deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: SQZ_Archive_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 48 4C 53 51 5A }

Detection condition:
$a at pe.entry_point

Full rule:
rule SQZ_Archive_Hint_FILE_START: PEiD
{
    strings:
        $a = { 48 4C 53 51 5A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: WWPACK_v305c4_Unextr_Passwcheck_Vir_shield_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 03 05 C0 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule WWPACK_v305c4_Unextr_Passwcheck_Vir_shield_additional: PEiD
{
    strings:
        $a = { 03 05 C0 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SimplePack_111_Method_2NT_bagieTMX_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule SimplePack_111_Method_2NT_bagieTMX_additional: PEiD
{
    strings:
        $a = { 4D 5A 90 EB 01 00 52 E9 89 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_v131_Eng_dulekxt
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB }
        $b = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B6 00 56 8B F7 2B F0 F3 A4 5E EB 97 33 C9 41 FF D3 13 C9 FF D3 72 F8 C3 02 D2 75 05 8A 16 46 12 D2 C3 5B 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 58 FF FF FF 5F BB ?? ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 89 06 AD 85 C0 75 D9 8B EC C3 ?? ?

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule FSG_v131_Eng_dulekxt: PEiD
{
    strings:
        $a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB }
        $b = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 BB ?? ?? ?? 00 B2 80 A4 B6 80 FF D3 73 F9 33 C9 FF D3 73 16 33 C0 FF D3 73 23 B6 80 41 B0 10 FF D3 12 C0 73 FA 75 42 AA EB E0 E8 46 00 00 00 02 F6 83 D9 01 75 10 E8 38 00 00 00 EB 28 AC D1 E8 74 48 13 C9 EB 1C 91 48 C1 E0 08 AC E8 22 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B6 00 56 8B F7 2B F0 F3 A4 5E EB 97 33 C9 41 FF D3 13 C9 FF D3 72 F8 C3 02 D2 75 05 8A 16 46 12 D2 C3 5B 5B 0F B7 3B 4F 74 08 4F 74 13 C1 E7 0C EB 07 8B 7B 02 57 83 C3 04 43 43 E9 58 FF FF FF 5F BB ?? ?? ?? 00 47 8B 37 AF 57 FF 13 95 33 C0 AE 75 FD FE 0F 74 EF FE 0F 75 06 47 FF 37 AF EB 09 FE 0F 0F 84 ?? ?? ?? FF 57 55 FF 53 04 89 06 AD 85 C0 75 D9 8B EC C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00 88 01 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: _028_beta_shoooo
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B }

Detection condition:
$a at pe.entry_point

Full rule:
rule _028_beta_shoooo: PEiD
{
    strings:
        $a = { 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 60 8B 74 24 24 8B }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_01_WATCOM_CCpp_EXE_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 00 00 00 00 90 90 90 90 57 41 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_01_WATCOM_CCpp_EXE_Anorganix: PEiD
{
    strings:
        $a = { E9 00 00 00 00 90 90 90 90 57 41 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_LTC_13_Anorganix_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_LTC_13_Anorganix_additional: PEiD
{
    strings:
        $a = { 54 E8 00 00 00 00 5D 8B C5 81 ED F6 73 40 00 2B 85 87 75 40 00 83 E8 06 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: XM_music_file
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 45 78 74 65 6E 64 65 64 20 4D 6F 64 75 6C 65 3A }

Detection condition:
$a at pe.entry_point

Full rule:
rule XM_music_file: PEiD
{
    strings:
        $a = { 45 78 74 65 6E 64 65 64 20 4D 6F 64 75 6C 65 3A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Zurenava_DOS_Extender_v045_v049
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE ?? ?? BF ?? ?? B9 ?? ?? 56 FC F3 A5 5F E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Zurenava_DOS_Extender_v045_v049: PEiD
{
    strings:
        $a = { BE ?? ?? BF ?? ?? B9 ?? ?? 56 FC F3 A5 5F E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ZipWorxSecureEXE_v25_ZipWORX_Technologies_LLC
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 B8 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ZipWorxSecureEXE_v25_ZipWORX_Technologies_LLC: PEiD
{
    strings:
        $a = { E9 B8 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 53 65 63 75 72 65 45 58 45 20 45 78 65 63 75 74 61 62 6C 65 20 46 69 6C 65 20 50 72 6F 74 65 63 74 6F 72 0D 0A 43 6F 70 79 72 69 67 68 74 28 63 29 20 32 30 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PolyCrypt_PE_214b215_JLab_Software_Creations_h_oep
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 91 8B F4 AD FE C9 80 34 08 ?? E2 FA C3 60 E8 ED FF FF FF EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule PolyCrypt_PE_214b215_JLab_Software_Creations_h_oep: PEiD
{
    strings:
        $a = { 91 8B F4 AD FE C9 80 34 08 ?? E2 FA C3 60 E8 ED FF FF FF EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_v0977_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 49 87 40 ?? 87 DD 8B 85 CE 87 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_v0977_additional: PEiD
{
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 49 87 40 ?? 87 DD 8B 85 CE 87 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FreeBasic_014_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? 00 E8 ?? FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D }

Detection condition:
$a at pe.entry_point

Full rule:
rule FreeBasic_014_additional: PEiD
{
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? 00 E8 ?? FF FF FF 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 89 E5 83 EC 08 8B 45 08 89 04 24 FF 15 ?? ?? ?? 00 89 EC 5D }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: nPack_v11xxx_NEOx_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 3D ?? ?? ?? 00 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 08 ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 ?? 02 00 00 E8 ?? 06 00 00 E8 ?? 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? 00 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule nPack_v11xxx_NEOx_additional: PEiD
{
    strings:
        $a = { 83 3D ?? ?? ?? 00 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 08 ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 ?? 02 00 00 E8 ?? 06 00 00 E8 ?? 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? 00 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXE_Stealth_V27X_WebtoolMaster_20080109
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 65 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 E8 00 00 00 00 5D 81 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? ?? ?? 04 ?? ?? 01 EB 05 ?? ?? ?? ?? ?? EB 00 EB 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXE_Stealth_V27X_WebtoolMaster_20080109: PEiD
{
    strings:
        $a = { EB 65 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 60 E8 00 00 00 00 5D 81 ?? ?? ?? ?? ?? B9 ?? ?? ?? ?? ?? ?? 04 ?? ?? 01 EB 05 ?? ?? ?? ?? ?? EB 00 EB 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: tElock_v098b2_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 1B E4 FF FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule tElock_v098b2_additional: PEiD
{
    strings:
        $a = { E9 1B E4 FF FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASPack_v212_Alexey_Solodovnikov
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASPack_v212_Alexey_Solodovnikov: PEiD
{
    strings:
        $a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASPack_v104b
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 75 ?? }
        $b = { 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 12 9D ?? 89 85 1E 9D ?? ?? 80 BD 08 9D }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule ASPack_v104b: PEiD
{
    strings:
        $a = { 75 ?? }
        $b = { 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? B8 ?? ?? ?? ?? 03 C5 2B 85 ?? 12 9D ?? 89 85 1E 9D ?? ?? 80 BD 08 9D }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: FSG_v110_Eng_dulekxt_Microsoft_Visual_C_Basic_NET_
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 77 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_v110_Eng_dulekxt_Microsoft_Visual_C_Basic_NET_: PEiD
{
    strings:
        $a = { EB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 77 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MSLRH_v032a_fake_PE_Lock_NT_204_emadicius_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 EB EB 03 CD 20 03 61 9D 83 C4 04 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule MSLRH_v032a_fake_PE_Lock_NT_204_emadicius_h: PEiD
{
    strings:
        $a = { EB 03 CD 20 C7 1E EB 03 CD 20 EA 9C EB 02 EB 01 EB 01 EB 60 EB 03 CD 20 EB EB 01 EB E8 03 00 00 00 E9 EB 04 58 40 50 C3 EB 03 CD 20 EB EB 03 CD 20 03 61 9D 83 C4 04 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Bitlock_31_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB ?? B4 30 CD 21 3C 03 72 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Bitlock_31_Hint_DOS_EP: PEiD
{
    strings:
        $a = { EB ?? B4 30 CD 21 3C 03 72 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXE2COM_Method_4_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? E8 ?? ?? 5D 8B CD 83 ?? ?? BF ?? ?? BE ?? ?? 2B CF F3 A4 B9 ?? ?? BE }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXE2COM_Method_4_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? E8 ?? ?? 5D 8B CD 83 ?? ?? BF ?? ?? BE ?? ?? 2B CF F3 A4 B9 ?? ?? BE }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: nSpack_V13_LiuXingPing
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule nSpack_V13_LiuXingPing: PEiD
{
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: WATCOM_CCpp_Run_Time_systempDOS4GW_DOS_Extender_1988_93
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BF ?? ?? 8E D7 81 C4 ?? ?? BE ?? ?? 2B F7 8B C6 B1 ?? D3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule WATCOM_CCpp_Run_Time_systempDOS4GW_DOS_Extender_1988_93: PEiD
{
    strings:
        $a = { BF ?? ?? 8E D7 81 C4 ?? ?? BE ?? ?? 2B F7 8B C6 B1 ?? D3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PKLITE_v120_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 B4 4C CD 21 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PKLITE_v120_additional: PEiD
{
    strings:
        $a = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 72 ?? B4 09 BA ?? ?? CD 21 B4 4C CD 21 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: TaiShanXiangYu_LockSoft_DLL_V10_zlocksoft
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED E3 00 42 00 8B D5 81 C2 32 01 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 }
        $b = { 60 E8 00 00 00 00 5D 81 ED E3 00 42 00 8B D5 81 C2 32 01 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 AF 28 42 00 81 E9 DD 01 42 00 8B D5 81 C2 DD 01 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 78 20 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule TaiShanXiangYu_LockSoft_DLL_V10_zlocksoft: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED E3 00 42 00 8B D5 81 C2 32 01 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 }
        $b = { 60 E8 00 00 00 00 5D 81 ED E3 00 42 00 8B D5 81 C2 32 01 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 AF 28 42 00 81 E9 DD 01 42 00 8B D5 81 C2 DD 01 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 78 20 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: CAN2EXE_v001
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 26 8E 06 ?? ?? B9 ?? ?? 33 C0 8B F8 F2 AE E3 ?? 26 38 05 75 ?? EB ?? E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CAN2EXE_v001: PEiD
{
    strings:
        $a = { 26 8E 06 ?? ?? B9 ?? ?? 33 C0 8B F8 F2 AE E3 ?? 26 38 05 75 ?? EB ?? E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SimplePack_V10X_bagie_Sign_by_fly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5B 8D 5B FA 6A 00 FF 93 ?? ?? 00 00 89 C5 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 8B 86 88 00 00 00 09 C0 }

Detection condition:
$a at pe.entry_point

Full rule:
rule SimplePack_V10X_bagie_Sign_by_fly: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5B 8D 5B FA 6A 00 FF 93 ?? ?? 00 00 89 C5 8B 7D 3C 8D 74 3D 00 8D BE F8 00 00 00 8B 86 88 00 00 00 09 C0 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PEBundle_v02_v20x
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PEBundle_v02_v20x: PEiD
{
    strings:
        $a = { 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB ?? ?? 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: HACKSTOP_v111c
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 ?? CD 21 B0 ?? B4 4C CD 21 53 BB ?? ?? 5B EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule HACKSTOP_v111c: PEiD
{
    strings:
        $a = { B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 ?? CD 21 B0 ?? B4 4C CD 21 53 BB ?? ?? 5B EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MEW_10_by_Northfox_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 33 C0 E9 ?? ?? FF FF ?? 1C ?? ?? 40 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MEW_10_by_Northfox_additional: PEiD
{
    strings:
        $a = { 33 C0 E9 ?? ?? FF FF ?? 1C ?? ?? 40 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ProPack_214_m1_EXE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 0E 8C D3 8E C3 8C CA 8E DA 8B 0E 08 00 8B F1 83 EE 02 8B FE D1 E9 FD F3 A5 53 B8 35 00 50 8B 2E 0A 00 03 16 0C 00 CB B8 00 10 3B C5 76 02 8B C5 2B E8 2B D8 2B D0 8E DA 8E C3 B1 03 D3 E0 8B C8 D1 E0 48 48 8B F0 8B F8 F3 A5 0B ED 75 D9 FC 07 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ProPack_214_m1_EXE: PEiD
{
    strings:
        $a = { 0E 8C D3 8E C3 8C CA 8E DA 8B 0E 08 00 8B F1 83 EE 02 8B FE D1 E9 FD F3 A5 53 B8 35 00 50 8B 2E 0A 00 03 16 0C 00 CB B8 00 10 3B C5 76 02 8B C5 2B E8 2B D8 2B D0 8E DA 8E C3 B1 03 D3 E0 8B C8 D1 E0 48 48 8B F0 8B F8 F3 A5 0B ED 75 D9 FC 07 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: WordPerfect_Graphics_format
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FF 57 50 43 10 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule WordPerfect_Graphics_format: PEiD
{
    strings:
        $a = { FF 57 50 43 10 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Stones_PE_Encrypter_10
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 63 3A 40 00 2B 95 C2 3A 40 00 83 EA 0B 89 95 CB 3A 40 00 8D B5 CA 3A 40 00 0F B6 36 8B FD 8D 9D CB 3A 40 00 8B 1B 8D 87 CF 3A 40 00 8B 00 03 D8 8D 8F D3 3A 40 00 8B 09 80 2B 01 43 E2 FA 83 C7 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Stones_PE_Encrypter_10: PEiD
{
    strings:
        $a = { 55 57 56 52 51 53 E8 00 00 00 00 5D 8B D5 81 ED 63 3A 40 00 2B 95 C2 3A 40 00 83 EA 0B 89 95 CB 3A 40 00 8D B5 CA 3A 40 00 0F B6 36 8B FD 8D 9D CB 3A 40 00 8B 1B 8D 87 CF 3A 40 00 8B 00 03 D8 8D 8F D3 3A 40 00 8B 09 80 2B 01 43 E2 FA 83 C7 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Watcom_C_1994
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FB B9 00 0B 8E C1 26 BB 00 09 83 C3 0F 80 E3 F0 26 89 1E 00 03 26 8C 1E 00 03 01 E3 83 C3 0F 80 E3 F0 8E D1 89 DC 26 89 1E 00 03 89 DA D1 EA D1 EA D1 EA D1 EA 26 80 3E 00 03 00 75 3F 8B 0E 02 00 8C C0 29 C1 39 CA 72 0D BB 01 00 B8 00 00 8C }

Detection condition:
$a at pe.entry_point

Full rule:
rule Watcom_C_1994: PEiD
{
    strings:
        $a = { FB B9 00 0B 8E C1 26 BB 00 09 83 C3 0F 80 E3 F0 26 89 1E 00 03 26 8C 1E 00 03 01 E3 83 C3 0F 80 E3 F0 8E D1 89 DC 26 89 1E 00 03 89 DA D1 EA D1 EA D1 EA D1 EA 26 80 3E 00 03 00 75 3F 8B 0E 02 00 8C C0 29 C1 39 CA 72 0D BB 01 00 B8 00 00 8C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Watcom_C_1995
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FB B9 00 00 8E C1 26 BB 00 00 83 C3 0F 80 E3 F0 26 89 1E 00 00 26 8C 1E 00 00 01 E3 83 C3 0F 80 E3 F0 8E D1 89 DC 26 89 1E 00 00 89 DA D1 EA D1 EA D1 EA D1 EA 26 80 3E 00 00 00 75 3D 8B 0E 02 00 8C C0 29 C1 39 CA 72 0B BB 01 00 B8 00 00 8C }

Detection condition:
$a at pe.entry_point

Full rule:
rule Watcom_C_1995: PEiD
{
    strings:
        $a = { FB B9 00 00 8E C1 26 BB 00 00 83 C3 0F 80 E3 F0 26 89 1E 00 00 26 8C 1E 00 00 01 E3 83 C3 0F 80 E3 F0 8E D1 89 DC 26 89 1E 00 00 89 DA D1 EA D1 EA D1 EA D1 EA 26 80 3E 00 00 00 75 3D 8B 0E 02 00 8C C0 29 C1 39 CA 72 0B BB 01 00 B8 00 00 8C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: bambam_V001_bedrock_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1 }

Detection condition:
$a at pe.entry_point

Full rule:
rule bambam_V001_bedrock_additional: PEiD
{
    strings:
        $a = { 6A 14 E8 9A 05 00 00 8B D8 53 68 ?? ?? ?? ?? E8 6C FD FF FF B9 05 00 00 00 8B F3 BF ?? ?? ?? ?? 53 F3 A5 E8 8D 05 00 00 8B 3D ?? ?? ?? ?? A1 ?? ?? ?? ?? 66 8B 15 ?? ?? ?? ?? B9 ?? ?? ?? ?? 2B CF 89 45 E8 89 0D ?? ?? ?? ?? 66 89 55 EC 8B 41 3C 33 D2 03 C1 }
    condition:
        $a at pe.entry_point

}