deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Armadillo_37x_Silicon_Realms_Toolworks
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 B8 3B 01 00 00 03 C5 33 DB 81 C3 01 01 01 01 31 18 81 38 78 54 00 00 74 04 31 18 EB EC }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_37x_Silicon_Realms_Toolworks: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 33 C9 75 02 EB 15 ?? 33 C9 75 18 7A 0C 70 0E EB 0D ?? 72 0E 79 F1 ?? ?? ?? 79 09 74 F0 ?? 87 DB 7A F0 ?? ?? 61 50 51 EB 0F ?? EB 0F ?? EB 07 ?? EB 0F ?? EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC ?? 59 58 60 9C 33 C0 E8 09 00 00 00 E8 E8 23 00 00 00 7A 23 ?? 8B 04 24 EB 03 7A 29 ?? C6 00 90 C3 ?? 70 F0 87 D2 71 07 ?? ?? 40 8B DB 7A 11 EB 08 ?? EB F7 EB C3 ?? 7A E9 70 DA 7B D1 71 F3 ?? 7B F3 71 D6 ?? 9D 61 83 ED 06 B8 3B 01 00 00 03 C5 33 DB 81 C3 01 01 01 01 31 18 81 38 78 54 00 00 74 04 31 18 EB EC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: GIF87a_Graphics_format
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 47 49 46 38 37 61 }

Detection condition:
$a at pe.entry_point

Full rule:
rule GIF87a_Graphics_format: PEiD
{
    strings:
        $a = { 47 49 46 38 37 61 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: OAZ_Fax_Graphics_format_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 0F 0F 0F 0F 01 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule OAZ_Fax_Graphics_format_Hint_FILE_START: PEiD
{
    strings:
        $a = { 0F 0F 0F 0F 01 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MSLRH_032a_fake_MSVCpp_DLL_Method_4_emadicius_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule MSLRH_032a_fake_MSVCpp_DLL_Method_4_emadicius_additional: PEiD
{
    strings:
        $a = { 55 8B EC 53 8B 5D 08 56 8B 75 0C 5E 5B 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: OptLink_Pass_2
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 87 C0 EB 0B 00 01 02 D8 01 00 00 02 00 00 00 FC 8C DA 83 C2 10 52 16 07 0E 1F 01 16 09 00 01 16 0D 00 33 F6 33 FF B9 00 00 F3 A5 06 B8 31 00 50 CB FD 8B 1E 00 00 B9 00 10 3B D9 77 02 8B CB 2B D9 8C D8 2B C1 8E D8 8C C0 2B C1 8E C0 03 C9 03 }

Detection condition:
$a at pe.entry_point

Full rule:
rule OptLink_Pass_2: PEiD
{
    strings:
        $a = { 87 C0 EB 0B 00 01 02 D8 01 00 00 02 00 00 00 FC 8C DA 83 C2 10 52 16 07 0E 1F 01 16 09 00 01 16 0D 00 33 F6 33 FF B9 00 00 F3 A5 06 B8 31 00 50 CB FD 8B 1E 00 00 B9 00 10 3B D9 77 02 8B CB 2B D9 8C D8 2B C1 8E D8 8C C0 2B C1 8E C0 03 C9 03 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Unknown_encryptor_2_PK7Tjrvx
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 06 B4 52 CD 21 07 E8 ?? ?? B4 62 CD 21 E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Unknown_encryptor_2_PK7Tjrvx: PEiD
{
    strings:
        $a = { 06 B4 52 CD 21 07 E8 ?? ?? B4 62 CD 21 E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_Resource_Cursors_file
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 02 00 01 00 20 20 00 00 ?? 00 ?? 00 E8 02 00 00 16 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_Resource_Cursors_file: PEiD
{
    strings:
        $a = { 00 00 02 00 01 00 20 20 00 00 ?? 00 ?? 00 E8 02 00 00 16 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SDProtector_Pro_Edition_116_Randy_Li_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41 }

Detection condition:
$a at pe.entry_point

Full rule:
rule SDProtector_Pro_Edition_116_Randy_Li_additional: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: eXPressor_10_beta_CGSoftLabs_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 53 03 00 00 8B F0 56 56 E8 98 03 00 00 8B C8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule eXPressor_10_beta_CGSoftLabs_additional: PEiD
{
    strings:
        $a = { E8 53 03 00 00 8B F0 56 56 E8 98 03 00 00 8B C8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Petite_v22_wwwun4seencompetite
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 00 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 }
        $b = { B8 00 ?0 ?? 00 6? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Petite_v22_wwwun4seencompetite: PEiD
{
    strings:
        $a = { B8 00 ?? ?? 00 ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 }
        $b = { B8 00 ?0 ?? 00 6? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: ASProtect_v11_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 60 E8 1B ?? ?? ?? E9 FC }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASProtect_v11_additional: PEiD
{
    strings:
        $a = { 90 60 E8 1B ?? ?? ?? E9 FC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: COMPACK_45
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE 00 00 E8 00 00 5D 83 C5 FA 55 50 53 51 52 0E 07 0E 1F 8B CE 8D 72 42 BF 82 FF D1 E9 FD 57 F3 A5 8D 75 02 FC F9 8B FD C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule COMPACK_45: PEiD
{
    strings:
        $a = { BE 00 00 E8 00 00 5D 83 C5 FA 55 50 53 51 52 0E 07 0E 1F 8B CE 8D 72 42 BF 82 FF D1 E9 FD 57 F3 A5 8D 75 02 FC F9 8B FD C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PC_Shrinker_v045_Virogen
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BD 01 AD E3 38 40 00 FF B5 DF 38 40 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PC_Shrinker_v045_Virogen: PEiD
{
    strings:
        $a = { BD 01 AD E3 38 40 00 FF B5 DF 38 40 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_v220b1_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 30 12 41 00 68 A4 A5 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_v220b1_additional: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 30 12 41 00 68 A4 A5 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_v300_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_v300_additional: PEiD
{
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Obsidium_V1353_Obsidium_Software_20080120
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 02 ?? ?? E8 2B 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 02 ?? ?? E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsidium_V1353_Obsidium_Software_20080120: PEiD
{
    strings:
        $a = { EB 02 ?? ?? E8 2B 00 00 00 EB 04 ?? ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 24 EB 02 ?? ?? 33 C0 EB 02 ?? ?? C3 EB 04 ?? ?? ?? ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? 8B 00 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 04 ?? ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 01 ?? 58 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 02 ?? ?? E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AntiDote_V12Demo_SIS_Team_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 F7 FE FF FF 05 CB 22 00 00 FF E0 E8 EB FE FF FF 05 BB 19 00 00 FF E0 E8 BD 00 00 00 08 B2 62 00 01 52 17 0C 0F 2C 2B 20 7F 52 79 01 30 07 17 29 4F 01 3C 30 2B 5A 3D C7 26 11 26 06 59 0E 78 2E 10 14 0B 13 1A 1A 3F 64 1D 71 33 57 21 09 24 8B 1B 09 37 08 }

Detection condition:
$a at pe.entry_point

Full rule:
rule AntiDote_V12Demo_SIS_Team_additional: PEiD
{
    strings:
        $a = { E8 F7 FE FF FF 05 CB 22 00 00 FF E0 E8 EB FE FF FF 05 BB 19 00 00 FF E0 E8 BD 00 00 00 08 B2 62 00 01 52 17 0C 0F 2C 2B 20 7F 52 79 01 30 07 17 29 4F 01 3C 30 2B 5A 3D C7 26 11 26 06 59 0E 78 2E 10 14 0B 13 1A 1A 3F 64 1D 71 33 57 21 09 24 8B 1B 09 37 08 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PE_Armor_046_Hying_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PE_Armor_046_Hying_additional: PEiD
{
    strings:
        $a = { E8 AA 00 00 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 3D ?? ?? 00 2D ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B ?? ?? 00 5C ?? ?? 00 6F ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: hyings_PEArmor_V07X_hying
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 55 56 81 C5 ?? ?? ?? ?? 55 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule hyings_PEArmor_V07X_hying: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? 8D B5 ?? ?? ?? ?? 55 56 81 C5 ?? ?? ?? ?? 55 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MPEG_Layer_IIIII_music_file
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FF F5 }
        $b = { FF F3 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule MPEG_Layer_IIIII_music_file: PEiD
{
    strings:
        $a = { FF F5 }
        $b = { FF F3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: _PseudoSigner_01_CrunchPE_Heuristic_Anorganix_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_CrunchPE_Heuristic_Anorganix_additional: PEiD
{
    strings:
        $a = { 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_02_DEF_10
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_02_DEF_10: PEiD
{
    strings:
        $a = { BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AsCrypt_V01_SToRM_SignByfly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B9 ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? ?? 83 04 24 04 ?? 90 90 90 83 E9 03 E2 EC EB ?? 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule AsCrypt_V01_SToRM_SignByfly: PEiD
{
    strings:
        $a = { B9 ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? ?? 83 04 24 04 ?? 90 90 90 83 E9 03 E2 EC EB ?? 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Private_EXE_20a_22
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 53 E8 00 00 00 00 5B 8B C3 2D 00 00 00 00 50 81 EB 06 10 40 00 8B 83 E7 10 40 00 81 38 64 A1 18 00 0F 85 A4 00 00 00 8D 83 23 11 40 00 50 FF 93 EB 10 40 00 0B C0 74 78 90 90 90 90 89 83 1F 11 40 00 8D 83 27 11 40 00 50 FF B3 1F 11 40 00 FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule Private_EXE_20a_22: PEiD
{
    strings:
        $a = { 53 E8 00 00 00 00 5B 8B C3 2D 00 00 00 00 50 81 EB 06 10 40 00 8B 83 E7 10 40 00 81 38 64 A1 18 00 0F 85 A4 00 00 00 8D 83 23 11 40 00 50 FF 93 EB 10 40 00 0B C0 74 78 90 90 90 90 89 83 1F 11 40 00 8D 83 27 11 40 00 50 FF B3 1F 11 40 00 FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: LameCrypt_v10
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 66 9C BB ?? ?? ?? ?? 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 }

Detection condition:
$a at pe.entry_point

Full rule:
rule LameCrypt_v10: PEiD
{
    strings:
        $a = { 60 66 9C BB ?? ?? ?? ?? 80 B3 00 10 40 00 90 4B 83 FB FF 75 F3 66 9D 61 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RLPack_V118_Basic_Edition_aPLib_or_LZMA_ap0x
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? 00 00 8D 9D ?? 02 00 00 33 FF E8 ?? 01 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RLPack_V118_Basic_Edition_aPLib_or_LZMA_ap0x: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? 00 00 8D 9D ?? 02 00 00 33 FF E8 ?? 01 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RJoiner_12_by_Vaska_25032007_1658
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 81 EC 0C 02 00 00 8D 85 F4 FD FF FF 56 50 68 04 01 00 00 FF 15 14 10 40 00 90 8D 85 F4 FD FF FF 50 FF 15 10 10 40 00 90 BE 00 20 40 00 90 83 3E FF 0F 84 84 00 00 00 53 57 33 FF 8D 46 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RJoiner_12_by_Vaska_25032007_1658: PEiD
{
    strings:
        $a = { 55 8B EC 81 EC 0C 02 00 00 8D 85 F4 FD FF FF 56 50 68 04 01 00 00 FF 15 14 10 40 00 90 8D 85 F4 FD FF FF 50 FF 15 10 10 40 00 90 BE 00 20 40 00 90 83 3E FF 0F 84 84 00 00 00 53 57 33 FF 8D 46 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXECryptor_v1401_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXECryptor_v1401_additional: PEiD
{
    strings:
        $a = { E8 24 00 00 00 8B 4C 24 0C C7 01 17 00 01 00 C7 81 B8 00 00 00 00 ?? ?? 00 31 C0 89 41 14 89 41 18 80 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPX_062_PE_DLL
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 58 83 E8 48 50 8D B8 00 00 00 FF 57 66 81 87 00 00 00 00 00 00 8D B0 F8 01 00 00 83 CD FF 31 DB EB 08 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPX_062_PE_DLL: PEiD
{
    strings:
        $a = { 80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 58 83 E8 48 50 8D B8 00 00 00 FF 57 66 81 87 00 00 00 00 00 00 8D B0 F8 01 00 00 83 CD FF 31 DB EB 08 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_300a_361_Silicon_Realms_Toolworks
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_300a_361_Silicon_Realms_Toolworks: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Protect_3031_COM
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 1E 06 0E 55 0E 1F 33 C0 8E C0 FA FC 26 A1 04 00 50 26 A1 06 00 50 26 A1 0C 00 50 26 A1 0E 00 50 8C C8 26 A3 06 00 26 C7 06 04 00 00 00 26 A3 0E 00 26 C7 06 0C 00 00 00 FB CD 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Protect_3031_COM: PEiD
{
    strings:
        $a = { 50 1E 06 0E 55 0E 1F 33 C0 8E C0 FA FC 26 A1 04 00 50 26 A1 06 00 50 26 A1 0C 00 50 26 A1 0E 00 50 8C C8 26 A3 06 00 26 C7 06 04 00 00 00 26 A3 0E 00 26 C7 06 0C 00 00 00 FB CD 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPX_V200_V290_Markus_Oberhumer_Laszlo_Molnar_John_Reiser
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FF D5 8D 87 ?? ?? ?? ?? 80 20 ?? 80 60 ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPX_V200_V290_Markus_Oberhumer_Laszlo_Molnar_John_Reiser: PEiD
{
    strings:
        $a = { FF D5 8D 87 ?? ?? ?? ?? 80 20 ?? 80 60 ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: VMProtect_1704_phpbb3
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 ?? ?? ?? ?? E8 ?? ?? ?? 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule VMProtect_1704_phpbb3: PEiD
{
    strings:
        $a = { 68 ?? ?? ?? ?? E8 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RLPack_FullEdition_V120_V121_BasicEdition_Stub_ap0x
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 10 00 00 08 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RLPack_FullEdition_V120_V121_BasicEdition_Stub_ap0x: PEiD
{
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 10 00 00 08 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PoPa_001_Packer_on_Pascal_bagie_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 A4 3E 00 10 E8 30 F6 FF FF 33 C0 55 68 BE 40 00 10 ?? ?? ?? ?? 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 62 E7 FF FF 8B 45 EC E8 32 F2 FF FF 50 E8 B4 F6 FF FF A3 64 66 00 10 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PoPa_001_Packer_on_Pascal_bagie_additional: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 EC 53 56 57 33 C0 89 45 EC B8 A4 3E 00 10 E8 30 F6 FF FF 33 C0 55 68 BE 40 00 10 ?? ?? ?? ?? 89 20 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 8D 55 EC 33 C0 E8 62 E7 FF FF 8B 45 EC E8 32 F2 FF FF 50 E8 B4 F6 FF FF A3 64 66 00 10 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PeStubOEP_v1x_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? ?? 00 FF E0 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PeStubOEP_v1x_additional: PEiD
{
    strings:
        $a = { B8 ?? ?? ?? 00 FF E0 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MinGW_GCC_2x
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 00 }
        $b = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 FC 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 FC 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 18 41 40 00 89 EC 5D }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule MinGW_GCC_2x: PEiD
{
    strings:
        $a = { 55 89 E5 ?? ?? ?? ?? ?? ?? FF FF ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 00 }
        $b = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 FC 40 40 00 E8 68 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 FC 40 40 00 E8 48 00 00 00 89 EC 31 C0 5D C3 89 F6 55 89 E5 83 EC 08 8B 55 08 89 14 24 FF 15 18 41 40 00 89 EC 5D }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: NoodleCrypt_v200_Eng_NoodleSpa_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 01 9A E8 76 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule NoodleCrypt_v200_Eng_NoodleSpa_additional: PEiD
{
    strings:
        $a = { EB 01 9A E8 76 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CorelDraw_8_CDR_Graphics_format
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 52 49 46 46 ?? ?? ?? ?? 43 44 52 38 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CorelDraw_8_CDR_Graphics_format: PEiD
{
    strings:
        $a = { 52 49 46 46 ?? ?? ?? ?? 43 44 52 38 }
    condition:
        $a at pe.entry_point

}