deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: RLPack_V120_LZMA_430_ap0x
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 01 00 00 EB 20 60 8B 85 9C 0C 00 00 FF B5 94 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD A8 0C 00 00 00 74 0E 83 BD AC 0C 00 00 00 74 05 E8 F2 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 2D 0C 00 00 89 85 C0 0C 00 00 5B 60 FF B5 94 0C 00 00 56 FF B5 C0 0C 00 00 FF D3 61 8B B5 C0 0C 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 9C 0C 00 00 83 C0 04 89 85 BC 0C 00 00 EB 72 56 FF 95 25 0C 00 00 0B C0 75 05 E8 E6 02 00 00 85 C0 0F 84 AB 00 00 00 89 85 B8 0C 00 00 8B C6 EB 2E 8B 85 BC 0C 00 00 8B 00 50 FF B5 B8 0C 00 00 E8 2E 02 00 00 85 C0 0F 84 85 00 00 00 89 07 83 85 BC 0C 00 00 04 83 C7 04 8B 85 BC 0C 00 00 83 38 00 75 CD EB 01 46 80 3E 00 75 FA 46 83 

Detection condition:
$a at pe.entry_point

Full rule:
rule RLPack_V120_LZMA_430_ap0x: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 01 00 00 EB 20 60 8B 85 9C 0C 00 00 FF B5 94 0C 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD A8 0C 00 00 00 74 0E 83 BD AC 0C 00 00 00 74 05 E8 F2 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 2D 0C 00 00 89 85 C0 0C 00 00 5B 60 FF B5 94 0C 00 00 56 FF B5 C0 0C 00 00 FF D3 61 8B B5 C0 0C 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 9C 0C 00 00 83 C0 04 89 85 BC 0C 00 00 EB 72 56 FF 95 25 0C 00 00 0B C0 75 05 E8 E6 02 00 00 85 C0 0F 84 AB 00 00 00 89 85 B8 0C 00 00 8B C6 EB 2E 8B 85 BC 0C 00 00 8B 00 50 FF B5 B8 0C 00 00 E8 2E 02 00 00 85 C0 0F 84 85 00 00 00 89 07 83 85 BC 0C 00 00 04 83 C7 04 8B 85 BC 0C 00 00 83 38 00 75 CD EB 01 46 80 3E 00 75 FA 46 83 C0 04 8B 38 03 BD 9C 0C 00 00 83 C0 04 89 85 BC 0C 00 00 80 3E 01 75 89 68 00 40 00 00 68 ?? ?? ?? ?? FF B5 C0 0C 00 00 FF 95 31 0C 00 00 68 00 80 00 00 6A 00 FF B5 C0 0C 00 00 FF 95 31 0C 00 00 68 00 80 00 00 6A 00 FF B5 94 0C 00 00 FF 95 31 0C 00 00 E8 61 00 00 00 E8 5C 01 00 00 61 E9 ?? ?? ?? ?? 61 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Kodak_Color_management_for_Windows_file_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 4B 43 4D 53 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Kodak_Color_management_for_Windows_file_Hint_FILE_START: PEiD
{
    strings:
        $a = { 4B 43 4D 53 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXE_Manager_30
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B4 30 1E 06 CD 21 2E A3 08 00 BF 0A 00 B9 89 0A 33 C0 2E 03 05 47 E2 FA 2E 3B 06 06 00 74 09 B8 07 0E CD 10 33 C0 50 CB BF 0A 00 B9 45 05 2E 8B 16 04 00 FA 33 C0 8E C0 26 FF 36 0C 00 26 FF 36 0E 00 26 C7 06 0C 00 45 01 26 8C 0E 0E 00 2E 89 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXE_Manager_30: PEiD
{
    strings:
        $a = { B4 30 1E 06 CD 21 2E A3 08 00 BF 0A 00 B9 89 0A 33 C0 2E 03 05 47 E2 FA 2E 3B 06 06 00 74 09 B8 07 0E CD 10 33 C0 50 CB BF 0A 00 B9 45 05 2E 8B 16 04 00 FA 33 C0 8E C0 26 FF 36 0C 00 26 FF 36 0E 00 26 C7 06 0C 00 45 01 26 8C 0E 0E 00 2E 89 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXE_Manager_32
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B4 30 1E 06 CD 21 2E A3 08 00 BF 0A 00 B9 F6 0B 33 C0 2E 03 05 47 E2 FA 2E 3B 06 06 00 74 09 B8 07 0E CD 10 33 C0 50 CB BD 0A 00 B9 FB 05 2E 8B 1E 04 00 FA 33 C0 8E C0 26 FF 36 0C 00 26 FF 36 0E 00 26 C7 06 0C 00 70 01 26 8C 0E 0E 00 BE 47 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXE_Manager_32: PEiD
{
    strings:
        $a = { B4 30 1E 06 CD 21 2E A3 08 00 BF 0A 00 B9 F6 0B 33 C0 2E 03 05 47 E2 FA 2E 3B 06 06 00 74 09 B8 07 0E CD 10 33 C0 50 CB BD 0A 00 B9 FB 05 2E 8B 1E 04 00 FA 33 C0 8E C0 26 FF 36 0C 00 26 FF 36 0E 00 26 C7 06 0C 00 70 01 26 8C 0E 0E 00 BE 47 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: eXPressor_v13_CGSoftLabs
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 45 78 50 72 2D 76 2E 31 2E 33 2E }
        $b = { 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 13 A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? 89 ?? ?? E9 ?? ?? 00 00 C7 05 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule eXPressor_v13_CGSoftLabs: PEiD
{
    strings:
        $a = { 45 78 50 72 2D 76 2E 31 2E 33 2E }
        $b = { 55 8B EC 83 EC ?? 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 33 2E 2E B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 13 A1 ?? ?? ?? ?? 03 05 ?? ?? ?? ?? 89 ?? ?? E9 ?? ?? 00 00 C7 05 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: BlackEnergy_DDoS_Bot_Crypter_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 ?? ?? 81 EC 1C 01 00 00 53 56 57 6A 04 BE 00 30 00 00 56 FF 35 00 20 11 13 6A 00 E8 ?? 03 00 00 ?? ?? 83 C4 10 ?? FF 89 7D F4 0F }

Detection condition:
$a at pe.entry_point

Full rule:
rule BlackEnergy_DDoS_Bot_Crypter_additional: PEiD
{
    strings:
        $a = { 55 ?? ?? 81 EC 1C 01 00 00 53 56 57 6A 04 BE 00 30 00 00 56 FF 35 00 20 11 13 6A 00 E8 ?? 03 00 00 ?? ?? 83 C4 10 ?? FF 89 7D F4 0F }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_C_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B4 30 CD 21 3C 02 73 ?? B8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_C_Hint_DOS_EP: PEiD
{
    strings:
        $a = { B4 30 CD 21 3C 02 73 ?? B8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASProtect_130824_beta
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 01 ?? 40 00 E8 01 00 00 00 C3 C3 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 89 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASProtect_130824_beta: PEiD
{
    strings:
        $a = { 68 01 ?? 40 00 E8 01 00 00 00 C3 C3 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 89 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AHTeam_EP_Protector_03_fake_Borland_Delphi_60_70_FEUERRADER_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 53 8B D8 33 C0 A3 00 00 00 00 6A 00 E8 00 00 00 FF A3 00 00 00 00 A1 00 00 00 00 A3 00 00 00 00 33 C0 A3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule AHTeam_EP_Protector_03_fake_Borland_Delphi_60_70_FEUERRADER_additional: PEiD
{
    strings:
        $a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 53 8B D8 33 C0 A3 00 00 00 00 6A 00 E8 00 00 00 FF A3 00 00 00 00 A1 00 00 00 00 A3 00 00 00 00 33 C0 A3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXELOCK_666_15_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BA ?? ?? BF ?? ?? EB ?? EA ?? ?? ?? ?? 79 ?? 7F ?? 7E ?? 1C ?? 48 78 ?? E3 ?? 45 14 ?? 5A E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXELOCK_666_15_Hint_DOS_EP: PEiD
{
    strings:
        $a = { BA ?? ?? BF ?? ?? EB ?? EA ?? ?? ?? ?? 79 ?? 7F ?? 7E ?? 1C ?? 48 78 ?? E3 ?? 45 14 ?? 5A E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Themida_1201_compressed_Oreans_Technologies_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 00 00 ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Themida_1201_compressed_Oreans_Technologies_h: PEiD
{
    strings:
        $a = { B8 00 00 ?? ?? 60 0B C0 74 58 E8 00 00 00 00 58 05 43 00 00 00 80 38 E9 75 03 61 EB 35 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_C_19881989_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B4 30 CD 21 3C 02 73 ?? CD 20 BF ?? ?? 8B ?? ?? ?? 2B F7 81 ?? ?? ?? 72 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_C_19881989_additional: PEiD
{
    strings:
        $a = { B4 30 CD 21 3C 02 73 ?? CD 20 BF ?? ?? 8B ?? ?? ?? 2B F7 81 ?? ?? ?? 72 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PeX_099_Eng_bartCrackPl
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PeX_099_Eng_bartCrackPl: PEiD
{
    strings:
        $a = { E9 F5 00 00 00 0D 0A C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 C4 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Borland_Delphi_3_Portions_Copyright_c_198396_Borland_h_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 36 20 42 6F 72 6C 61 6E 64 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Borland_Delphi_3_Portions_Copyright_c_198396_Borland_h_additional: PEiD
{
    strings:
        $a = { 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 36 20 42 6F 72 6C 61 6E 64 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SimplePack_111_Method_2NT_bagieTMX_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 

Detection condition:
$a at pe.entry_point

Full rule:
rule SimplePack_111_Method_2NT_bagieTMX_h: PEiD
{
    strings:
        $a = { 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 40 00 00 C0 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 EB 01 CD 64 A1 30 00 00 00 EB 01 CD 8B 48 0C E3 6F EB 01 CD 05 AC 00 00 00 EB 01 CD 66 81 38 93 08 EB 01 CD 75 0A EB 01 CD B8 38 FF FF FF EB 14 EB 01 CD 66 81 38 28 0A 75 4A EB 01 CD B8 1A FF FF FF EB 00 EB 01 CD 31 C9 EB 01 CD 51 EB 01 CD 51 EB 01 CD 6A 11 EB 01 CD 6A FE EB 01 CD E8 03 00 00 00 EB 01 CD 83 04 24 18 EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RCryptor_15_by_Vaska_UsAr_sign_individual_version_21032007_2215
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 2C 24 4F 68 40 A1 14 13 FF 54 24 04 83 44 24 04 4F B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 2B 40 EB F3 B8 8C 20 18 13 3D B9 27 18 13 74 06 80 30 19 40 EB F3 E8 00 00 00 00 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RCryptor_15_by_Vaska_UsAr_sign_individual_version_21032007_2215: PEiD
{
    strings:
        $a = { 83 2C 24 4F 68 40 A1 14 13 FF 54 24 04 83 44 24 04 4F B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 2B 40 EB F3 B8 8C 20 18 13 3D B9 27 18 13 74 06 80 30 19 40 EB F3 E8 00 00 00 00 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: The_aPE_Inline_Patch_ExtraStealth_SuperStealth_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 02 ?? ?? ?? EB 01 C3 3E 8B 44 24 FC 50 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 }

Detection condition:
$a at pe.entry_point

Full rule:
rule The_aPE_Inline_Patch_ExtraStealth_SuperStealth_additional: PEiD
{
    strings:
        $a = { E8 02 ?? ?? ?? EB 01 C3 3E 8B 44 24 FC 50 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_01_Microsoft_Visual_Basic_50_60_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_01_Microsoft_Visual_Basic_50_60_Anorganix: PEiD
{
    strings:
        $a = { 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CrunchPE_10xx_BitArts
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 09 C6 85 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CrunchPE_10xx_BitArts: PEiD
{
    strings:
        $a = { 55 E8 ?? ?? ?? ?? 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 89 85 ?? ?? ?? ?? 80 BD ?? ?? ?? ?? ?? 75 09 C6 85 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: VProtector_V13X_vcasm_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 00 00 55 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 64 69 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule VProtector_V13X_vcasm_additional: PEiD
{
    strings:
        $a = { 00 00 00 00 55 73 65 72 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 47 64 69 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MPEG_Layer_IIIII_music_file_Hint_FILE_START_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FF FE }

Detection condition:
$a at pe.entry_point

Full rule:
rule MPEG_Layer_IIIII_music_file_Hint_FILE_START_additional: PEiD
{
    strings:
        $a = { FF FE }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CRYPToCRACks_PE_Protector_v093_Lucas_Fleischer_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC 04 0F 85 DD 00 00 00 81 EB 00 01 00 00 75 BE 90 72 ?? ?? ?? ?? 00 00 00 00 00 00 00 7A ?? ?? ?? 72 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 C1 00 46 61 74 61 6C 45 78 69 74 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CRYPToCRACks_PE_Protector_v093_Lucas_Fleischer_h: PEiD
{
    strings:
        $a = { 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC 04 0F 85 DD 00 00 00 81 EB 00 01 00 00 75 BE 90 72 ?? ?? ?? ?? 00 00 00 00 00 00 00 7A ?? ?? ?? 72 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 C1 00 46 61 74 61 6C 45 78 69 74 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Caz1204
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? 5E 83 EE 03 1E 06 B8 FF FF CD 2F 3C 10 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Caz1204: PEiD
{
    strings:
        $a = { E8 ?? ?? 5E 83 EE 03 1E 06 B8 FF FF CD 2F 3C 10 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_02_ExeSmasher_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_02_ExeSmasher_Anorganix: PEiD
{
    strings:
        $a = { 9C FE 03 90 60 BE 90 90 41 90 8D BE 90 10 FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 FE 0B }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_02_Lockless_Intro_Pack_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_02_Lockless_Intro_Pack_Anorganix: PEiD
{
    strings:
        $a = { 2C E8 EB 1A 90 90 5D 8B C5 81 ED F6 73 90 90 2B 85 90 90 90 90 83 E8 06 89 85 FF 01 EC AD }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PCrypt_v351_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 43 52 59 50 54 FF 76 33 2E 35 31 00 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PCrypt_v351_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 50 43 52 59 50 54 FF 76 33 2E 35 31 00 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RCryptor_v16_Vaska_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 33 D0 68 ?? ?? ?? ?? FF D2 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RCryptor_v16_Vaska_additional: PEiD
{
    strings:
        $a = { 33 D0 68 ?? ?? ?? ?? FF D2 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: InstallShield_Cabinet_Archive_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 49 53 63 }

Detection condition:
$a at pe.entry_point

Full rule:
rule InstallShield_Cabinet_Archive_Hint_FILE_START: PEiD
{
    strings:
        $a = { 49 53 63 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MPRESS_V107_V125_MATCODE_Softwarenbsp_nbsp_SignByfly_20080730
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 58 05 9E 02 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 51 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 8B D6 8B CF E8 56 00 00 00 5E 5A 83 EA 05 2B C9 3B CA 73 26 8B D9 AC 41 24 FE 3C E8 75 F2 43 83 C1 04 AD 0B C0 78 06 3B C2 73 E5 EB 06 03 C3 78 DF 03 C2 2B C3 89 46 FC EB D6 E8 00 00 00 00 5F 81 C7 8D FF FF FF B0 E9 AA B8 9A 02 00 00 AB E8 00 00 00 00 58 05 1C 02 00 00 E9 0C 02 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MPRESS_V107_V125_MATCODE_Softwarenbsp_nbsp_SignByfly_20080730: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 58 05 9E 02 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 50 AD 2B C8 03 F1 8B C8 57 51 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 8B D6 8B CF E8 56 00 00 00 5E 5A 83 EA 05 2B C9 3B CA 73 26 8B D9 AC 41 24 FE 3C E8 75 F2 43 83 C1 04 AD 0B C0 78 06 3B C2 73 E5 EB 06 03 C3 78 DF 03 C2 2B C3 89 46 FC EB D6 E8 00 00 00 00 5F 81 C7 8D FF FF FF B0 E9 AA B8 9A 02 00 00 AB E8 00 00 00 00 58 05 1C 02 00 00 E9 0C 02 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SimbiOZ_Poly_21_Extranger_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 50 8B C4 83 C0 04 C7 00 ?? ?? ?? ?? 58 C3 90 }

Detection condition:
$a at pe.entry_point

Full rule:
rule SimbiOZ_Poly_21_Extranger_additional: PEiD
{
    strings:
        $a = { 55 50 8B C4 83 C0 04 C7 00 ?? ?? ?? ?? 58 C3 90 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: APatch_GUI_v11
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 52 31 C0 E8 FF FF FF FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule APatch_GUI_v11: PEiD
{
    strings:
        $a = { 52 31 C0 E8 FF FF FF FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Obsidium_V1364_Obsidium_Software_20090428
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 02 ?? ?? 50 EB 04 ?? ?? ?? ?? E8 29 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 1E EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 64 FF 30 EB 02 ?? ?? 64 89 20 EB 01 ?? EB 01 ?? 8B 00 EB 01 ?? C3 EB 02 ?? ?? E9 ?? ?? ?? ?? EB 02 ?? ?? E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsidium_V1364_Obsidium_Software_20090428: PEiD
{
    strings:
        $a = { EB 02 ?? ?? 50 EB 04 ?? ?? ?? ?? E8 29 00 00 00 EB 01 ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 1E EB 04 ?? ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 02 ?? ?? 33 C0 EB 04 ?? ?? ?? ?? 64 FF 30 EB 02 ?? ?? 64 89 20 EB 01 ?? EB 01 ?? 8B 00 EB 01 ?? C3 EB 02 ?? ?? E9 ?? ?? ?? ?? EB 02 ?? ?? E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: NME_11_Public_by_redlime_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 F0 53 56 B8 30 35 14 13 E8 9A E6 FF FF 33 C0 55 68 6C 36 14 13 64 FF 30 64 89 20 B8 08 5C 14 13 BA 84 36 14 13 E8 7D E2 FF FF E8 C0 EA FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 04 F8 FF FF 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 F4 F7 FF FF 8B }

Detection condition:
$a at pe.entry_point

Full rule:
rule NME_11_Public_by_redlime_additional: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 F0 53 56 B8 30 35 14 13 E8 9A E6 FF FF 33 C0 55 68 6C 36 14 13 64 FF 30 64 89 20 B8 08 5C 14 13 BA 84 36 14 13 E8 7D E2 FF FF E8 C0 EA FF FF 8B 15 CC 45 14 13 A1 C8 45 14 13 E8 04 F8 FF FF 8B 15 D0 45 14 13 A1 C8 45 14 13 E8 F4 F7 FF FF 8B }
    condition:
        $a at pe.entry_point

}