deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: EXE32Pack_v138_SteelBytes
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? 00 ?? ?? 00 3B DB 74 01 BE 5D 8B D5 81 ED DC 8D 40 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXE32Pack_v138_SteelBytes: PEiD
{
    strings:
        $a = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? 00 ?? ?? 00 3B DB 74 01 BE 5D 8B D5 81 ED DC 8D 40 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPXLock_v11_CyberDoom_Bob
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? 00 60 }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPXLock_v11_CyberDoom_Bob: PEiD
{
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? 00 60 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXECryptor_2223_compressed_code_wwwstrongbitcom
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50 }
        $b = { E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50 B8 C8 ?? ?? ?? 8B 04 18 FF D0 59 58 5B 83 EB 05 C6 03 B8 43 89 03 83 C3 04 C6 03 C3 09 C9 74 46 89 C3 E8 A0 00 00 00 FC AD 83 F8 FF 74 38 53 89 CB 01 C3 01 0B 83 C3 04 AC 3C FE 73 07 25 FF 00 00 00 EB ED 81 C3 FE 00 00 00 09 C0 7A 09 66 AD 25 FF FF 00 00 EB DA AD 4E 25 FF FF FF 00 3D FF FF FF 00 75 CC ?? ?? ?? ?? ?? C3 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule EXECryptor_2223_compressed_code_wwwstrongbitcom: PEiD
{
    strings:
        $a = { E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50 }
        $b = { E8 00 00 00 00 58 ?? ?? ?? ?? ?? 8B 1C 24 81 EB ?? ?? ?? ?? B8 ?? ?? ?? ?? 50 6A 04 68 00 10 00 00 50 6A 00 B8 C4 ?? ?? ?? 8B 04 18 FF D0 59 BA ?? ?? ?? ?? 01 DA 52 53 50 89 C7 89 D6 FC F3 A4 B9 ?? ?? ?? ?? 01 D9 FF D1 58 8B 1C 24 68 00 80 00 00 6A 00 50 B8 C8 ?? ?? ?? 8B 04 18 FF D0 59 58 5B 83 EB 05 C6 03 B8 43 89 03 83 C3 04 C6 03 C3 09 C9 74 46 89 C3 E8 A0 00 00 00 FC AD 83 F8 FF 74 38 53 89 CB 01 C3 01 0B 83 C3 04 AC 3C FE 73 07 25 FF 00 00 00 EB ED 81 C3 FE 00 00 00 09 C0 7A 09 66 AD 25 FF FF 00 00 EB DA AD 4E 25 FF FF FF 00 3D FF FF FF 00 75 CC ?? ?? ?? ?? ?? C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: MPRESS_V077b_MATCODE_Softwarenbsp_nbsp_SignByfly_20080313
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 0B 00 00 00 E8 77 00 00 00 61 E9 75 01 00 00 E8 00 00 00 00 58 05 75 01 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 AD 2B C8 03 F1 8B C8 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 2B C0 3B FE 73 3A AC 0A C0 74 35 8A C8 24 3F 80 E1 C0 C1 E0 10 66 AD 80 F9 C0 74 1C F6 C1 40 75 08 8B C8 2B C0 F3 AA EB D7 8B D6 8B CF 03 F0 E8 7E 00 00 00 03 F8 EB C8 8B C8 F3 A4 75 FC EB C0 C3 E8 00 00 00 00 5F 81 C7 79 FF FF FF B0 E9 AA B8 81 01 00 00 AB 2B FF E8 00 00 00 00 58 05 ED 00 00 00 8B 78 08 8B D7 8B 78 04 0B FF 74 42 8B 30 03 F0 2B F2 8B EE 8B 48 10 2B CD 74 33 8B 50 0C 03 F2 03 FE 2B C0 AD 3B F7 73 25 8B D8 AD 3B F7 73 1E 8B D0 83 EA 08 03 D6 66 AD 0A E4 74 0B 25 FF 0F 00 00 03 C3 03 C5 29 08 3B F2 73 D8 EB E9 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MPRESS_V077b_MATCODE_Softwarenbsp_nbsp_SignByfly_20080313: PEiD
{
    strings:
        $a = { 60 E8 0B 00 00 00 E8 77 00 00 00 61 E9 75 01 00 00 E8 00 00 00 00 58 05 75 01 00 00 8B 30 03 F0 2B C0 8B FE 66 AD C1 E0 0C 8B C8 AD 2B C8 03 F1 8B C8 49 8A 44 39 06 74 05 88 04 31 EB F4 88 04 31 2B C0 3B FE 73 3A AC 0A C0 74 35 8A C8 24 3F 80 E1 C0 C1 E0 10 66 AD 80 F9 C0 74 1C F6 C1 40 75 08 8B C8 2B C0 F3 AA EB D7 8B D6 8B CF 03 F0 E8 7E 00 00 00 03 F8 EB C8 8B C8 F3 A4 75 FC EB C0 C3 E8 00 00 00 00 5F 81 C7 79 FF FF FF B0 E9 AA B8 81 01 00 00 AB 2B FF E8 00 00 00 00 58 05 ED 00 00 00 8B 78 08 8B D7 8B 78 04 0B FF 74 42 8B 30 03 F0 2B F2 8B EE 8B 48 10 2B CD 74 33 8B 50 0C 03 F2 03 FE 2B C0 AD 3B F7 73 25 8B D8 AD 3B F7 73 1E 8B D0 83 EA 08 03 D6 66 AD 0A E4 74 0B 25 FF 0F 00 00 03 C3 03 C5 29 08 3B F2 73 D8 EB E9 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Inno_Setup_Module_v109a_JRSoftware
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 A7 7F FF FF E8 FA 92 FF FF E8 F1 B3 FF FF 33 C0 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Inno_Setup_Module_v109a_JRSoftware: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 A7 7F FF FF E8 FA 92 FF FF E8 F1 B3 FF FF 33 C0 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Setup_Factory_v6003_Setup_Launcher_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89 40 00 33 F6 56 E8 E0 00 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 E6 0F 00 00 FF 15 10 61 40 00 A3 40 8E 40 00 E8 A4 0E 00 00 A3 90 89 40 00 E8 4D 0C 00 00 E8 8F 0B 00 00 E8 22 FE FF FF 89 75 D0 8D 45 A4 50 FF 15 0C 61 40 00 E8 20 0B 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 08 61 40 00 50 E8 5A E9 FF FF 89 45 A0 50 E8 10 FE FF FF 8B 45 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Setup_Factory_v6003_Setup_Launcher_additional: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89 40 00 33 F6 56 E8 E0 00 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 E6 0F 00 00 FF 15 10 61 40 00 A3 40 8E 40 00 E8 A4 0E 00 00 A3 90 89 40 00 E8 4D 0C 00 00 E8 8F 0B 00 00 E8 22 FE FF FF 89 75 D0 8D 45 A4 50 FF 15 0C 61 40 00 E8 20 0B 00 00 89 45 9C F6 45 D0 01 74 06 0F B7 45 D4 EB 03 6A 0A 58 50 FF 75 9C 56 56 FF 15 08 61 40 00 50 E8 5A E9 FF FF 89 45 A0 50 E8 10 FE FF FF 8B 45 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Hafen809_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? 1C ?? 81 EE ?? ?? 50 1E 06 8C C8 8E D8 06 33 C0 8E C0 26 ?? ?? ?? 07 3D }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Hafen809_additional: PEiD
{
    strings:
        $a = { E8 ?? ?? 1C ?? 81 EE ?? ?? 50 1E 06 8C C8 8E D8 06 33 C0 8E C0 26 ?? ?? ?? 07 3D }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ANDpakk2_006_by_Dmitry_AND_Andreev
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 FC BE D4 00 40 00 BF 00 10 00 01 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ANDpakk2_006_by_Dmitry_AND_Andreev: PEiD
{
    strings:
        $a = { 60 FC BE D4 00 40 00 BF 00 10 00 01 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPX_v051
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 ?? ?? ?? ?? 58 83 E8 3D 50 8D B8 FF 57 8D B0 }
        $b = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 8D B0 D8 01 ?? ?? 83 CD FF 31 DB ?? ?? ?? ?? 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 0B 8A 06 46 88 07 47 EB EB 90 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule UPX_v051: PEiD
{
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 58 83 E8 3D 50 8D B8 FF 57 8D B0 }
        $b = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 ?? ?? ?? FF 57 8D B0 D8 01 ?? ?? 83 CD FF 31 DB ?? ?? ?? ?? 01 DB 75 07 8B 1E 83 EE FC 11 DB 73 0B 8A 06 46 88 07 47 EB EB 90 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Turbo_Pascal_Version_30_1985_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? E8 ?? ?? 06 00 ?? ?? ?? 4B 8E 04 85 00 00 04 ?? ?? ?? ?? ?? ?? 80 ?? ?? EC E8 ?? ?? 45 1B ?? ?? ?? A6 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Turbo_Pascal_Version_30_1985_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? E8 ?? ?? 06 00 ?? ?? ?? 4B 8E 04 85 00 00 04 ?? ?? ?? ?? ?? ?? 80 ?? ?? EC E8 ?? ?? 45 1B ?? ?? ?? A6 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPolyX_V01_Delikon_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E2 ?? FF ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPolyX_V01_Delikon_additional: PEiD
{
    strings:
        $a = { E2 ?? FF ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Quake518
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 1E 06 8C C8 8E D8 ?? ?? ?? ?? ?? ?? ?? B8 21 35 CD 21 81 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Quake518: PEiD
{
    strings:
        $a = { 1E 06 8C C8 8E D8 ?? ?? ?? ?? ?? ?? ?? B8 21 35 CD 21 81 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPXFreak_V01_HMX0101
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPXFreak_V01_HMX0101: PEiD
{
    strings:
        $a = { BE ?? ?? ?? ?? 83 C6 01 FF E6 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: NTkrnl_Secure_Suite_NTkrnl_Team_Blue_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 29 19 43 00 E8 01 00 00 00 C3 C3 A2 A9 61 4E A5 0E C7 A6 59 90 6E 4D 4C DB 36 46 FB 6E C4 45 A3 C2 2E 0E 41 59 1A 50 17 39 62 4D B8 61 24 8E CF D1 0E 9E 7A 66 C0 8D 6B 9C 52 7E 96 46 80 AF }

Detection condition:
$a at pe.entry_point

Full rule:
rule NTkrnl_Secure_Suite_NTkrnl_Team_Blue_additional: PEiD
{
    strings:
        $a = { 68 29 19 43 00 E8 01 00 00 00 C3 C3 A2 A9 61 4E A5 0E C7 A6 59 90 6E 4D 4C DB 36 46 FB 6E C4 45 A3 C2 2E 0E 41 59 1A 50 17 39 62 4D B8 61 24 8E CF D1 0E 9E 7A 66 C0 8D 6B 9C 52 7E 96 46 80 AF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_01_DxPack_10_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_01_DxPack_10_Anorganix: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: LHA_Archive
Repository: Yara-Rules/rules

Pattern signatures:
$a = { ?? ?? ?? 6C 68 35 }
        $b = { 6C 68 35 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule LHA_Archive: PEiD
{
    strings:
        $a = { ?? ?? ?? 6C 68 35 }
        $b = { 6C 68 35 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: ASPack_v21_Alexey_Solodovnikov
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 72 05 00 00 EB 33 87 DB 90 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASPack_v21_Alexey_Solodovnikov: PEiD
{
    strings:
        $a = { 60 E8 72 05 00 00 EB 33 87 DB 90 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASProtect_20
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 01 ?? 40 00 E8 01 00 00 00 C3 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASProtect_20: PEiD
{
    strings:
        $a = { 68 01 ?? 40 00 E8 01 00 00 00 C3 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_v110_Eng_dulekxt_Borland_Delphi_Microsoft_Visual_Cpp_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 1E 0E 1F B8 ?? ?? 8E C0 26 8A 1E ?? ?? 80 ?? ?? 72 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_v110_Eng_dulekxt_Borland_Delphi_Microsoft_Visual_Cpp_additional: PEiD
{
    strings:
        $a = { 1E 0E 1F B8 ?? ?? 8E C0 26 8A 1E ?? ?? 80 ?? ?? 72 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CreateInstall_Stub_v2003xx_Gentee
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CreateInstall_Stub_v2003xx_Gentee: PEiD
{
    strings:
        $a = { 81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Borland_Cpp
Repository: Yara-Rules/rules

Pattern signatures:
$a = { A1 C1 E0 02 }
        $b = { A1 ?? ?? ?? ?? C1 E0 02 A3 ?? ?? ?? ?? 57 51 33 C0 BF ?? ?? ?? ?? B9 ?? ?? ?? ?? 3B CF 76 05 2B CF FC F3 AA 59 5F }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Borland_Cpp: PEiD
{
    strings:
        $a = { A1 C1 E0 02 }
        $b = { A1 ?? ?? ?? ?? C1 E0 02 A3 ?? ?? ?? ?? 57 51 33 C0 BF ?? ?? ?? ?? B9 ?? ?? ?? ?? 3B CF 76 05 2B CF FC F3 AA 59 5F }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Upack_02x_beta_Dwing
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE 88 01 40 00 AD 8B F8 95 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_02x_beta_Dwing: PEiD
{
    strings:
        $a = { BE 88 01 40 00 AD 8B F8 95 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: TopSpeed_v301_1989_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 1E BA ?? ?? 8E DA 8B ?? ?? ?? 8B ?? ?? ?? FF ?? ?? ?? 50 53 }

Detection condition:
$a at pe.entry_point

Full rule:
rule TopSpeed_v301_1989_additional: PEiD
{
    strings:
        $a = { 1E BA ?? ?? 8E DA 8B ?? ?? ?? 8B ?? ?? ?? FF ?? ?? ?? 50 53 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: XorCopy_10
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 00 05 BB 03 01 BA 00 00 31 07 43 40 39 D3 75 F8 C6 06 00 01 E9 C6 06 01 01 00 C6 06 02 01 00 31 C0 31 DB 31 D2 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule XorCopy_10: PEiD
{
    strings:
        $a = { B8 00 05 BB 03 01 BA 00 00 31 07 43 40 39 D3 75 F8 C6 06 00 01 E9 C6 06 01 01 00 C6 06 02 01 00 31 C0 31 DB 31 D2 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MSLRH_032a_fake_PEtite_21_emadicius_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 2B 00 00 00 0D 0A 0D 0A 0D 0A 52 65 67 69 73 74 41 72 65 64 20 74 6F 3A 20 4E 4F 4E 2D 43 4F 4D 4D 45 52 43 49 41 4C 21 21 0D 0A 0D 0A 0D 00 58 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MSLRH_032a_fake_PEtite_21_emadicius_additional: PEiD
{
    strings:
        $a = { 60 E8 2B 00 00 00 0D 0A 0D 0A 0D 0A 52 65 67 69 73 74 41 72 65 64 20 74 6F 3A 20 4E 4F 4E 2D 43 4F 4D 4D 45 52 43 49 41 4C 21 21 0D 0A 0D 0A 0D 00 58 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: USSR_V031_SpiritST_Sign_by_fly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 2E 55 53 53 52 00 00 00 00 10 00 00 ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule USSR_V031_SpiritST_Sign_by_fly: PEiD
{
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 2E 55 53 53 52 00 00 00 00 10 00 00 ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SCRAM_v08a1_Hint_DOS_EP_p_5
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B4 30 CD 21 3C 02 77 ?? CD 20 BC ?? ?? B9 ?? ?? 8B FC B2 ?? 58 4C }

Detection condition:
$a at pe.entry_point

Full rule:
rule SCRAM_v08a1_Hint_DOS_EP_p_5: PEiD
{
    strings:
        $a = { B4 30 CD 21 3C 02 77 ?? CD 20 BC ?? ?? B9 ?? ?? 8B FC B2 ?? 58 4C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPack_Alt_Stub_Dwing
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 09 00 00 00 C3 F6 00 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPack_Alt_Stub_Dwing: PEiD
{
    strings:
        $a = { 60 E8 09 00 00 00 C3 F6 00 00 E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RCryptor_16_by_Vaska_Damrai_sign_20032007_2041
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 2C 24 4F 68 40 A1 14 13 FF 54 24 04 83 44 24 04 4F B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 2B 40 EB F3 B8 8C 20 18 13 3D B9 27 18 13 74 06 80 30 19 40 EB F3 E8 00 00 00 00 C3 }
        $b = { 33 D0 68 40 A1 14 13 FF D2 B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 BB 40 EB F3 33 C0 C3 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule RCryptor_16_by_Vaska_Damrai_sign_20032007_2041: PEiD
{
    strings:
        $a = { 83 2C 24 4F 68 40 A1 14 13 FF 54 24 04 83 44 24 04 4F B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 2B 40 EB F3 B8 8C 20 18 13 3D B9 27 18 13 74 06 80 30 19 40 EB F3 E8 00 00 00 00 C3 }
        $b = { 33 D0 68 40 A1 14 13 FF D2 B8 00 10 14 13 3D 24 C0 14 13 74 06 80 30 BB 40 EB F3 33 C0 C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Unknown_SFX_Archive_MRI
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 4D 52 49 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Unknown_SFX_Archive_MRI: PEiD
{
    strings:
        $a = { 4D 52 49 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SVKP_v132_Pavol_Cerven_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61 }

Detection condition:
$a at pe.entry_point

Full rule:
rule SVKP_v132_Pavol_Cerven_h: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 0C 61 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 18 61 00 00 5D 6A FF FF 95 10 61 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: XPack_097_098_DLL_JoKo
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 ?? ?? ?? 00 9C 60 E8 ?? ?? 00 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 44 ?? ?? 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 ?? ?? 00 62 ?? ?? 00 71 ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule XPack_097_098_DLL_JoKo: PEiD
{
    strings:
        $a = { 68 ?? ?? ?? 00 9C 60 E8 ?? ?? 00 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 44 ?? ?? 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 51 ?? ?? 00 62 ?? ?? 00 71 ?? ?? 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Turbo_Pascal_Help_File
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 54 55 52 ?? ?? ?? 50 41 53 ?? ?? ?? ?? 48 45 4C 50 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Turbo_Pascal_Help_File: PEiD
{
    strings:
        $a = { 54 55 52 ?? ?? ?? 50 41 53 ?? ?? ?? ?? 48 45 4C 50 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_Patch_Dwing_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 2A A3 F2 54 CE }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_Patch_Dwing_additional: PEiD
{
    strings:
        $a = { 2A A3 F2 54 CE }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RLPack_120_Basic_Edition_LZMA_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RLPack_120_Basic_Edition_LZMA_additional: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 9C 0C 00 00 EB 0C 8B 85 98 0C 00 00 89 85 9C 0C 00 00 8D B5 C4 0C 00 00 8D 9D 82 04 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 2D 0C 00 00 89 85 94 0C 00 00 E8 59 }
    condition:
        $a at pe.entry_point

}