deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: HACKSTOP_v100_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FA BD ?? ?? FF E5 6A 49 48 0C ?? E4 ?? 3F 98 3F }

Detection condition:
$a at pe.entry_point

Full rule:
rule HACKSTOP_v100_Hint_DOS_EP: PEiD
{
    strings:
        $a = { FA BD ?? ?? FF E5 6A 49 48 0C ?? E4 ?? 3F 98 3F }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SimplePack_111_Method_1_bagieTMX_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC F3 A5 89 C1 83 E1 03 F3 A4 5F 5E 8B 04 24 89 EA 03 57 0C E8 3F 01 00 00 58 68 00 40 00 00 FF 77 10 50 FF 93 3C 03 00 00 83 C7 28 4E 75 9E BE ?? ?? ?? ?? 09 F6 0F 84 0C 01 00 00 01 EE 8B 4E 0C 09 C9 0F 84 FF 00 00 00 01 E9 89 CF 57 FF 93 30 03 00 00 09 C0 75 3D 6A 04 68 00 10 00 00 68 00 10 00 00 6A 00 FF 93 38 03 00 00 89 C6 8D 83 6F 02 00 00 57 50 56 FF 93 44 03 00 00 6A 10 6A 00 56 6A 00 FF 93 48 03 00 00 89 E5 }

Detection condition:
$a at pe.entry_point

Full rule:
rule SimplePack_111_Method_1_bagieTMX_h: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5B 8D 5B FA BD 00 00 ?? ?? 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 0F B7 76 06 4E 8B 47 10 09 C0 74 55 0F B7 47 22 09 C0 74 4D 6A 04 68 00 10 00 00 FF 77 10 6A 00 FF 93 38 03 00 00 50 56 57 89 EE 03 77 0C 8B 4F 10 89 C7 89 C8 C1 E9 02 FC F3 A5 89 C1 83 E1 03 F3 A4 5F 5E 8B 04 24 89 EA 03 57 0C E8 3F 01 00 00 58 68 00 40 00 00 FF 77 10 50 FF 93 3C 03 00 00 83 C7 28 4E 75 9E BE ?? ?? ?? ?? 09 F6 0F 84 0C 01 00 00 01 EE 8B 4E 0C 09 C9 0F 84 FF 00 00 00 01 E9 89 CF 57 FF 93 30 03 00 00 09 C0 75 3D 6A 04 68 00 10 00 00 68 00 10 00 00 6A 00 FF 93 38 03 00 00 89 C6 8D 83 6F 02 00 00 57 50 56 FF 93 44 03 00 00 6A 10 6A 00 56 6A 00 FF 93 48 03 00 00 89 E5 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_v035_alpha
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B F2 8B CA 03 4C 19 1C 03 54 1A 20 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_v035_alpha: PEiD
{
    strings:
        $a = { 8B F2 8B CA 03 4C 19 1C 03 54 1A 20 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RLPack_V112_aPlib_043_ap0x
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF EB 0F FF ?? ?? ?? FF ?? ?? ?? D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule RLPack_V112_aPlib_043_ap0x: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF EB 0F FF ?? ?? ?? FF ?? ?? ?? D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ExeBundle_v30_standard_loader
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 00 00 60 BE 00 B0 42 00 8D BE 00 60 FD FF C7 87 B0 E4 02 00 31 3C 4B DF 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB }

Detection condition:
$a at pe.entry_point

Full rule:
rule ExeBundle_v30_standard_loader: PEiD
{
    strings:
        $a = { 00 00 00 00 60 BE 00 B0 42 00 8D BE 00 60 FD FF C7 87 B0 E4 02 00 31 3C 4B DF 57 83 CD FF EB 0E 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Diet_100_EXE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FC 06 1E 0E 8C C8 01 06 38 01 BA 00 00 03 C2 8B D8 05 00 00 8E DB 8E C0 33 F6 33 FF B9 08 00 F3 A5 4B 48 4A 79 EE 8E C3 8E D8 BE 4A 00 AD 8B E8 B2 10 EA 00 00 00 00 FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule Diet_100_EXE: PEiD
{
    strings:
        $a = { FC 06 1E 0E 8C C8 01 06 38 01 BA 00 00 03 C2 8B D8 05 00 00 8E DB 8E C0 33 F6 33 FF B9 08 00 F3 A5 4B 48 4A 79 EE 8E C3 8E D8 BE 4A 00 AD 8B E8 B2 10 EA 00 00 00 00 FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: NoodleCrypt_v20_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 01 9A E8 ?? 00 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule NoodleCrypt_v20_additional: PEiD
{
    strings:
        $a = { EB 01 9A E8 ?? 00 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01 9A E8 ?? ?? 00 00 EB 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Petite_22_c1998_99_Ian_Luck
Repository: Yara-Rules/rules

Pattern signatures:
$a = { ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 ?? ?? 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66 }
        $b = { 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 ?? ?? 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Petite_22_c1998_99_Ian_Luck: PEiD
{
    strings:
        $a = { ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 ?? ?? 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66 }
        $b = { 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 66 9C 60 50 68 00 00 ?? ?? 8B 3C 24 8B 30 66 81 C7 80 07 8D 74 06 08 89 38 8B 5E 10 50 56 6A 02 68 80 08 00 00 57 6A ?? 6A 06 56 6A 04 68 80 08 00 00 57 FF D3 83 EE 08 59 F3 A5 59 66 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: yP_v10b_by_Ashkbiz_Danehkar
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 C2 E8 03 00 00 00 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? EB 01 E8 }
        $b = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 C2 E8 03 00 00 00 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? EB 01 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 01 E8 ?? AA E2 9C }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule yP_v10b_by_Ashkbiz_Danehkar: PEiD
{
    strings:
        $a = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 C2 E8 03 00 00 00 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? EB 01 E8 }
        $b = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 C2 E8 03 00 00 00 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? EB 01 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 01 E8 ?? AA E2 9C }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: RLPack_V119_Dll_LZMA_430_ap0xnbsp_nbsp_Sign_by_fly_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA }

Detection condition:
$a at pe.entry_point

Full rule:
rule RLPack_V119_Dll_LZMA_430_ap0xnbsp_nbsp_Sign_by_fly_additional: PEiD
{
    strings:
        $a = { 80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Libraries_by_John_Socha_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BB ?? ?? 8E DB 2E 89 ?? ?? ?? 8D ?? ?? ?? 25 ?? ?? FA 8E D3 8B E0 FB 26 A1 A3 ?? ?? B4 30 CD 21 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Libraries_by_John_Socha_additional: PEiD
{
    strings:
        $a = { BB ?? ?? 8E DB 2E 89 ?? ?? ?? 8D ?? ?? ?? 25 ?? ?? FA 8E D3 8B E0 FB 26 A1 A3 ?? ?? B4 30 CD 21 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_02_JDPack_1x_JDProtect_09
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_02_JDPack_1x_JDProtect_09: PEiD
{
    strings:
        $a = { 60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RCryptor_v15_Vaska
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F }

Detection condition:
$a at pe.entry_point

Full rule:
rule RCryptor_v15_Vaska: PEiD
{
    strings:
        $a = { 83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: BobPack_v100_BoB_BobSoft
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 8B 0C 24 89 CD 83 E9 06 81 ED ?? ?? ?? ?? E8 3D 00 00 00 89 85 ?? ?? ?? ?? 89 C2 B8 5D 0A 00 00 8D 04 08 E8 E4 00 00 00 8B 70 04 01 D6 E8 76 00 00 00 E8 51 01 00 00 E8 01 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule BobPack_v100_BoB_BobSoft: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 8B 0C 24 89 CD 83 E9 06 81 ED ?? ?? ?? ?? E8 3D 00 00 00 89 85 ?? ?? ?? ?? 89 C2 B8 5D 0A 00 00 8D 04 08 E8 E4 00 00 00 8B 70 04 01 D6 E8 76 00 00 00 E8 51 01 00 00 E8 01 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SimplePack_12build3009_Method2_bagie
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 4D 5A 90 EB 01 00 52 E9 86 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule SimplePack_12build3009_Method2_bagie: PEiD
{
    strings:
        $a = { 4D 5A 90 EB 01 00 52 E9 86 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MASMTASM_sig1h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { CC FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MASMTASM_sig1h: PEiD
{
    strings:
        $a = { CC FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Windows_Type_1_font_metric_file_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 01 ?? ?? 00 00 43 6F 70 79 72 69 67 68 74 20 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Windows_Type_1_font_metric_file_Hint_FILE_START: PEiD
{
    strings:
        $a = { 00 01 ?? ?? 00 00 43 6F 70 79 72 69 67 68 74 20 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Naked_Packer_V10_BigBoote
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 FC 0F B6 05 ?? ?? ?? ?? 85 C0 75 31 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9A 00 00 00 A3 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? 01 83 3D ?? ?? ?? ?? 00 75 07 61 FF 25 ?? ?? ?? ?? 61 FF 74 24 04 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? C3 FF 74 24 04 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? C3 }
        $b = { 60 FC 0F B6 05 ?? ?? ?? ?? 85 C0 75 31 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9A 00 00 00 A3 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? 01 83 3D ?? ?? ?? ?? 00 75 07 61 FF 25 ?? ?? ?? ?? 61 FF 74 24 04 6A 00 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Naked_Packer_V10_BigBoote: PEiD
{
    strings:
        $a = { 60 FC 0F B6 05 ?? ?? ?? ?? 85 C0 75 31 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9A 00 00 00 A3 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? 01 83 3D ?? ?? ?? ?? 00 75 07 61 FF 25 ?? ?? ?? ?? 61 FF 74 24 04 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? C3 FF 74 24 04 6A 00 FF 15 ?? ?? ?? ?? 50 FF 15 ?? ?? ?? ?? C3 }
        $b = { 60 FC 0F B6 05 ?? ?? ?? ?? 85 C0 75 31 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9A 00 00 00 A3 ?? ?? ?? ?? C6 05 ?? ?? ?? ?? 01 83 3D ?? ?? ?? ?? 00 75 07 61 FF 25 ?? ?? ?? ?? 61 FF 74 24 04 6A 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: XPack_152_164_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B EC FA 33 C0 8E D0 BC ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule XPack_152_164_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 8B EC FA 33 C0 8E D0 BC ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RLPack_Full_Edition_117_Ap0x_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule RLPack_Full_Edition_117_Ap0x_additional: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Software_Compress_V12_BG_Software_Protect_Technologies_SignByfly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Software_Compress_V12_BG_Software_Protect_Technologies_SignByfly: PEiD
{
    strings:
        $a = { E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 1A 0F 41 00 89 44 24 1C 61 C2 04 00 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Cracked_by_Autohack_2_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 0E 1F B4 09 BA ?? ?? CD 21 FA 8E 06 ?? ?? BE ?? ?? 8B 0E ?? ?? 83 F9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Cracked_by_Autohack_2_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 0E 1F B4 09 BA ?? ?? CD 21 FA 8E 06 ?? ?? BE ?? ?? 8B 0E ?? ?? 83 F9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Free_Pascal_v1010_win32_GUI
Repository: Yara-Rules/rules

Pattern signatures:
$a = { C6 05 ?? ?? ?? 00 00 E8 ?? ?? 00 00 50 E8 00 00 00 00 FF 25 ?? ?? ?? 00 55 89 E5 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Free_Pascal_v1010_win32_GUI: PEiD
{
    strings:
        $a = { C6 05 ?? ?? ?? 00 00 E8 ?? ?? 00 00 50 E8 00 00 00 00 FF 25 ?? ?? ?? 00 55 89 E5 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: fasm_Tomasz_Grysztar
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 53 55 56 8B 74 24 14 85 F6 57 B8 01 00 00 00 }
        $b = { 6A 24 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule fasm_Tomasz_Grysztar: PEiD
{
    strings:
        $a = { 53 55 56 8B 74 24 14 85 F6 57 B8 01 00 00 00 }
        $b = { 6A 24 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: PEtite_v21_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PEtite_v21_additional: PEiD
{
    strings:
        $a = { B8 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_Visual_Studio_NET_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_Visual_Studio_NET_additional: PEiD
{
    strings:
        $a = { FF 25 00 20 40 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: VMProtect_106107_PolyTech
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 60 68 00 00 00 00 8B 74 24 28 BF ?? ?? ?? ?? FC 89 F3 03 34 24 AC 00 D8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule VMProtect_106107_PolyTech: PEiD
{
    strings:
        $a = { 9C 60 68 00 00 00 00 8B 74 24 28 BF ?? ?? ?? ?? FC 89 F3 03 34 24 AC 00 D8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_v021Beta_Sign_by_hot_UNP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE 88 01 ?? ?? AD 8B F8 ?? ?? ?? ?? 33 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_v021Beta_Sign_by_hot_UNP: PEiD
{
    strings:
        $a = { BE 88 01 ?? ?? AD 8B F8 ?? ?? ?? ?? 33 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: VProtector_11X_vcasm_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule VProtector_11X_vcasm_additional: PEiD
{
    strings:
        $a = { EB 0B 5B 56 50 72 6F 74 65 63 74 5D 00 E8 24 00 00 00 8B 44 24 04 8B 00 3D 04 00 00 80 75 08 8B 64 24 08 EB 04 58 EB 0C E9 64 8F 05 00 00 00 00 74 F3 75 F1 EB 24 64 FF 35 00 00 00 00 EB 12 FF 9C 74 03 75 01 E9 81 0C 24 00 01 00 00 9D 90 EB F4 64 89 25 00 00 00 00 EB E6 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 16 00 00 00 8B 5C 24 0C 8B A3 C4 00 00 00 64 8F 05 00 00 00 00 83 C4 04 EB 14 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C9 99 F7 F1 E9 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_Access_Database_file_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 01 00 00 53 74 61 6E 64 61 72 64 20 4A 65 74 20 44 42 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_Access_Database_file_additional: PEiD
{
    strings:
        $a = { 00 01 00 00 53 74 61 6E 64 61 72 64 20 4A 65 74 20 44 42 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_02_PE_Pack_099
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_02_PE_Pack_099: PEiD
{
    strings:
        $a = { 60 E8 11 00 00 00 5D 83 ED 06 80 BD E0 04 90 90 01 0F 84 F2 FF CC 0A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXE2COM_Encrupted_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? B9 ?? ?? BE ?? ?? 8B FE 51 56 B4 ?? AC 32 C4 C0 ?? ?? 02 E1 AA E2 ?? BF ?? ?? 5E 59 F3 A4 BE ?? ?? 56 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXE2COM_Encrupted_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? B9 ?? ?? BE ?? ?? 8B FE 51 56 B4 ?? AC 32 C4 C0 ?? ?? 02 E1 AA E2 ?? BF ?? ?? 5E 59 F3 A4 BE ?? ?? 56 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Thinstall_Embedded_V22X_V2308_Jitit
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 B9 FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Thinstall_Embedded_V22X_V2308_Jitit: PEiD
{
    strings:
        $a = { B8 EF BE AD DE 50 6A 00 FF 15 ?? ?? ?? ?? E9 B9 FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Rec_028
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 06 1E 52 B8 02 30 1E CD 21 86 E0 3D FE 02 73 02 CD 20 0E 1F B4 09 E8 03 00 24 24 EA 5A CD 21 EB 02 D8 88 1F 5A B4 30 CD 21 3C 02 73 02 CD 20 BF 01 02 8B 03 90 2B F7 90 BF 06 07 B9 01 02 FB 1E B8 40 00 8E D8 A1 6C 00 3B 06 6C 00 74 FA 1F 53 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Rec_028: PEiD
{
    strings:
        $a = { 06 1E 52 B8 02 30 1E CD 21 86 E0 3D FE 02 73 02 CD 20 0E 1F B4 09 E8 03 00 24 24 EA 5A CD 21 EB 02 D8 88 1F 5A B4 30 CD 21 3C 02 73 02 CD 20 BF 01 02 8B 03 90 2B F7 90 BF 06 07 B9 01 02 FB 1E B8 40 00 8E D8 A1 6C 00 3B 06 6C 00 74 FA 1F 53 }
    condition:
        $a at pe.entry_point

}