deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Obsidium_V130X_Obsidium_Software
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B ?? ?? ?? EB 04 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsidium_V130X_Obsidium_Software: PEiD
{
    strings:
        $a = { EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B ?? ?? ?? EB 04 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Special_EXE_Pasword_Protector_V101_Pavol_Cerven
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E }

Detection condition:
$a at pe.entry_point

Full rule:
rule Special_EXE_Pasword_Protector_V101_Pavol_Cerven: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: File_Analyzer_Registration_file_v11_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 24 46 41 52 45 47 24 45 4E 43 3D ?? 26 26 52 45 47 3D ?? 26 26 45 58 50 3D }

Detection condition:
$a at pe.entry_point

Full rule:
rule File_Analyzer_Registration_file_v11_Hint_FILE_START: PEiD
{
    strings:
        $a = { 24 46 41 52 45 47 24 45 4E 43 3D ?? 26 26 52 45 47 3D ?? 26 26 45 58 50 3D }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_50_Dll_Silicon_Realms_Toolworks_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE FF FF 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 E5 24 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 8F 15 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 20 15 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 D7 23 00 00 59 89 7D FC FF 75 08 E8 EC 53 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 2B C5 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 19 ED FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 7D 22 00 00 59 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_50_Dll_Silicon_Realms_Toolworks_additional: PEiD
{
    strings:
        $a = { 83 7C 24 08 01 75 05 E8 DE 4B 00 00 FF 74 24 04 8B 4C 24 10 8B 54 24 0C E8 ED FE FF FF 59 C2 0C 00 6A 0C 68 ?? ?? ?? ?? E8 E5 24 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 8F 15 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 20 15 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 D7 23 00 00 59 89 7D FC FF 75 08 E8 EC 53 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 2B C5 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 19 ED FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 7D 22 00 00 59 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Visual_Protect_11
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 51 53 56 57 83 25 6C 00 00 00 00 68 5C 00 00 00 FF 15 00 00 00 00 A3 BC 00 00 00 68 48 00 00 00 FF 35 BC 00 00 00 FF 15 04 00 00 00 A3 50 00 00 00 6A 00 FF 15 50 00 00 00 A3 A0 00 00 00 FF 35 A0 00 00 00 E8 42 04 00 00 59 89 45 FC }

Detection condition:
$a at pe.entry_point

Full rule:
rule Visual_Protect_11: PEiD
{
    strings:
        $a = { 55 8B EC 51 53 56 57 83 25 6C 00 00 00 00 68 5C 00 00 00 FF 15 00 00 00 00 A3 BC 00 00 00 68 48 00 00 00 FF 35 BC 00 00 00 FF 15 04 00 00 00 A3 50 00 00 00 6A 00 FF 15 50 00 00 00 A3 A0 00 00 00 FF 35 A0 00 00 00 E8 42 04 00 00 59 89 45 FC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Encapsulated_Postscript_graphics_file_v20_EPSF_12_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 25 21 50 53 2D 41 64 6F 62 65 2D 32 2E 30 20 45 50 53 46 2D 31 2E 32 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Encapsulated_Postscript_graphics_file_v20_EPSF_12_Hint_FILE_START: PEiD
{
    strings:
        $a = { 25 21 50 53 2D 41 64 6F 62 65 2D 32 2E 30 20 45 50 53 46 2D 31 2E 32 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_Visual_C_v20
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 56 57 BF 8B 3B F7 }
        $b = { 53 56 57 BB ?? ?? ?? ?? 8B ?? ?? ?? 55 3B FB 75 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Microsoft_Visual_C_v20: PEiD
{
    strings:
        $a = { 55 8B EC 56 57 BF 8B 3B F7 }
        $b = { 53 56 57 BB ?? ?? ?? ?? 8B ?? ?? ?? 55 3B FB 75 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: CubiComp_PictureMaker_graphics_format_red
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 16 0C FF 02 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CubiComp_PictureMaker_graphics_format_red: PEiD
{
    strings:
        $a = { 16 0C FF 02 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Soft_Defender_v11x_Randy_Li_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 74 07 75 05 ?? ?? ?? ?? ?? 74 1F 75 1D ?? 68 ?? ?? ?? 00 59 9C 50 74 0A 75 08 ?? 59 C2 04 00 ?? ?? ?? E8 F4 FF FF FF ?? ?? ?? 78 0F 79 0D }

Detection condition:
$a at pe.entry_point

Full rule:
rule Soft_Defender_v11x_Randy_Li_additional: PEiD
{
    strings:
        $a = { 74 07 75 05 ?? ?? ?? ?? ?? 74 1F 75 1D ?? 68 ?? ?? ?? 00 59 9C 50 74 0A 75 08 ?? 59 C2 04 00 ?? ?? ?? E8 F4 FF FF FF ?? ?? ?? 78 0F 79 0D }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASPack_v103b_Alexey_Solodovnikov
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 ?? ?? ?? ?? 5D 81 ED AE 98 43 ?? B8 A8 98 43 ?? 03 C5 2B 85 18 9D 43 ?? 89 85 24 9D 43 ?? 80 BD 0E 9D 43 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASPack_v103b_Alexey_Solodovnikov: PEiD
{
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED AE 98 43 ?? B8 A8 98 43 ?? 03 C5 2B 85 18 9D 43 ?? 89 85 24 9D 43 ?? 80 BD 0E 9D 43 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXECryptor_239_DLL_compressed_resources_wwwstrongbitcom_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 ?? ?? ?? ?? E9 ?? ?? ?? FF 50 C1 C8 18 89 05 ?? ?? ?? ?? C3 C1 C0 18 51 E9 ?? ?? ?? FF 84 C0 0F 84 6A F9 FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF E8 CF E9 FF FF B8 01 00 00 00 E9 ?? ?? ?? FF 2B D0 68 A0 36 80 D4 59 81 C9 64 98 FF 99 E9 ?? ?? ?? FF 84 C0 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXECryptor_239_DLL_compressed_resources_wwwstrongbitcom_additional: PEiD
{
    strings:
        $a = { 68 ?? ?? ?? ?? E9 ?? ?? ?? FF 50 C1 C8 18 89 05 ?? ?? ?? ?? C3 C1 C0 18 51 E9 ?? ?? ?? FF 84 C0 0F 84 6A F9 FF FF E9 ?? ?? ?? FF C3 E9 ?? ?? ?? FF E8 CF E9 FF FF B8 01 00 00 00 E9 ?? ?? ?? FF 2B D0 68 A0 36 80 D4 59 81 C9 64 98 FF 99 E9 ?? ?? ?? FF 84 C0 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FakeNinja_v28_Anti_Debug_Spirit_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 64 A1 18 00 00 00 EB 02 C3 11 8B 40 30 EB 01 0F 0F B6 40 02 83 F8 01 74 FE EB 01 E8 90 C0 FF FF EB 03 BD F4 B5 64 A1 30 00 00 00 0F B6 40 02 74 01 BA 74 E0 50 00 64 A1 30 00 00 00 83 C0 68 8B 00 EB 00 83 F8 70 74 CF EB 02 EB FE 90 90 90 0F 31 33 C9 03 C8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FakeNinja_v28_Anti_Debug_Spirit_additional: PEiD
{
    strings:
        $a = { 64 A1 18 00 00 00 EB 02 C3 11 8B 40 30 EB 01 0F 0F B6 40 02 83 F8 01 74 FE EB 01 E8 90 C0 FF FF EB 03 BD F4 B5 64 A1 30 00 00 00 0F B6 40 02 74 01 BA 74 E0 50 00 64 A1 30 00 00 00 83 C0 68 8B 00 EB 00 83 F8 70 74 CF EB 02 EB FE 90 90 90 0F 31 33 C9 03 C8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXECryptor_2223_protected_IAT_wwwstrongbitcom
Repository: Yara-Rules/rules

Pattern signatures:
$a = { CC ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? B4 ?? ?? ?? 08 ?? ?? ?? 00 00 00 00 FF FF FF FF E8 ?? ?? ?? 04 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXECryptor_2223_protected_IAT_wwwstrongbitcom: PEiD
{
    strings:
        $a = { CC ?? ?? ?? 00 00 00 00 FF FF FF FF 3C ?? ?? ?? B4 ?? ?? ?? 08 ?? ?? ?? 00 00 00 00 FF FF FF FF E8 ?? ?? ?? 04 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 47 65 74 4D 6F 64 75 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_VCL
Repository: Yara-Rules/rules

Pattern signatures:
$a = { AC B9 00 80 F2 AE B9 04 00 AC AE 75 ?? E2 FA 89 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_VCL: PEiD
{
    strings:
        $a = { AC B9 00 80 F2 AE B9 04 00 AC AE 75 ?? E2 FA 89 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Metrowerks_CodeWarrior_DLL_v20
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 53 56 57 8B 75 0C 8B 5D 10 83 FE 01 74 05 83 FE 02 75 12 53 56 FF 75 08 E8 6E FF FF FF 09 C0 75 04 31 C0 EB 21 53 56 FF 75 08 E8 ?? ?? ?? ?? 89 C7 09 F6 74 05 83 FE 03 75 0A 53 56 FF 75 08 E8 47 FF FF FF 89 F8 8D 65 F4 5F 5E 5B 5D C2 0C 00 C9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Metrowerks_CodeWarrior_DLL_v20: PEiD
{
    strings:
        $a = { 55 89 E5 53 56 57 8B 75 0C 8B 5D 10 83 FE 01 74 05 83 FE 02 75 12 53 56 FF 75 08 E8 6E FF FF FF 09 C0 75 04 31 C0 EB 21 53 56 FF 75 08 E8 ?? ?? ?? ?? 89 C7 09 F6 74 05 83 FE 03 75 0A 53 56 FF 75 08 E8 47 FF FF FF 89 F8 8D 65 F4 5F 5E 5B 5D C2 0C 00 C9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MSLRH_v032a_fake_ASPack_212_emadicius_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 73 00 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MSLRH_v032a_fake_ASPack_212_emadicius_h: PEiD
{
    strings:
        $a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 73 00 00 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PEBundle_v244
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 83 BD }

Detection condition:
$a at pe.entry_point

Full rule:
rule PEBundle_v244: PEiD
{
    strings:
        $a = { 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 83 BD }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: aPack_v062_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 1E 06 8C C8 8E D8 ?? ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B6 }

Detection condition:
$a at pe.entry_point

Full rule:
rule aPack_v062_additional: PEiD
{
    strings:
        $a = { 1E 06 8C C8 8E D8 ?? ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B6 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Immun_12_EXE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 53 51 52 56 57 1E 06 2E 8B 0E FE 08 E3 1E 1E 06 D1 E1 8C C8 8E D8 8E C0 BE 00 09 BF 98 09 8B D1 4A D1 E2 03 F2 03 FA FD F3 A5 07 1F B4 30 CD 21 2E A2 63 01 3C 03 72 54 1E 33 C0 8E D8 80 3E FD 04 49 C6 06 FD 04 00 1F 74 42 8E 1E 2C 00 8C }

Detection condition:
$a at pe.entry_point

Full rule:
rule Immun_12_EXE: PEiD
{
    strings:
        $a = { 50 53 51 52 56 57 1E 06 2E 8B 0E FE 08 E3 1E 1E 06 D1 E1 8C C8 8E D8 8E C0 BE 00 09 BF 98 09 8B D1 4A D1 E2 03 F2 03 FA FD F3 A5 07 1F B4 30 CD 21 2E A2 63 01 3C 03 72 54 1E 33 C0 8E D8 80 3E FD 04 49 C6 06 FD 04 00 1F 74 42 8E 1E 2C 00 8C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: StarForce_30_StarForce_Technology_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 ?? ?? ?? ?? FF 25 ?? ?? 57 }

Detection condition:
$a at pe.entry_point

Full rule:
rule StarForce_30_StarForce_Technology_additional: PEiD
{
    strings:
        $a = { 68 ?? ?? ?? ?? FF 25 ?? ?? 57 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXECryptor_vxxxx
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXECryptor_vxxxx: PEiD
{
    strings:
        $a = { E8 24 ?? ?? ?? 8B 4C 24 0C C7 01 17 ?? 01 ?? C7 81 B8 ?? ?? ?? ?? ?? ?? ?? 31 C0 89 41 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PolyEnE_001p_by_Lennart_Hedlund
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 00 00 E0 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PolyEnE_001p_by_Lennart_Hedlund: PEiD
{
    strings:
        $a = { 60 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 00 00 E0 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: v02Packer_ttt
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 36 FE FF FF C3 90 ?? 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule v02Packer_ttt: PEiD
{
    strings:
        $a = { 60 E8 36 FE FF FF C3 90 ?? 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: REC_C0ded_by_ROSE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 06 1E 0E 0E 07 1F B4 30 CD 21 86 E0 3D 00 03 73 ?? CD 20 EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule REC_C0ded_by_ROSE: PEiD
{
    strings:
        $a = { 06 1E 0E 0E 07 1F B4 30 CD 21 86 E0 3D 00 03 73 ?? CD 20 EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: DAEMON_Protect_067_DAEMONUG
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 60 9C 8C C9 32 C9 E3 0C }

Detection condition:
$a at pe.entry_point

Full rule:
rule DAEMON_Protect_067_DAEMONUG: PEiD
{
    strings:
        $a = { 60 60 9C 8C C9 32 C9 E3 0C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MinGW_v32x_main_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 E4 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 E4 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 00 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 F4 40 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 53 83 EC 24 C7 04 24 A0 11 40 00 E8 8D 07 00 00 83 EC 04 E8 85 02 00 00 C7 04 24 00 20 40 00 8B 15 10 20 40 00 8D 4D F8 C7 45 F8 00 00 00 00 89 4C 24 10 89 54 24 0C 8D 55 F4 89 54 24 08 C7 44 24 04 04 20 40 00 E8 02 07 00 00 A1 20 20 40 00 85 C0 74 76 A3 30 20 40 00 A1 F0 40 40 00 85 C0 74 1F 89 04 24 E8 C3 06 00 00 8B 1D 20 20 40 00 89 04 24 89 5C 24 04 E8 C1 06 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MinGW_v32x_main_additional: PEiD
{
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 E4 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 E4 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 00 41 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 F4 40 40 00 89 EC 5D C3 8D 76 00 8D BC 27 00 00 00 00 55 89 E5 53 83 EC 24 C7 04 24 A0 11 40 00 E8 8D 07 00 00 83 EC 04 E8 85 02 00 00 C7 04 24 00 20 40 00 8B 15 10 20 40 00 8D 4D F8 C7 45 F8 00 00 00 00 89 4C 24 10 89 54 24 0C 8D 55 F4 89 54 24 08 C7 44 24 04 04 20 40 00 E8 02 07 00 00 A1 20 20 40 00 85 C0 74 76 A3 30 20 40 00 A1 F0 40 40 00 85 C0 74 1F 89 04 24 E8 C3 06 00 00 8B 1D 20 20 40 00 89 04 24 89 5C 24 04 E8 C1 06 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: WWPACK_v305c4_Modified_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule WWPACK_v305c4_Modified_Hint_DOS_EP: PEiD
{
    strings:
        $a = { B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_02_LCC_Win32_1x
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_02_LCC_Win32_1x: PEiD
{
    strings:
        $a = { 64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PRO_PACK_v208_emphasis_on_packed_size_locked
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 EC ?? 8B EC BE ?? ?? FC E8 ?? ?? 05 ?? ?? 8B C8 E8 ?? ?? 8B }

Detection condition:
$a at pe.entry_point

Full rule:
rule PRO_PACK_v208_emphasis_on_packed_size_locked: PEiD
{
    strings:
        $a = { 83 EC ?? 8B EC BE ?? ?? FC E8 ?? ?? 05 ?? ?? 8B C8 E8 ?? ?? 8B }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: eXPressor_12_CGSoftLabs_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 }

Detection condition:
$a at pe.entry_point

Full rule:
rule eXPressor_12_CGSoftLabs_h: PEiD
{
    strings:
        $a = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PE_Crypt_v100v101
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule PE_Crypt_v100v101: PEiD
{
    strings:
        $a = { E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PE_SHiELD_02
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PE_SHiELD_02: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 41 4E 41 4B 49 4E 5D 83 ED 06 EB 02 EA 04 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASProtect_SKE_2122_dll_Alexey_Solodovnikov_h_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASProtect_SKE_2122_dll_Alexey_Solodovnikov_h_additional: PEiD
{
    strings:
        $a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MSLRH_v032a_fake_PECompact_14x_emadicius
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 2E A8 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule MSLRH_v032a_fake_PECompact_14x_emadicius: PEiD
{
    strings:
        $a = { EB 06 68 2E A8 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: yzpack_V112_UsAr_Sign_by_fly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 ?? ?? ?? ?? B4 09 BA 00 00 1F CD 21 B8 01 4C CD 21 40 00 00 00 50 45 00 00 4C 01 02 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 E0 00 ?? ?? 0B 01 ?? ?? ?? ?? 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule yzpack_V112_UsAr_Sign_by_fly: PEiD
{
    strings:
        $a = { 5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 ?? ?? ?? ?? B4 09 BA 00 00 1F CD 21 B8 01 4C CD 21 40 00 00 00 50 45 00 00 4C 01 02 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 E0 00 ?? ?? 0B 01 ?? ?? ?? ?? 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Borland_Delphi_Setup_Module
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 }
        $b = { 55 8B EC 83 C4 ?? 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Borland_Delphi_Setup_Module: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 }
        $b = { 55 8B EC 83 C4 ?? 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 E8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}