deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Borland_Delphi_30_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Borland_Delphi_30_additional: PEiD
{
    strings:
        $a = { 55 8B EC 83 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXECryptor_v151x_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXECryptor_v151x_additional: PEiD
{
    strings:
        $a = { E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: DrHalo_or_DrGenius_Image_Graphics_format_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 3A 03 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule DrHalo_or_DrGenius_Image_Graphics_format_Hint_FILE_START: PEiD
{
    strings:
        $a = { 3A 03 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Turbo_C_1987_or_Borland_Cpp_1991
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FB BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Turbo_C_1987_or_Borland_Cpp_1991: PEiD
{
    strings:
        $a = { FB BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RLPack_116_LZMA_compression_ap0x
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 EB 09 00 00 89 85 3A 0A 00 00 EB 14 60 FF B5 3A 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 08 83 3C 37 00 75 E6 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85 56 0A 00 00 5B 60 FF B5 3A 0A 00 00 56 FF B5 56 0A 00 00 FF D3 61 8B B5 56 0A 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 E8 E7 00 00 00 83 C0 04 89 85 52 0A 00 00 E9 97 00 00 00 56 FF 95 E3 09 00 00 89 85 4E 0A 00 00 85 C0 0F 84 C2 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RLPack_116_LZMA_compression_ap0x: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 5A 0A 00 00 8D 9D 40 02 00 00 33 FF E8 83 01 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 EB 09 00 00 89 85 3A 0A 00 00 EB 14 60 FF B5 3A 0A 00 00 FF 34 37 FF 74 37 04 FF D3 61 83 C7 08 83 3C 37 00 75 E6 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 EB 09 00 00 89 85 56 0A 00 00 5B 60 FF B5 3A 0A 00 00 56 FF B5 56 0A 00 00 FF D3 61 8B B5 56 0A 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 E8 E7 00 00 00 83 C0 04 89 85 52 0A 00 00 E9 97 00 00 00 56 FF 95 E3 09 00 00 89 85 4E 0A 00 00 85 C0 0F 84 C2 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASPack_v100b_Alexey_Solodovnikov
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 ?? ?? ?? ?? 5D 81 ED 92 1A 44 ?? B8 8C 1A 44 ?? 03 C5 2B 85 CD 1D 44 ?? 89 85 D9 1D 44 ?? 80 BD C4 1D 44 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASPack_v100b_Alexey_Solodovnikov: PEiD
{
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED 92 1A 44 ?? B8 8C 1A 44 ?? 03 C5 2B 85 CD 1D 44 ?? 89 85 D9 1D 44 ?? 80 BD C4 1D 44 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: nSpack_V2x_LiuXingPing_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 }

Detection condition:
$a at pe.entry_point

Full rule:
rule nSpack_V2x_LiuXingPing_additional: PEiD
{
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Predator2448_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 0E 1F BF ?? ?? B8 ?? ?? B9 ?? ?? 49 ?? ?? ?? ?? 2A C1 4F 4F ?? ?? F9 CC }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Predator2448_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 0E 1F BF ?? ?? B8 ?? ?? B9 ?? ?? 49 ?? ?? ?? ?? 2A C1 4F 4F ?? ?? F9 CC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_02_FSG_131_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_02_FSG_131_Anorganix: PEiD
{
    strings:
        $a = { BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AinEXE_223
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 0E 07 B9 14 00 BE 00 01 33 FF FC F3 A4 A1 02 00 2D E1 0B 8E D0 BC 00 BE 8C D8 36 A3 00 BE 05 10 00 36 A3 02 BE 2E A1 0E 00 8A D4 B1 04 D2 EA D3 E0 8C D3 36 8B 2E 02 BE 2E 03 2E 0E 00 FD FE CA 78 17 81 ED 00 10 80 EF 10 8E DD 8E C3 BE FE FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule AinEXE_223: PEiD
{
    strings:
        $a = { 0E 07 B9 14 00 BE 00 01 33 FF FC F3 A4 A1 02 00 2D E1 0B 8E D0 BC 00 BE 8C D8 36 A3 00 BE 05 10 00 36 A3 02 BE 2E A1 0E 00 8A D4 B1 04 D2 EA D3 E0 8C D3 36 8B 2E 02 BE 2E 03 2E 0E 00 FD FE CA 78 17 81 ED 00 10 80 EF 10 8E DD 8E C3 BE FE FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_Upack_030_032_beta_Dwing
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 1C 2B C7 AB E2 E5 8B 5E 34 8B 76 38 46 AD ?? C0 0F 84 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_Upack_030_032_beta_Dwing: PEiD
{
    strings:
        $a = { 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F1 B0 00 0F C8 03 46 1C 2B C7 AB E2 E5 8B 5E 34 8B 76 38 46 AD ?? C0 0F 84 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Wicat_GED_Graphics_format
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 0D 00 40 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Wicat_GED_Graphics_format: PEiD
{
    strings:
        $a = { 0D 00 40 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Special_EXE_Password_Protector_v10
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Special_EXE_Password_Protector_v10: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_02_CrunchPE_Heuristic_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_02_CrunchPE_Heuristic_Anorganix: PEiD
{
    strings:
        $a = { 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FASM_v13x
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? 6E ?? ?? 55 89 E5 8B 7D 0C 8B 75 08 89 F8 8B 5D 10 }
        $b = { 6A ?? FF 15 ?? ?? ?? ?? A3 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule FASM_v13x: PEiD
{
    strings:
        $a = { E8 ?? 6E ?? ?? 55 89 E5 8B 7D 0C 8B 75 08 89 F8 8B 5D 10 }
        $b = { 6A ?? FF 15 ?? ?? ?? ?? A3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Vx_GRUNT4Family
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 1C 00 8D 9E 41 01 40 3E 8B 96 14 03 B9 EA 00 87 DB F7 D0 31 17 83 C3 02 E2 F7 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_GRUNT4Family: PEiD
{
    strings:
        $a = { E8 1C 00 8D 9E 41 01 40 3E 8B 96 14 03 B9 EA 00 87 DB F7 D0 31 17 83 C3 02 E2 F7 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_01_ACProtect_109_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 90 90 90 EB 06 00 00 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_01_ACProtect_109_Anorganix: PEiD
{
    strings:
        $a = { 60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 90 90 90 EB 06 00 00 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Nullsoft_Install_System_v20_RC2
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 }
        $b = { 83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 68 68 92 40 00 56 FF D3 E8 6A FF FF FF 85 C0 0F 84 59 01 00 00 BE 20 E4 42 00 56 FF 15 68 70 40 00 68 5C 92 40 00 56 E8 B9 28 00 00 57 FF 15 BC 70 40 00 BE 00 40 43 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 40 43 00 22 A3 20 EC 42 00 8B C6 75 0A C6 44 24 13 22 B8 01 40 43 00 8B 3D 18 72 40 00 EB 09 3A 4C 24 13 74 09 50 FF D7 8A 08 84 C9 75 F1 50 FF D7 8B F0 89 74 24 1C EB 05 56 FF D7 8B F0 80 3E 20 74 F6 80 3E 2F 75 44 46 80 3E 53 75 0C 8A 46 0

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Nullsoft_Install_System_v20_RC2: PEiD
{
    strings:
        $a = { 83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 }
        $b = { 83 EC 10 53 55 56 57 C7 44 24 14 70 92 40 00 33 ED C6 44 24 13 20 FF 15 2C 70 40 00 55 FF 15 84 72 40 00 BE 00 54 43 00 BF 00 04 00 00 56 57 A3 A8 EC 42 00 FF 15 C4 70 40 00 E8 8D FF FF FF 8B 1D 90 70 40 00 85 C0 75 21 68 FB 03 00 00 56 FF 15 5C 71 40 00 68 68 92 40 00 56 FF D3 E8 6A FF FF FF 85 C0 0F 84 59 01 00 00 BE 20 E4 42 00 56 FF 15 68 70 40 00 68 5C 92 40 00 56 E8 B9 28 00 00 57 FF 15 BC 70 40 00 BE 00 40 43 00 50 56 FF 15 B8 70 40 00 6A 00 FF 15 44 71 40 00 80 3D 00 40 43 00 22 A3 20 EC 42 00 8B C6 75 0A C6 44 24 13 22 B8 01 40 43 00 8B 3D 18 72 40 00 EB 09 3A 4C 24 13 74 09 50 FF D7 8A 08 84 C9 75 F1 50 FF D7 8B F0 89 74 24 1C EB 05 56 FF D7 8B F0 80 3E 20 74 F6 80 3E 2F 75 44 46 80 3E 53 75 0C 8A 46 01 0C 20 3C 20 75 03 83 CD 02 81 3E 4E 43 52 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: XPack_139_EXE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 2E C7 06 01 01 00 00 8B EC EB 01 E8 2E C6 06 0E 05 FA EB 00 9A BC 1C 05 2E C6 06 1A 05 C3 EB 00 9A 90 42 05 06 09 95 19 99 26 03 62 F7 03 74 05 8F 05 1A 06 50 06 E2 00 64 06 CF 00 4C 06 AC 00 4F 06 AA 00 43 06 FC 00 33 E4 8E D4 83 C4 10 2E }

Detection condition:
$a at pe.entry_point

Full rule:
rule XPack_139_EXE: PEiD
{
    strings:
        $a = { 2E C7 06 01 01 00 00 8B EC EB 01 E8 2E C6 06 0E 05 FA EB 00 9A BC 1C 05 2E C6 06 1A 05 C3 EB 00 9A 90 42 05 06 09 95 19 99 26 03 62 F7 03 74 05 8F 05 1A 06 50 06 E2 00 64 06 CF 00 4C 06 AC 00 4F 06 AA 00 43 06 FC 00 33 E4 8E D4 83 C4 10 2E }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SDProtector_BasicPro_Edition_110_Randy_Li
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64 }

Detection condition:
$a at pe.entry_point

Full rule:
rule SDProtector_BasicPro_Edition_110_Randy_Li: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 50 83 EC 08 64 A1 00 00 00 00 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 83 C4 08 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 64 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PackerPetite_v22_Compresor_wwwun4seencompetite
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 00 ?0 ?? 00 6? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PackerPetite_v22_Compresor_wwwun4seencompetite: PEiD
{
    strings:
        $a = { B8 00 ?0 ?? 00 6? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RLPack_V112_V114_aPlib_043_ap0x_Sign_by_fly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF EB 0F FF ?? ?? ?? FF ?? ?? ?? D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule RLPack_V112_V114_aPlib_043_ap0x_Sign_by_fly: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF EB 0F FF ?? ?? ?? FF ?? ?? ?? D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPX_081_083_EXE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B9 00 00 BE 00 00 89 F7 1E A9 B5 80 8C C8 05 05 00 8E D8 05 00 00 8E C0 FD F3 A5 FC 2E 80 6C 12 10 73 E7 92 AF AD 0E 0E 0E 06 1F 07 16 BD 00 00 BB 00 80 55 CB 55 50 58 21 0A 03 03 07 }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPX_081_083_EXE: PEiD
{
    strings:
        $a = { B9 00 00 BE 00 00 89 F7 1E A9 B5 80 8C C8 05 05 00 8E D8 05 00 00 8E C0 FD F3 A5 FC 2E 80 6C 12 10 73 E7 92 AF AD 0E 0E 0E 06 1F 07 16 BD 00 00 BB 00 80 55 CB 55 50 58 21 0A 03 03 07 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_02_Watcom_CCpp_DLL_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87 01 00 00 00 F1 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_02_Watcom_CCpp_DLL_Anorganix: PEiD
{
    strings:
        $a = { 53 56 57 55 8B 74 24 14 8B 7C 24 18 8B 6C 24 1C 83 FF 03 0F 87 01 00 00 00 F1 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SGI_Image_Graphics_format_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 01 DA 00 01 00 03 }

Detection condition:
$a at pe.entry_point

Full rule:
rule SGI_Image_Graphics_format_Hint_FILE_START: PEiD
{
    strings:
        $a = { 01 DA 00 01 00 03 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: eXPressor_V1451_CGSoftLabs
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D }

Detection condition:
$a at pe.entry_point

Full rule:
rule eXPressor_V1451_CGSoftLabs: PEiD
{
    strings:
        $a = { 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Dev_Cue_4992_Bloodshed_Software
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D }

Detection condition:
$a at pe.entry_point

Full rule:
rule Dev_Cue_4992_Bloodshed_Software: PEiD
{
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Dev_Cpp_v4_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 83 EC 08 83 C4 F4 6A ?? A1 ?? ?? ?? 00 FF D0 E8 ?? FF FF FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule Dev_Cpp_v4_additional: PEiD
{
    strings:
        $a = { 55 89 E5 83 EC 08 83 C4 F4 6A ?? A1 ?? ?? ?? 00 FF D0 E8 ?? FF FF FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Petite_14_c1998_99_Ian_Luck_h_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC }

Detection condition:
$a at pe.entry_point

Full rule:
rule Petite_14_c1998_99_Ian_Luck_h_additional: PEiD
{
    strings:
        $a = { 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_Visual_Basic_v50v60_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 00 00 00 00 00 00 30 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_Visual_Basic_v50v60_additional: PEiD
{
    strings:
        $a = { 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 00 00 00 00 00 00 30 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Gotcha879_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? 5B 81 EB ?? ?? 9C FC 2E ?? ?? ?? ?? ?? ?? ?? 8C D8 05 ?? ?? 2E ?? ?? ?? ?? 50 2E ?? ?? ?? ?? ?? ?? 8B C3 05 ?? ?? 8B F0 BF 00 01 B9 20 00 F3 A4 0E B8 00 01 50 B8 DA DA CD 21 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Gotcha879_additional: PEiD
{
    strings:
        $a = { E8 ?? ?? 5B 81 EB ?? ?? 9C FC 2E ?? ?? ?? ?? ?? ?? ?? 8C D8 05 ?? ?? 2E ?? ?? ?? ?? 50 2E ?? ?? ?? ?? ?? ?? 8B C3 05 ?? ?? 8B F0 BF 00 01 B9 20 00 F3 A4 0E B8 00 01 50 B8 DA DA CD 21 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Obsidium_V12X_Obsidium_Software_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 0E 00 00 00 33 C0 8B 54 24 0C 83 82 B8 00 00 00 0D C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsidium_V12X_Obsidium_Software_additional: PEiD
{
    strings:
        $a = { E8 0E 00 00 00 33 C0 8B 54 24 0C 83 82 B8 00 00 00 0D C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vcasm_Protector_10_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vcasm_Protector_10_additional: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 FF 35 E8 07 00 00 00 C7 83 83 C0 13 EB 0B 58 EB 02 CD 20 83 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MS_FORTRAN_Library_19
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC B8 ?? ?? 8E C0 26 C7 ?? ?? ?? ?? ?? 26 }
        $b = { FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC 8C DB 8E C3 BB ?? ?? 9A ?? ?? ?? ?? 9B DB E3 9B D9 2E ?? ?? 33 C9 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule MS_FORTRAN_Library_19: PEiD
{
    strings:
        $a = { FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC B8 ?? ?? 8E C0 26 C7 ?? ?? ?? ?? ?? 26 }
        $b = { FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC 8C DB 8E C3 BB ?? ?? 9A ?? ?? ?? ?? 9B DB E3 9B D9 2E ?? ?? 33 C9 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: CRYPT_Version_17_c_Dismember_COM_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 0E 17 9C 58 F6 C4 01 ?? ?? ?? ?? ?? B4 01 BE ?? ?? BF ?? ?? B9 ?? ?? 68 ?? ?? 68 ?? ?? 68 ?? ?? 57 F3 A4 C3 B0 02 E6 21 60 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CRYPT_Version_17_c_Dismember_COM_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 0E 17 9C 58 F6 C4 01 ?? ?? ?? ?? ?? B4 01 BE ?? ?? BF ?? ?? B9 ?? ?? 68 ?? ?? 68 ?? ?? 68 ?? ?? 57 F3 A4 C3 B0 02 E6 21 60 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AverCryptor_102_beta_os1r1s_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED 0C 17 40 00 8B BD 33 18 40 00 8B 8D 3B 18 40 00 B8 51 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 37 18 40 00 33 C0 51 33 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 37 18 40 00 8B 85 3F }

Detection condition:
$a at pe.entry_point

Full rule:
rule AverCryptor_102_beta_os1r1s_additional: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 0C 17 40 00 8B BD 33 18 40 00 8B 8D 3B 18 40 00 B8 51 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 37 18 40 00 33 C0 51 33 C9 66 B9 F7 00 66 83 F9 00 74 49 8B 57 0C 03 95 37 18 40 00 8B 85 3F }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Xtreme_Protector_107_Rafael_Ahucha_Sergio_Lara
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? ?? 00 B9 8E ?? ?? 00 50 51 E8 1E 00 00 00 E8 00 00 00 00 58 2D 16 00 00 00 B9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Xtreme_Protector_107_Rafael_Ahucha_Sergio_Lara: PEiD
{
    strings:
        $a = { B8 ?? ?? ?? 00 B9 8E ?? ?? 00 50 51 E8 1E 00 00 00 E8 00 00 00 00 58 2D 16 00 00 00 B9 }
    condition:
        $a at pe.entry_point

}