deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Thinstall_Virtualization_Suite_V30X_Thinstall_Company_Sign_by_fly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 BA FE FF FF E9 ?? ?? ?? ?? CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA ?? ?? ?? ?? 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 ?? ?? ?? ?? E8 DF 00 00 00 73 1B 55 BD ?? ?? ?? ?? E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule Thinstall_Virtualization_Suite_V30X_Thinstall_Company_Sign_by_fly: PEiD
{
    strings:
        $a = { 9C 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 BA FE FF FF E9 ?? ?? ?? ?? CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA ?? ?? ?? ?? 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 ?? ?? ?? ?? E8 DF 00 00 00 73 1B 55 BD ?? ?? ?? ?? E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Borland_Pascal_v70_for_Windows_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9A FF FF 00 00 9A FF FF 00 00 55 89 E5 31 C0 9A FF FF 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Borland_Pascal_v70_for_Windows_additional: PEiD
{
    strings:
        $a = { 9A FF FF 00 00 9A FF FF 00 00 55 89 E5 31 C0 9A FF FF 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_Microsoft_Visual_Cpp_60_Debug_Version_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_Microsoft_Visual_Cpp_60_Debug_Version_Anorganix: PEiD
{
    strings:
        $a = { 55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Hyings_PE_Armor_075exe_Hying_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00 ?? ?? 01 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 74 ?? ?? ?? 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Hyings_PE_Armor_075exe_Hying_additional: PEiD
{
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? 00 00 00 00 00 00 ?? ?? 01 00 00 00 00 00 00 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 74 ?? ?? ?? 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PEiD_Bundle_v101_BoB_BobSoft_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 23 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A }

Detection condition:
$a at pe.entry_point

Full rule:
rule PEiD_Bundle_v101_BoB_BobSoft_additional: PEiD
{
    strings:
        $a = { 60 E8 23 02 00 00 8B 44 24 04 52 48 66 31 C0 66 81 38 4D 5A 75 F5 8B 50 3C 81 3C 02 50 45 00 00 75 E9 5A C2 04 00 60 89 DD 89 C3 8B 45 3C 8B 54 28 78 01 EA 52 8B 52 20 01 EA 31 C9 41 8B 34 8A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASPack_10801_Solodovnikov_Alexey
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 75 ?? 90 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASPack_10801_Solodovnikov_Alexey: PEiD
{
    strings:
        $a = { 90 75 ?? 90 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: nbuild_v10_soft
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B9 ?? ?? BB ?? ?? C0 ?? ?? 80 ?? ?? 43 E2 }

Detection condition:
$a at pe.entry_point

Full rule:
rule nbuild_v10_soft: PEiD
{
    strings:
        $a = { B9 ?? ?? BB ?? ?? C0 ?? ?? 80 ?? ?? 43 E2 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: LZEXE_v091_v100a_2_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BF ?? ?? 06 89 F9 0E 41 1F 8C CB 89 FE }

Detection condition:
$a at pe.entry_point

Full rule:
rule LZEXE_v091_v100a_2_Hint_DOS_EP: PEiD
{
    strings:
        $a = { BF ?? ?? 06 89 F9 0E 41 1F 8C CB 89 FE }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: App_Encryptor_Silent_Team_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED 1F 1F 40 00 B9 7B 09 00 00 8D BD 67 1F 40 00 8B F7 AC }

Detection condition:
$a at pe.entry_point

Full rule:
rule App_Encryptor_Silent_Team_additional: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 1F 1F 40 00 B9 7B 09 00 00 8D BD 67 1F 40 00 8B F7 AC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MetaWare_High_C_Run_Time_Library_p_Phar_Lap_DOS_Extender_1983_89_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? 50 B8 ?? ?? 50 CB }

Detection condition:
$a at pe.entry_point

Full rule:
rule MetaWare_High_C_Run_Time_Library_p_Phar_Lap_DOS_Extender_1983_89_additional: PEiD
{
    strings:
        $a = { B8 ?? ?? 50 B8 ?? ?? 50 CB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ACE_SFX_Archive
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 2A 2A 41 43 45 2A 2A }

Detection condition:
$a at pe.entry_point

Full rule:
rule ACE_SFX_Archive: PEiD
{
    strings:
        $a = { 2A 2A 41 43 45 2A 2A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ExeFactor_20_ExeFactor
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 81 EC 7C 0B 00 00 53 56 57 E9 00 8B 01 00 55 53 43 41 54 49 4F 4E 33 82 42 9F 51 87 D5 12 BE 0A E2 A9 1B D3 67 F6 81 4F 2C FB 97 2C 96 22 8C EF 0E 7B B8 BE }

Detection condition:
$a at pe.entry_point

Full rule:
rule ExeFactor_20_ExeFactor: PEiD
{
    strings:
        $a = { 55 8B EC 81 EC 7C 0B 00 00 53 56 57 E9 00 8B 01 00 55 53 43 41 54 49 4F 4E 33 82 42 9F 51 87 D5 12 BE 0A E2 A9 1B D3 67 F6 81 4F 2C FB 97 2C 96 22 8C EF 0E 7B B8 BE }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_MEW_11_SE_10
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_MEW_11_SE_10: PEiD
{
    strings:
        $a = { E9 09 00 00 00 00 00 00 02 00 00 00 0C 90 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_v01x_v02x_Dwing_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE 88 01 ?? ?? AD 8B F8 95 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_v01x_v02x_Dwing_additional: PEiD
{
    strings:
        $a = { BE 88 01 ?? ?? AD 8B F8 95 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Celsius_Crypt_21_Z3r0_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Celsius_Crypt_21_Z3r0_additional: PEiD
{
    strings:
        $a = { 55 89 E5 83 EC 28 8B 45 10 89 04 24 E8 3F 14 01 00 48 89 45 FC 8B 45 0C 48 89 45 F4 8D 45 F4 89 44 24 04 8D 45 FC 89 04 24 E8 12 A3 03 00 8B 00 89 45 F8 8B 45 FC 89 45 F0 C6 45 EF 01 C7 45 E8 00 00 00 00 8B 45 E8 3B 45 F8 73 39 80 7D EF 00 74 33 8B 45 F0 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PEtite_v13_Ian_Luck
Repository: Yara-Rules/rules

Pattern signatures:
$a = { ?? ?? ?? ?? ?? 66 9C 60 50 8D 88 00 F0 00 00 8D 90 04 16 00 00 8B DC 8B E1 68 ?? ?? ?? ?? 53 50 80 04 24 08 50 80 04 24 42 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PEtite_v13_Ian_Luck: PEiD
{
    strings:
        $a = { ?? ?? ?? ?? ?? 66 9C 60 50 8D 88 00 F0 00 00 8D 90 04 16 00 00 8B DC 8B E1 68 ?? ?? ?? ?? 53 50 80 04 24 08 50 80 04 24 42 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: LOCK98_V10028_keenvim_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 E8 00 00 00 00 5D 81 ?? ?? ?? ?? ?? EB 05 E9 ?? ?? ?? ?? EB 08 }

Detection condition:
$a at pe.entry_point

Full rule:
rule LOCK98_V10028_keenvim_additional: PEiD
{
    strings:
        $a = { 55 E8 00 00 00 00 5D 81 ?? ?? ?? ?? ?? EB 05 E9 ?? ?? ?? ?? EB 08 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: eXPressorFullSupport_V1601_CGSoftLabsnbsp_nbsp_SignByfly_20080308
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 81 EC 74 02 00 00 53 56 57 83 A5 C8 FD FF FF 00 F3 EB 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 74 5C 83 7D 0C 01 75 2A 8B 45 08 A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 75 19 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 7D 0C 00 75 0E 83 3D ?? ?? ?? ?? ?? 74 05 E9 F4 0A 00 00 83 3D ?? ?? ?? ?? ?? 74 05 E9 BB 09 00 00 C7 05 ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 78 60 00 75 1C 6A 10 6A 00 E8 E8 19 00 00 59 50 6A 01 E8 DF 19 00 00 59 50 6A 00 FF 15 ?? ?? ?? ?? E8 27 FF FF FF A3 ?? ?? ?? ?? 6A 04 68 00 10 00 00 68 80 00 00 00 6A 00 FF 15 ?? ?? ?? ?? 89 85 E8 FD FF FF 68 04 01 00 00 8D 85 F0 FD FF FF 50 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 84 05 EF FD FF FF 89 85 D4 FD FF FF 8B 85 D4 FD FF FF 0F BE 00 83 F8 5C 74 0F 8B 85 D4 FD FF FF 48 89 85 D4 FD FF FF EB E3 8B 85 D4 FD FF FF 40 89 85 D4 FD FF FF 8B 85 D4 FD FF FF 8D 8D F0 FD FF FF 2B C1 89 85 AC FD FF 

Detection condition:
$a at pe.entry_point

Full rule:
rule eXPressorFullSupport_V1601_CGSoftLabsnbsp_nbsp_SignByfly_20080308: PEiD
{
    strings:
        $a = { 55 8B EC 81 EC 74 02 00 00 53 56 57 83 A5 C8 FD FF FF 00 F3 EB 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 74 5C 83 7D 0C 01 75 2A 8B 45 08 A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 75 19 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF ?? ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 7D 0C 00 75 0E 83 3D ?? ?? ?? ?? ?? 74 05 E9 F4 0A 00 00 83 3D ?? ?? ?? ?? ?? 74 05 E9 BB 09 00 00 C7 05 ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 78 60 00 75 1C 6A 10 6A 00 E8 E8 19 00 00 59 50 6A 01 E8 DF 19 00 00 59 50 6A 00 FF 15 ?? ?? ?? ?? E8 27 FF FF FF A3 ?? ?? ?? ?? 6A 04 68 00 10 00 00 68 80 00 00 00 6A 00 FF 15 ?? ?? ?? ?? 89 85 E8 FD FF FF 68 04 01 00 00 8D 85 F0 FD FF FF 50 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 84 05 EF FD FF FF 89 85 D4 FD FF FF 8B 85 D4 FD FF FF 0F BE 00 83 F8 5C 74 0F 8B 85 D4 FD FF FF 48 89 85 D4 FD FF FF EB E3 8B 85 D4 FD FF FF 40 89 85 D4 FD FF FF 8B 85 D4 FD FF FF 8D 8D F0 FD FF FF 2B C1 89 85 AC FD FF FF 8B 8D AC FD FF FF 8D B5 F0 FD FF FF 8D BD FC FE FF FF 8B C1 C1 E9 02 F3 A5 8B C8 83 E1 03 F3 A4 8B 85 AC FD FF FF 80 A4 05 FD FE FF FF 00 83 A5 D8 FD FF FF 00 A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 75 11 A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 74 43 E8 11 0C 00 00 89 85 D8 FD FF FF A1 ?? ?? ?? ?? 8B 40 04 25 ?? ?? ?? ?? 85 C0 74 27 83 BD D8 FD FF FF 00 74 1E 6A 10 FF B5 D4 FD FF FF 6A 18 E8 C3 18 00 00 59 50 6A 00 FF 15 ?? ?? ?? ?? E9 8F 09 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_420_Silicon_Realms_Toolworks
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 F8 8E 4C 00 68 F0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 84 A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 80 A5 4C 00 C1 E1 08 03 CA 89 0D 7C A5 4C 00 C1 E8 10 A3 78 A5 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_420_Silicon_Realms_Toolworks: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 F8 8E 4C 00 68 F0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 84 A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 80 A5 4C 00 C1 E1 08 03 CA 89 0D 7C A5 4C 00 C1 E8 10 A3 78 A5 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASProtect_123_RC4_build_0807_exe_Alexey_Solodovnikov_h_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASProtect_123_RC4_build_0807_exe_Alexey_Solodovnikov_h_additional: PEiD
{
    strings:
        $a = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB ?? ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Borland_Cpp_for_Win32_1994
Repository: Yara-Rules/rules

Pattern signatures:
$a = { A1 C1 A3 57 51 33 C0 BF B9 3B CF }
        $b = { A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 83 ?? ?? ?? ?? 75 ?? 57 51 33 C0 BF }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Borland_Cpp_for_Win32_1994: PEiD
{
    strings:
        $a = { A1 C1 A3 57 51 33 C0 BF B9 3B CF }
        $b = { A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 83 ?? ?? ?? ?? 75 ?? 57 51 33 C0 BF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Borland_Cpp_for_Win32_1995
Repository: Yara-Rules/rules

Pattern signatures:
$a = { A1 C1 A3 83 75 80 }
        $b = { A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 57 51 33 C0 BF ?? ?? ?? ?? B9 ?? ?? ?? ?? 3B CF 76 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Borland_Cpp_for_Win32_1995: PEiD
{
    strings:
        $a = { A1 C1 A3 83 75 80 }
        $b = { A1 ?? ?? ?? ?? C1 ?? ?? A3 ?? ?? ?? ?? 57 51 33 C0 BF ?? ?? ?? ?? B9 ?? ?? ?? ?? 3B CF 76 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: ActiveMARKTM
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 84 ?? 00 00 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 88 ?? 00 00 61 E9 ?? ?? ?? FF }
        $b = { 79 11 7F AB 9A 4A 83 B5 C9 6B 1A 48 F9 27 B4 25 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule ActiveMARKTM: PEiD
{
    strings:
        $a = { 79 07 0F B7 07 47 50 47 B9 57 48 F2 AE 55 FF 96 84 ?? 00 00 09 C0 74 07 89 03 83 C3 04 EB D8 FF 96 88 ?? 00 00 61 E9 ?? ?? ?? FF }
        $b = { 79 11 7F AB 9A 4A 83 B5 C9 6B 1A 48 F9 27 B4 25 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: CrypteXeC_09
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B EC FA C7 46 F7 40 07 42 81 FA BD F3 75 F9 FF 66 F7 08 42 BE 27 1F 5B CC C2 C5 74 4B A3 A3 DB 93 1F C9 A6 C9 3A 7A 27 9F 38 F1 99 67 22 85 50 55 9C 23 39 77 85 94 34 E5 18 F9 06 A3 3E FA C4 3A 69 04 E8 09 AC 5F 97 EE D8 BE DA 05 00 06 99 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CrypteXeC_09: PEiD
{
    strings:
        $a = { 8B EC FA C7 46 F7 40 07 42 81 FA BD F3 75 F9 FF 66 F7 08 42 BE 27 1F 5B CC C2 C5 74 4B A3 A3 DB 93 1F C9 A6 C9 3A 7A 27 9F 38 F1 99 67 22 85 50 55 9C 23 39 77 85 94 34 E5 18 F9 06 A3 3E FA C4 3A 69 04 E8 09 AC 5F 97 EE D8 BE DA 05 00 06 99 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: DrHalo_or_DrGenius_Image_Graphics_format
Repository: Yara-Rules/rules

Pattern signatures:
$a = { ?? ?? 3A 03 00 00 }
        $b = { 3A 03 00 00 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule DrHalo_or_DrGenius_Image_Graphics_format: PEiD
{
    strings:
        $a = { ?? ?? 3A 03 00 00 }
        $b = { 3A 03 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: bambam_V004_bedrock_Sign_by_fly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BF ?? ?? ?? ?? 83 C9 FF 33 C0 68 ?? ?? ?? ?? F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 11 0A 00 00 83 C4 0C 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 BF ?? ?? ?? ?? 8B D1 68 ?? ?? ?? ?? C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 C0 09 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule bambam_V004_bedrock_Sign_by_fly: PEiD
{
    strings:
        $a = { BF ?? ?? ?? ?? 83 C9 FF 33 C0 68 ?? ?? ?? ?? F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 11 0A 00 00 83 C4 0C 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B F0 BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 BF ?? ?? ?? ?? 8B D1 68 ?? ?? ?? ?? C1 E9 02 F3 AB 8B CA 83 E1 03 F3 AA BF ?? ?? ?? ?? 83 C9 FF 33 C0 F2 AE F7 D1 49 51 68 ?? ?? ?? ?? E8 C0 09 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Borland_Cpp_for_Win32_1999
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B }
        $b = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Borland_Cpp_for_Win32_1999: PEiD
{
    strings:
        $a = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B }
        $b = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Crinkler_V01_V02_Rune_LHStubbe_and_Aske_Simon_Christensen_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 EF BE AD DE 50 6A ?? FF 15 10 19 40 ?? E9 AD FF FF FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule Crinkler_V01_V02_Rune_LHStubbe_and_Aske_Simon_Christensen_additional: PEiD
{
    strings:
        $a = { B8 EF BE AD DE 50 6A ?? FF 15 10 19 40 ?? E9 AD FF FF FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_Patch
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 81 3A 00 00 00 02 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_Patch: PEiD
{
    strings:
        $a = { 81 3A 00 00 00 02 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_Armadillo_300_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_Armadillo_300_Anorganix: PEiD
{
    strings:
        $a = { 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: HQR_data_file_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 48 00 00 00 ?? 02 00 00 ?? ?? 00 00 ?? ?? 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule HQR_data_file_Hint_FILE_START: PEiD
{
    strings:
        $a = { 48 00 00 00 ?? 02 00 00 ?? ?? 00 00 ?? ?? 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ACProtect_V20_risco
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? C3 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ACProtect_V20_risco: PEiD
{
    strings:
        $a = { 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? C3 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: XPack_097_098_EXE_JoKo
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 ?? ?? ?? ?? 9C 60 E8 2D 06 00 00 34 ?? 01 00 00 00 00 00 00 00 00 00 44 ?? 01 00 34 ?? 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 ?? 01 00 62 ?? 01 00 71 ?? 01 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule XPack_097_098_EXE_JoKo: PEiD
{
    strings:
        $a = { 68 ?? ?? ?? ?? 9C 60 E8 2D 06 00 00 34 ?? 01 00 00 00 00 00 00 00 00 00 44 ?? 01 00 34 ?? 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 ?? 01 00 62 ?? 01 00 71 ?? 01 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Loader_for_Dos_Extender_by_Doug_Hoffmann
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 0E 1F 8C C6 B4 4A 50 BB FF FF CD 21 73 C1 58 CD 21 72 BC 03 DE 8B EB B8 21 35 CD 21 06 53 56 B8 87 16 CD 2F 0B C0 75 C9 B8 00 16 CD 2F A8 7F 75 07 E8 51 00 66 C1 CD 10 B8 87 16 CD 2F 80 F9 03 0F 82 16 00 55 68 C0 00 66 5D 80 E3 01 74 9D 66 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Loader_for_Dos_Extender_by_Doug_Hoffmann: PEiD
{
    strings:
        $a = { 0E 1F 8C C6 B4 4A 50 BB FF FF CD 21 73 C1 58 CD 21 72 BC 03 DE 8B EB B8 21 35 CD 21 06 53 56 B8 87 16 CD 2F 0B C0 75 C9 B8 00 16 CD 2F A8 7F 75 07 E8 51 00 66 C1 CD 10 B8 87 16 CD 2F 80 F9 03 0F 82 16 00 55 68 C0 00 66 5D 80 E3 01 74 9D 66 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPX_090_101_EXE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B9 00 00 BE 00 00 89 F7 1E A9 B5 80 8C C8 05 05 00 8E D8 05 00 00 8E C0 FD F3 A5 FC 2E 80 6C 12 10 73 E7 92 AF AD 0E 0E 0E 06 1F 07 16 BD 00 00 BB 00 80 55 CB 55 50 58 21 0B 03 03 07 }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPX_090_101_EXE: PEiD
{
    strings:
        $a = { B9 00 00 BE 00 00 89 F7 1E A9 B5 80 8C C8 05 05 00 8E D8 05 00 00 8E C0 FD F3 A5 FC 2E 80 6C 12 10 73 E7 92 AF AD 0E 0E 0E 06 1F 07 16 BD 00 00 BB 00 80 55 CB 55 50 58 21 0B 03 03 07 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EPW_130_EXE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 06 57 1E 56 55 52 51 53 50 2E 8C 06 08 00 8C C0 83 C0 10 2E A3 0A 00 8E D8 A1 08 00 2E 03 06 0A 00 2E A3 0C 00 A1 0E 00 2E 03 06 0A 00 2E A3 06 00 A1 10 00 2E A3 04 00 A1 14 00 2E A3 00 00 A1 16 00 2E 03 06 0A 00 2E A3 02 00 0E 1F BA 30 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EPW_130_EXE: PEiD
{
    strings:
        $a = { 06 57 1E 56 55 52 51 53 50 2E 8C 06 08 00 8C C0 83 C0 10 2E A3 0A 00 8E D8 A1 08 00 2E 03 06 0A 00 2E A3 0C 00 A1 0E 00 2E 03 06 0A 00 2E A3 06 00 A1 10 00 2E A3 04 00 A1 14 00 2E A3 00 00 A1 16 00 2E 03 06 0A 00 2E A3 02 00 0E 1F BA 30 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_430_440_Silicon_Realms_Toolworks
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 40 ?? ?? 00 68 80 ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 ?? ?? 00 33 D2 8A D4 89 15 30 ?? ?? 00 8B C8 81 E1 FF 00 00 00 89 0D 2C ?? ?? 00 C1 E1 08 03 CA 89 0D 28 ?? ?? 00 C1 E8 10 A3 24 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_430_440_Silicon_Realms_Toolworks: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 40 ?? ?? 00 68 80 ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 ?? ?? 00 33 D2 8A D4 89 15 30 ?? ?? 00 8B C8 81 E1 FF 00 00 00 89 0D 2C ?? ?? 00 C1 E1 08 03 CA 89 0D 28 ?? ?? 00 C1 E8 10 A3 24 }
    condition:
        $a at pe.entry_point

}