8B 74 24 10 89 }

Detection condition:
$a at pe.entry_point

Full rule:
rule SecuROM_V7X_Sony_DADC_SignByfly_20080114_additional: PEiD
{
    strings:
        $a = { 9C 9C 83 EC 1C C7 44 24 18 ?? ?? ?? ?? C7 44 24 14 BF 03 01 00 89 74 24 10 BE F0 ?? ?? ?? C1 4C 24 18 18 ?? 89 6C 24 0C 8B 2E 01 6C 24 18 ?? 83 C6 04 66 FF 4C 24 14 52 5A 75 ED 80 64 24 18 FE ?? 8B 74 24 1C C1 E1 00 8B 6C 24 18 89 74 24 18 8B 74 24 10 89 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Turbo_Pascal_v60_Unit
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 54 50 55 39 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Turbo_Pascal_v60_Unit: PEiD
{
    strings:
        $a = { 54 50 55 39 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: aPack_v098b_com_Hint_HDR_FILESIZE_16
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE ?? ?? BF ?? ?? 8B CF FC 57 F3 A4 C3 BF ?? ?? 57 57 BE ?? ?? B2 ?? BD ?? ?? 50 A4 }

Detection condition:
$a at pe.entry_point

Full rule:
rule aPack_v098b_com_Hint_HDR_FILESIZE_16: PEiD
{
    strings:
        $a = { BE ?? ?? BF ?? ?? 8B CF FC 57 F3 A4 C3 BF ?? ?? 57 57 BE ?? ?? B2 ?? BD ?? ?? 50 A4 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Cruncher_10
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 2E 8C 1E 00 00 2E A3 02 00 B4 30 CD 21 3C 03 73 12 BB 51 00 8E DB 8D 16 B4 00 B4 09 CD 21 06 33 C0 50 CB BB 51 00 8E C3 BF B3 00 8B 1E 2C 00 0B DB 74 DE 8E DB BE 00 00 83 3C 00 74 03 46 EB F8 83 C6 04 AC AA 0A C0 75 FA BB 51 00 8E C3 8E DB }

Detection condition:
$a at pe.entry_point

Full rule:
rule Cruncher_10: PEiD
{
    strings:
        $a = { 2E 8C 1E 00 00 2E A3 02 00 B4 30 CD 21 3C 03 73 12 BB 51 00 8E DB 8D 16 B4 00 B4 09 CD 21 06 33 C0 50 CB BB 51 00 8E C3 BF B3 00 8B 1E 2C 00 0B DB 74 DE 8E DB BE 00 00 83 3C 00 74 03 46 EB F8 83 C6 04 AC AA 0A C0 75 FA BB 51 00 8E C3 8E DB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MEW_11_SE_v11_Northfox
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? ?? ?? 0C ?? ?? ?? 00 00 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MEW_11_SE_v11_Northfox: PEiD
{
    strings:
        $a = { E9 ?? ?? ?? ?? 0C ?? ?? ?? 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Borland_Graphics_Interface_Driver_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 46 42 47 44 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Borland_Graphics_Interface_Driver_Hint_FILE_START: PEiD
{
    strings:
        $a = { 46 42 47 44 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: yodas_Protector_10_beta_Ashkbiz_Danehkar_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule yodas_Protector_10_beta_Ashkbiz_Danehkar_additional: PEiD
{
    strings:
        $a = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 ?? E8 03 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ID_Application_Protector_V12_ID_Security_Suite_Sign_by_fly_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 70 3B 00 10 E8 3C FA FF FF 33 C0 55 68 6C 3C 00 10 64 FF 30 64 89 20 6A 0A 68 7C 3C 00 10 A1 50 56 00 10 50 E8 D8 FA FF FF 8B D8 53 A1 50 56 00 10 50 E8 0A FB FF FF 8B F8 53 A1 50 56 00 10 50 E8 D4 FA FF FF 8B }

Detection condition:
$a at pe.entry_point

Full rule:
rule ID_Application_Protector_V12_ID_Security_Suite_Sign_by_fly_additional: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 70 3B 00 10 E8 3C FA FF FF 33 C0 55 68 6C 3C 00 10 64 FF 30 64 89 20 6A 0A 68 7C 3C 00 10 A1 50 56 00 10 50 E8 D8 FA FF FF 8B D8 53 A1 50 56 00 10 50 E8 0A FB FF FF 8B F8 53 A1 50 56 00 10 50 E8 D4 FA FF FF 8B }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Obsidium_V1334_Obsidium_Software
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? 33 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsidium_V1334_Obsidium_Software: PEiD
{
    strings:
        $a = { EB 02 ?? ?? E8 29 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 25 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? 33 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Alloy_4x_PGWare_LLC_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 A8 33 40 00 0B C0 0F 84 F6 01 00 00 89 85 2E 33 40 00 83 BD E8 32 40 00 01 74 0D 83 BD E4 32 40 00 01 74 2A 8B F8 EB 3E 68 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Alloy_4x_PGWare_LLC_additional: PEiD
{
    strings:
        $a = { 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 30 40 00 87 DD 6A 04 68 00 10 00 00 68 00 02 00 00 6A 00 FF 95 A8 33 40 00 0B C0 0F 84 F6 01 00 00 89 85 2E 33 40 00 83 BD E8 32 40 00 01 74 0D 83 BD E4 32 40 00 01 74 2A 8B F8 EB 3E 68 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXEPACK_v531009_LINK_v369_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B E8 8C C0 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXEPACK_v531009_LINK_v369_additional: PEiD
{
    strings:
        $a = { 8B E8 8C C0 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: GCC_CYGWIN_MSYS_sign_ASL
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 83 EC 08 A1 00 ?? ?? 00 85 C0 74 01 CC D9 7D FE 0F B7 4D FE 81 E1 C0 F0 FF FF 66 89 4D FE 0F B7 55 FE 81 CA 3F 03 00 00 66 89 55 FE D9 6D FE }

Detection condition:
$a at pe.entry_point

Full rule:
rule GCC_CYGWIN_MSYS_sign_ASL: PEiD
{
    strings:
        $a = { 55 89 E5 83 EC 08 A1 00 ?? ?? 00 85 C0 74 01 CC D9 7D FE 0F B7 4D FE 81 E1 C0 F0 FF FF 66 89 4D FE 0F B7 55 FE 81 CA 3F 03 00 00 66 89 55 FE D9 6D FE }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Stones_PE_Encrypter_113
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 97 3B 40 00 2B 95 2D 3C 40 00 83 EA 0B 89 95 36 3C 40 00 01 95 24 3C 40 00 01 95 28 3C 40 00 80 BD 2C 3C 40 00 00 75 4A C6 85 2C 3C 40 00 01 8D B5 35 3C 40 00 0F B6 36 8B FD 8D 9D 36 3C 40 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Stones_PE_Encrypter_113: PEiD
{
    strings:
        $a = { 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 97 3B 40 00 2B 95 2D 3C 40 00 83 EA 0B 89 95 36 3C 40 00 01 95 24 3C 40 00 01 95 28 3C 40 00 80 BD 2C 3C 40 00 00 75 4A C6 85 2C 3C 40 00 01 8D B5 35 3C 40 00 0F B6 36 8B FD 8D 9D 36 3C 40 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_v110_Eng_dulekxt_Borland_Cpp_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? ?? 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_v110_Eng_dulekxt_Borland_Cpp_additional: PEiD
{
    strings:
        $a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? ?? 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 41 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 96 33 C9 41 FF 54 24 04 13 C9 FF 54 24 04 72 F4 C3 5F 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 52 FF FF FF 5F BB ?? ?? ?? ?? 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_0399_Dwing
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_0399_Dwing: PEiD
{
    strings:
        $a = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: tElock_v098_tHE_EGOiSTE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule tElock_v098_tHE_EGOiSTE: PEiD
{
    strings:
        $a = { E9 25 E4 FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 75 73 65 72 33 32 2E 64 6C 6C 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 00 00 00 00 00 00 00 00 00 00 00 08 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: WWPACK_v305c4_Unextr_Passwcheck_Vir_shield
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 03 05 C0 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule WWPACK_v305c4_Unextr_Passwcheck_Vir_shield: PEiD
{
    strings:
        $a = { 03 05 C0 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_Visual_Basic_v60
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FF 25 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? FF FF FF ?? ?? ?? ?? ?? ?? 30 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_Visual_Basic_v60: PEiD
{
    strings:
        $a = { FF 25 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? FF FF FF ?? ?? ?? ?? ?? ?? 30 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_02_PE_Protect_09
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_02_PE_Protect_09: PEiD
{
    strings:
        $a = { 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXE_Shield_v01b_v03b_v03_SMoKE_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXE_Shield_v01b_v03b_v03_SMoKE_additional: PEiD
{
    strings:
        $a = { EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CAN2EXE_v001_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 26 8E 06 ?? ?? B9 ?? ?? 33 C0 8B F8 F2 AE E3 ?? 26 38 05 75 ?? EB ?? E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CAN2EXE_v001_additional: PEiD
{
    strings:
        $a = { 26 8E 06 ?? ?? B9 ?? ?? 33 C0 8B F8 F2 AE E3 ?? 26 38 05 75 ?? EB ?? E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PMODEW_120
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FC 16 07 BF 00 01 8B F7 57 B9 EE 12 F3 A5 06 1E 07 1F 5F BE 1D 02 06 0E A4 AD 8B E8 B2 10 1E B8 D4 01 50 CB D1 ED FE CA 75 05 AD 8B E8 B2 10 C3 E8 F1 FF 73 0F E8 EC FF 80 D1 01 D0 E1 E8 E4 FF D0 D7 E2 F9 B6 02 B1 04 FE C6 E8 D7 FF 72 1D E2 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PMODEW_120: PEiD
{
    strings:
        $a = { FC 16 07 BF 00 01 8B F7 57 B9 EE 12 F3 A5 06 1E 07 1F 5F BE 1D 02 06 0E A4 AD 8B E8 B2 10 1E B8 D4 01 50 CB D1 ED FE CA 75 05 AD 8B E8 B2 10 C3 E8 F1 FF 73 0F E8 EC FF 80 D1 01 D0 E1 E8 E4 FF D0 D7 E2 F9 B6 02 B1 04 FE C6 E8 D7 FF 72 1D E2 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PMODEW_121
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FC 16 07 BF 00 01 8B F7 57 B9 05 13 F3 A5 06 1E 07 1F 5F BE 1D 02 06 0E A4 AD 8B E8 B2 10 1E B8 D4 01 50 CB D1 ED FE CA 75 05 AD 8B E8 B2 10 C3 E8 F1 FF 73 0F E8 EC FF 80 D1 01 D0 E1 E8 E4 FF D0 D7 E2 F9 B6 02 B1 04 FE C6 E8 D7 FF 72 1D E2 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PMODEW_121: PEiD
{
    strings:
        $a = { FC 16 07 BF 00 01 8B F7 57 B9 05 13 F3 A5 06 1E 07 1F 5F BE 1D 02 06 0E A4 AD 8B E8 B2 10 1E B8 D4 01 50 CB D1 ED FE CA 75 05 AD 8B E8 B2 10 C3 E8 F1 FF 73 0F E8 EC FF 80 D1 01 D0 E1 E8 E4 FF D0 D7 E2 F9 B6 02 B1 04 FE C6 E8 D7 FF 72 1D E2 }
    condition:
        $a at pe.entry_point

}