deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: PE_Spin_v0b_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 ?? 4E 40 00 8B 42 3C 03 C2 89 85 ?? 4E 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D ?? 4E 40 00 53 8F 85 ?? 4C 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD ?? 4F 40 00 8D 5B 04 8B 1B 89 9D ?? 4F 40 00 E8 00 00 00 00 58 01 68 05 68 BC 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC FF 25 10 BB ?? 00 00 00 B9 84 12 00 00 8D BD ?? 4F 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 

Detection condition:
$a at pe.entry_point

Full rule:
rule PE_Spin_v0b_additional: PEiD
{
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 71 DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 ?? 4E 40 00 8B 42 3C 03 C2 89 85 ?? 4E 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D ?? 4E 40 00 53 8F 85 ?? 4C 40 00 EB 07 FA EB 01 FF EB 04 E3 EB F8 69 8B 59 38 03 DA 8B 3B 89 BD ?? 4F 40 00 8D 5B 04 8B 1B 89 9D ?? 4F 40 00 E8 00 00 00 00 58 01 68 05 68 BC 65 0F E2 B8 77 CE 2F B1 35 73 CE 2F B1 03 E0 F7 D8 81 2C 04 13 37 CF E1 FF 64 24 FC FF 25 10 BB ?? 00 00 00 B9 84 12 00 00 8D BD ?? 4F 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ACE_Archive
Repository: Yara-Rules/rules

Pattern signatures:
$a = { ?? ?? ?? ?? ?? ?? ?? 2A 2A 41 43 45 2A 2A }
        $b = { 2A 2A 41 43 45 2A 2A }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule ACE_Archive: PEiD
{
    strings:
        $a = { ?? ?? ?? ?? ?? ?? ?? 2A 2A 41 43 45 2A 2A }
        $b = { 2A 2A 41 43 45 2A 2A }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: PseudoSigner_02_JDPack_1x_JDProtect_09_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_02_JDPack_1x_JDProtect_09_Anorganix: PEiD
{
    strings:
        $a = { 60 E8 22 00 00 00 5D 8B D5 81 ED 90 90 90 90 2B 95 90 90 90 90 81 EA 06 90 90 90 89 95 90 90 90 90 83 BD 45 00 01 00 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Petite_14_c1998_99_Ian_Luck
Repository: Yara-Rules/rules

Pattern signatures:
$a = { ?? ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6 }
        $b = { 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Petite_14_c1998_99_Ian_Luck: PEiD
{
    strings:
        $a = { ?? ?? ?? ?? ?? 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6 }
        $b = { 66 9C 60 50 8B D8 03 00 68 54 BC 00 00 6A 00 FF 50 14 8B CC 8D A0 54 BC 00 00 50 8B C3 8D 90 ?? 16 00 00 68 00 00 ?? ?? 51 50 80 04 24 08 50 80 04 24 42 50 80 04 24 61 50 80 04 24 9D 50 80 04 24 BB 83 3A 00 0F 84 D8 14 00 00 8B 44 24 18 F6 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: FSG_v110_Eng_dulekxt_Borland_Delphi_20
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 01 56 E8 02 00 00 00 B2 D9 59 68 80 ?? 41 00 E8 02 00 00 00 65 32 59 5E EB 02 CD 20 BB }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_v110_Eng_dulekxt_Borland_Delphi_20: PEiD
{
    strings:
        $a = { EB 01 56 E8 02 00 00 00 B2 D9 59 68 80 ?? 41 00 E8 02 00 00 00 65 32 59 5E EB 02 CD 20 BB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: aPack_v098b_exe_Hint_HDR_FILESIZE_16
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 93 07 1F 05 ?? ?? 8E D0 BC ?? ?? EA }

Detection condition:
$a at pe.entry_point

Full rule:
rule aPack_v098b_exe_Hint_HDR_FILESIZE_16: PEiD
{
    strings:
        $a = { 93 07 1F 05 ?? ?? 8E D0 BC ?? ?? EA }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: nSPack_2x3x_NET_North_StarLiu_Xing_Ping_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FF 25 A4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule nSPack_2x3x_NET_North_StarLiu_Xing_Ping_additional: PEiD
{
    strings:
        $a = { FF 25 A4 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: BeRoEXEPacker_v100_LZBRS
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33 }
        $b = { 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 1C 00 00 00 72 03 A4 EB F2 E8 1A 00 00 00 8D 51 FF E8 12 00 00 00 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule BeRoEXEPacker_v100_LZBRS: PEiD
{
    strings:
        $a = { 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 ?? ?? ?? ?? 72 03 A4 EB F2 E8 ?? ?? ?? ?? 8D 51 FF E8 ?? ?? ?? ?? 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33 }
        $b = { 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC AD 8D 1C 07 B0 80 3B FB 73 3B E8 1C 00 00 00 72 03 A4 EB F2 E8 1A 00 00 00 8D 51 FF E8 12 00 00 00 56 8B F7 2B F2 F3 A4 5E EB DB 02 C0 75 03 AC 12 C0 C3 33 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: BeRoEXEPacker_v100_LZBRR
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10 }

Detection condition:
$a at pe.entry_point

Full rule:
rule BeRoEXEPacker_v100_LZBRR: PEiD
{
    strings:
        $a = { 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MSLRH_v032a_fake_SVKP_111_emadicius
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 64 A0 23 00 00 00 83 C5 06 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MSLRH_v032a_fake_SVKP_111_emadicius: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 64 A0 23 00 00 00 83 C5 06 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PKLITE_v114_v115_v120_3
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B ?? ?? ?? 72 ?? B4 09 BA ?? 01 CD 21 CD 20 4E 6F }

Detection condition:
$a at pe.entry_point

Full rule:
rule PKLITE_v114_v115_v120_3: PEiD
{
    strings:
        $a = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B ?? ?? ?? 72 ?? B4 09 BA ?? 01 CD 21 CD 20 4E 6F }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: XCR_v013
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 93 71 08 ?? ?? ?? ?? ?? ?? ?? ?? 8B D8 78 E2 ?? ?? ?? ?? 9C 33 C3 ?? ?? ?? ?? 60 79 CE ?? ?? ?? ?? E8 01 ?? ?? ?? ?? 83 C4 04 E8 AB FF FF FF ?? ?? ?? ?? 2B E8 ?? ?? ?? ?? 03 C5 FF 30 ?? ?? ?? ?? C6 ?? EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule XCR_v013: PEiD
{
    strings:
        $a = { 93 71 08 ?? ?? ?? ?? ?? ?? ?? ?? 8B D8 78 E2 ?? ?? ?? ?? 9C 33 C3 ?? ?? ?? ?? 60 79 CE ?? ?? ?? ?? E8 01 ?? ?? ?? ?? 83 C4 04 E8 AB FF FF FF ?? ?? ?? ?? 2B E8 ?? ?? ?? ?? 03 C5 FF 30 ?? ?? ?? ?? C6 ?? EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: kkrunchy_Ryd
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 }

Detection condition:
$a at pe.entry_point

Full rule:
rule kkrunchy_Ryd: PEiD
{
    strings:
        $a = { BD 08 ?? ?? 00 C7 45 00 ?? ?? ?? 00 FF 4D 08 C6 45 0C 05 8D 7D 14 31 C0 B4 04 89 C1 F3 AB BF ?? ?? ?? 00 57 BE ?? ?? ?? 00 31 C9 41 FF 4D 0C 8D 9C 8D A0 00 00 00 FF D6 10 C9 73 F3 FF 45 0C 91 AA 83 C9 FF 8D 5C 8D 18 FF D6 74 DD E3 17 8D 5D 1C FF D6 74 10 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: XCR_v011
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 9C E8 8B DD 5D 81 ED 89 }
        $b = { 60 8B F0 33 DB 83 C3 01 83 C0 01 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule XCR_v011: PEiD
{
    strings:
        $a = { 60 9C E8 8B DD 5D 81 ED 89 }
        $b = { 60 8B F0 33 DB 83 C3 01 83 C0 01 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Sharp_GPB_Graphics_format_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 4D 00 00 00 00 ?? ?? ?? ?? 08 00 00 00 03 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Sharp_GPB_Graphics_format_Hint_FILE_START: PEiD
{
    strings:
        $a = { 4D 00 00 00 00 ?? ?? ?? ?? 08 00 00 00 03 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: nPack_V111502006Beta_NEOxuinC_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule nPack_V111502006Beta_NEOxuinC_additional: PEiD
{
    strings:
        $a = { 83 3D 40 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 41 00 00 00 B8 80 ?? ?? ?? 2B 05 08 ?? ?? ?? A3 3C ?? ?? ?? E8 5E 00 00 00 E8 E0 01 00 00 E8 EC 06 00 00 E8 F7 05 00 00 A1 3C ?? ?? ?? C7 05 40 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Nullsoft_PiMP_Install_System
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 EC ?? 53 55 56 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Nullsoft_PiMP_Install_System: PEiD
{
    strings:
        $a = { 83 EC ?? 53 55 56 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_ARCV4_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 00 00 5D 81 ED 06 01 81 FC 4F 50 74 0B 8D B6 86 01 BF 00 01 57 A4 EB 11 1E 06 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_ARCV4_additional: PEiD
{
    strings:
        $a = { E8 00 00 5D 81 ED 06 01 81 FC 4F 50 74 0B 8D B6 86 01 BF 00 01 57 A4 EB 11 1E 06 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPX_SCRAMBLER_306_OnToL
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 00 00 00 00 59 83 C1 07 51 C3 C3 BE ?? ?? ?? ?? 83 EC 04 89 34 24 B9 80 00 00 00 81 36 ?? ?? ?? ?? 50 B8 04 00 00 00 50 03 34 24 58 58 83 E9 03 E2 E9 EB D6 }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPX_SCRAMBLER_306_OnToL: PEiD
{
    strings:
        $a = { E8 00 00 00 00 59 83 C1 07 51 C3 C3 BE ?? ?? ?? ?? 83 EC 04 89 34 24 B9 80 00 00 00 81 36 ?? ?? ?? ?? 50 B8 04 00 00 00 50 03 34 24 58 58 83 E9 03 E2 E9 EB D6 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Petite_v21_2_Hint_WIN_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Petite_v21_2_Hint_WIN_EP: PEiD
{
    strings:
        $a = { B8 ?? ?? ?? ?? 6A 00 68 ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 64 ?? ?? ?? ?? ?? ?? 66 9C 60 50 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AutoDesk_Animation_file_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 12 AF ?? ?? 40 01 C8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule AutoDesk_Animation_file_additional: PEiD
{
    strings:
        $a = { 00 12 AF ?? ?? 40 01 C8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PocketPC_SHA
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 86 2F 96 2F A6 2F B6 2F 22 4F 43 68 53 6B 63 6A 73 69 F0 7F 0B D0 0B 40 09 00 09 D0 B3 65 A3 66 93 67 0B 40 83 64 03 64 04 D0 0B 40 09 00 10 7F 26 4F F6 6B F6 6A F6 69 0B 00 F6 68 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 22 4F F0 7F 0A D0 06 D4 06 D5 0B 40 09 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PocketPC_SHA: PEiD
{
    strings:
        $a = { 86 2F 96 2F A6 2F B6 2F 22 4F 43 68 53 6B 63 6A 73 69 F0 7F 0B D0 0B 40 09 00 09 D0 B3 65 A3 66 93 67 0B 40 83 64 03 64 04 D0 0B 40 09 00 10 7F 26 4F F6 6B F6 6A F6 69 0B 00 F6 68 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 22 4F F0 7F 0A D0 06 D4 06 D5 0B 40 09 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MSLRH_032a_fake_ASPack_211d_emadicius_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 EB 02 C7 05 EB 02 CD 20 E8 03 00 00 00 E9 EB 04 58 40 50 C3 61 9D 1F EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MSLRH_032a_fake_ASPack_211d_emadicius_additional: PEiD
{
    strings:
        $a = { EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 EB 02 C7 05 EB 02 CD 20 E8 03 00 00 00 E9 EB 04 58 40 50 C3 61 9D 1F EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Warning_may_be_RCryptor_by_Vaska_unknown_ver_21032006_2317
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB F3 E8 00 00 00 00 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Warning_may_be_RCryptor_by_Vaska_unknown_ver_21032006_2317: PEiD
{
    strings:
        $a = { EB F3 E8 00 00 00 00 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_02_LCC_Win32_DLL
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_02_LCC_Win32_DLL: PEiD
{
    strings:
        $a = { 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Explosion1000
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? 5E 1E 06 50 81 ?? ?? ?? 56 FC B8 21 35 CD 21 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 26 ?? ?? ?? ?? ?? ?? 74 ?? 8C D8 48 8E D8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Explosion1000: PEiD
{
    strings:
        $a = { E8 ?? ?? 5E 1E 06 50 81 ?? ?? ?? 56 FC B8 21 35 CD 21 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 26 ?? ?? ?? ?? ?? ?? 74 ?? 8C D8 48 8E D8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MinGW_v32x_Dll_mainCRTStartup_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 83 EC 08 6A 00 6A 00 6A 00 6A 00 E8 0D 00 00 00 B8 00 00 00 00 C9 C3 90 90 90 90 90 90 FF 25 38 20 00 10 90 90 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MinGW_v32x_Dll_mainCRTStartup_additional: PEiD
{
    strings:
        $a = { 55 89 E5 83 EC 08 6A 00 6A 00 6A 00 6A 00 E8 0D 00 00 00 B8 00 00 00 00 C9 C3 90 90 90 90 90 90 FF 25 38 20 00 10 90 90 00 00 00 00 00 00 00 00 FF FF FF FF 00 00 00 00 FF FF FF FF 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Warning_may_be_RCryptor_by_Vaska_unknown_ver_21032006_2318
Repository: Yara-Rules/rules

Pattern signatures:
$a = { C0 14 13 74 06 80 30 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Warning_may_be_RCryptor_by_Vaska_unknown_ver_21032006_2318: PEiD
{
    strings:
        $a = { C0 14 13 74 06 80 30 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PCrypt_v351_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 43 52 59 50 54 FF 76 33 2E 35 31 00 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PCrypt_v351_additional: PEiD
{
    strings:
        $a = { 50 43 52 59 50 54 FF 76 33 2E 35 31 00 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_100
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB C4 84 40 00 87 DD 8B 85 49 85 40 00 01 85 B8 84 40 00 66 C7 85 B5 84 40 00 90 90 BB AB 0A 00 00 03 9D 4D 85 40 00 03 9D 49 85 40 00 53 53 53 58 2D 1F }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_100: PEiD
{
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB C4 84 40 00 87 DD 8B 85 49 85 40 00 01 85 B8 84 40 00 66 C7 85 B5 84 40 00 90 90 BB AB 0A 00 00 03 9D 4D 85 40 00 03 9D 49 85 40 00 53 53 53 58 2D 1F }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ST_Protector_V15_Silent_Software
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 }
        $b = { 68 00 1A 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 ?? ?? ?? ?? ?? ?? 50 72 6F 6A 65 63 74 31 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 06 00 00 00 AC }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule ST_Protector_V15_Silent_Software: PEiD
{
    strings:
        $a = { 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 }
        $b = { 68 00 1A 40 00 E8 EE FF FF FF 00 00 00 00 00 00 30 00 00 00 40 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 01 00 00 00 ?? ?? ?? ?? ?? ?? 50 72 6F 6A 65 63 74 31 00 ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 06 00 00 00 AC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: HQR_data_file
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 48 00 00 00 ?? 02 00 00 ?? ?? 00 00 ?? ?? 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule HQR_data_file: PEiD
{
    strings:
        $a = { 48 00 00 00 ?? 02 00 00 ?? ?? 00 00 ?? ?? 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Borland_Delphi_vxx_Component
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 B4 B8 E8 E8 8D }
        $b = { C3 E9 ?? ?? ?? FF 8D 40 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Borland_Delphi_vxx_Component: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 B4 B8 E8 E8 8D }
        $b = { C3 E9 ?? ?? ?? FF 8D 40 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: _PseudoSigner_01_Gleam_100_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_Gleam_100_Anorganix: PEiD
{
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MoleBox_v20
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? ?? ?? 60 E8 4F }

Detection condition:
$a at pe.entry_point

Full rule:
rule MoleBox_v20: PEiD
{
    strings:
        $a = { E8 ?? ?? ?? ?? 60 E8 4F }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXE_Stealth_273_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXE_Stealth_273_additional: PEiD
{
    strings:
        $a = { 60 90 EB 22 45 78 65 53 74 65 61 6C 74 68 20 2D 20 77 77 77 2E 77 65 62 74 6F 6F 6C 6D 61 73 74 65 72 2E 63 6F 6D E8 00 00 00 00 5D 81 ED 40 1E 40 00 B9 99 09 00 00 8D BD 88 1E 40 00 8B F7 AC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ZipWorxSecureEXE_25_ZipWORX_Technologies_LLC_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 B8 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ZipWorxSecureEXE_25_ZipWORX_Technologies_LLC_h: PEiD
{
    strings:
        $a = { E9 B8 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30 }
    condition:
        $a at pe.entry_point

}