deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: ExeJoiner_10_Yoda
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 E8 E2 02 00 00 83 F8 FF 0F 84 6D 02 00 00 A3 0C 12 40 00 8B D8 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 E3 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1E 12 40 00 FF 35 08 12 40 00 E8 C4 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ExeJoiner_10_Yoda: PEiD
{
    strings:
        $a = { 68 00 10 40 00 68 04 01 00 00 E8 39 03 00 00 05 00 10 40 00 C6 00 5C 68 04 01 00 00 68 04 11 40 00 6A 00 E8 1A 03 00 00 6A 00 68 80 00 00 00 6A 03 6A 00 6A 01 68 00 00 00 80 68 04 11 40 00 E8 EC 02 00 00 83 F8 FF 0F 84 83 02 00 00 A3 08 12 40 00 6A 00 50 E8 E2 02 00 00 83 F8 FF 0F 84 6D 02 00 00 A3 0C 12 40 00 8B D8 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 E8 E3 02 00 00 6A 00 68 3C 12 40 00 6A 04 68 1E 12 40 00 FF 35 08 12 40 00 E8 C4 02 00 00 83 EB 04 6A 00 6A 00 53 FF 35 08 12 40 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PEZip_10_by_BaGIE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { D9 D0 F8 74 02 23 DB F5 F5 50 51 52 53 8D 44 24 10 50 55 56 57 D9 D0 22 C9 C1 F7 A0 55 66 C1 C8 B0 5D 81 E6 FF FF FF FF F8 77 07 52 76 03 72 01 90 5A C1 E0 60 90 BD 1F 01 00 00 87 E8 E2 07 E3 05 17 5D 47 E4 42 41 7F 06 50 66 83 EE 00 58 25 FF FF FF FF 51 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PEZip_10_by_BaGIE: PEiD
{
    strings:
        $a = { D9 D0 F8 74 02 23 DB F5 F5 50 51 52 53 8D 44 24 10 50 55 56 57 D9 D0 22 C9 C1 F7 A0 55 66 C1 C8 B0 5D 81 E6 FF FF FF FF F8 77 07 52 76 03 72 01 90 5A C1 E0 60 90 BD 1F 01 00 00 87 E8 E2 07 E3 05 17 5D 47 E4 42 41 7F 06 50 66 83 EE 00 58 25 FF FF FF FF 51 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Special_EXE_Pasword_Protector_v101_Eng_Pavol_Cerven_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 00 00 8D 95 C6 77 00 00 8D 8D FF 77 00 00 55 68 00 20 00 00 51 52 6A 00 FF 95 04 7A 00 00 5D 6A 00 FF 95 FC 79 00 00 8D 8D 60 78 00 00 8D 95 85 01 00 00 55 68 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Special_EXE_Pasword_Protector_v101_Eng_Pavol_Cerven_additional: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 00 00 8D 95 C6 77 00 00 8D 8D FF 77 00 00 55 68 00 20 00 00 51 52 6A 00 FF 95 04 7A 00 00 5D 6A 00 FF 95 FC 79 00 00 8D 8D 60 78 00 00 8D 95 85 01 00 00 55 68 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EncryptPE_V220080618_V220090726_WFS_20090822
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 5D 5F 8B 45 00 83 F8 00 0F 85 87 01 00 00 89 E8 83 C0 24 50 FF 14 2F 89 45 00 89 E8 83 C0 31 50 FF 75 00 FF 54 2F 04 89 45 04 89 E8 83 C0 3E 50 FF 75 00 FF 54 2F 04 89 45 08 89 E8 83 C0 4A 50 FF 75 00 FF 54 2F 04 89 45 0C 89 E8 83 C0 5D 50 FF 75 00 FF 54 2F 04 89 45 10 89 E8 83 C0 6B 50 FF 75 00 FF 54 2F 04 89 45 14 89 E8 83 C0 7B 50 FF 75 00 FF 54 2F 04 89 45 18 89 E8 05 87 00 00 00 50 FF 75 00 FF 54 2F 04 89 45 1C 89 E8 05 94 00 00 00 50 FF 75 00 FF 54 2F 04 89 45 20 89 E8 83 C0 24 50 68 04 01 00 00 FF 55 04 83 F8 04 0F 8C 07 01 00 00 01 E8 83 C0 23 8A 10 80 FA 5C 74 04 40 C6 00 5C 31 C9 8A 94 29 29 01 00 00 88 54 01 01 80 FA 00 74 03 41 EB ED 8B 85 49 01 00 00 83 F8 00 0F 84 87 00 00 00 6A 00 68 80 00 00 00 6A 04 6A 00 6A 00 68 00 00 00 C0 89 E8 83 C0 24 50 FF 55 08 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EncryptPE_V220080618_V220090726_WFS_20090822: PEiD
{
    strings:
        $a = { 5D 5F 8B 45 00 83 F8 00 0F 85 87 01 00 00 89 E8 83 C0 24 50 FF 14 2F 89 45 00 89 E8 83 C0 31 50 FF 75 00 FF 54 2F 04 89 45 04 89 E8 83 C0 3E 50 FF 75 00 FF 54 2F 04 89 45 08 89 E8 83 C0 4A 50 FF 75 00 FF 54 2F 04 89 45 0C 89 E8 83 C0 5D 50 FF 75 00 FF 54 2F 04 89 45 10 89 E8 83 C0 6B 50 FF 75 00 FF 54 2F 04 89 45 14 89 E8 83 C0 7B 50 FF 75 00 FF 54 2F 04 89 45 18 89 E8 05 87 00 00 00 50 FF 75 00 FF 54 2F 04 89 45 1C 89 E8 05 94 00 00 00 50 FF 75 00 FF 54 2F 04 89 45 20 89 E8 83 C0 24 50 68 04 01 00 00 FF 55 04 83 F8 04 0F 8C 07 01 00 00 01 E8 83 C0 23 8A 10 80 FA 5C 74 04 40 C6 00 5C 31 C9 8A 94 29 29 01 00 00 88 54 01 01 80 FA 00 74 03 41 EB ED 8B 85 49 01 00 00 83 F8 00 0F 84 87 00 00 00 6A 00 68 80 00 00 00 6A 04 6A 00 6A 00 68 00 00 00 C0 89 E8 83 C0 24 50 FF 55 08 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MEW_5_10_Northfox_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE 48 01 ?? ?? ?? ?? ?? 95 A5 33 C0 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MEW_5_10_Northfox_additional: PEiD
{
    strings:
        $a = { BE 48 01 ?? ?? ?? ?? ?? 95 A5 33 C0 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXE2COM_Encrypted_without_selfcheck_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B3 ?? B9 ?? ?? BE ?? ?? BF ?? ?? EB ?? 54 69 ?? ?? ?? ?? 03 ?? ?? 32 C3 AA 43 49 E3 ?? EB ?? BE ?? ?? 8B C6 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXE2COM_Encrypted_without_selfcheck_additional: PEiD
{
    strings:
        $a = { B3 ?? B9 ?? ?? BE ?? ?? BF ?? ?? EB ?? 54 69 ?? ?? ?? ?? 03 ?? ?? 32 C3 AA 43 49 E3 ?? EB ?? BE ?? ?? 8B C6 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_v156_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 90 40 ?? 87 DD 8B 85 A2 90 40 ?? 01 85 03 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 9E 90 40 ?? BB 2D 12 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_v156_additional: PEiD
{
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 90 40 ?? 87 DD 8B 85 A2 90 40 ?? 01 85 03 90 40 ?? 66 C7 85 ?? 90 40 ?? 90 90 01 85 9E 90 40 ?? BB 2D 12 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ChSfx_small_v11
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BA ?? ?? E8 ?? ?? 8B EC 83 EC ?? 8C C8 BB ?? ?? B1 ?? D3 EB 03 C3 8E D8 05 ?? ?? 89 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ChSfx_small_v11: PEiD
{
    strings:
        $a = { BA ?? ?? E8 ?? ?? 8B EC 83 EC ?? 8C C8 BB ?? ?? B1 ?? D3 EB 03 C3 8E D8 05 ?? ?? 89 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: COM2TXT_120_141
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 54 5F 4F 4F 57 57 33 3D 58 58 57 58 50 59 35 30 50 50 5A 35 6A 51 50 5F 2D 79 73 2C 41 31 45 61 35 79 38 35 32 63 50 34 5A 34 50 50 2D 70 56 34 30 50 2D 42 4F 75 0D 0A 00 00 00 00 00 00 00 00 00 00 00 00 35 55 71 50 57 58 2C 77 50 35 30 30 }

Detection condition:
$a at pe.entry_point

Full rule:
rule COM2TXT_120_141: PEiD
{
    strings:
        $a = { 54 5F 4F 4F 57 57 33 3D 58 58 57 58 50 59 35 30 50 50 5A 35 6A 51 50 5F 2D 79 73 2C 41 31 45 61 35 79 38 35 32 63 50 34 5A 34 50 50 2D 70 56 34 30 50 2D 42 4F 75 0D 0A 00 00 00 00 00 00 00 00 00 00 00 00 35 55 71 50 57 58 2C 77 50 35 30 30 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Freshbind_v20_gFresh
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 64 A1 00 00 00 00 55 89 E5 6A FF 68 1C A0 41 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Freshbind_v20_gFresh: PEiD
{
    strings:
        $a = { 64 A1 00 00 00 00 55 89 E5 6A FF 68 1C A0 41 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Borland_Delphi_40
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Borland_Delphi_40: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Keypress1212
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? E8 ?? ?? E8 ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EA ?? ?? ?? ?? 1E 33 DB 8E DB BB }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Keypress1212: PEiD
{
    strings:
        $a = { E8 ?? ?? E8 ?? ?? E8 ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EA ?? ?? ?? ?? 1E 33 DB 8E DB BB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ADEX_Graphics_format
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 49 43 54 00 08 ?? 02 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ADEX_Graphics_format: PEiD
{
    strings:
        $a = { 50 49 43 54 00 08 ?? 02 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ExeSafeguard_10_simonzh_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE }

Detection condition:
$a at pe.entry_point

Full rule:
rule ExeSafeguard_10_simonzh_h: PEiD
{
    strings:
        $a = { C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PKLITE_v200c_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 B8 ?? ?? BA ?? ?? 3B C4 73 ?? 8B C4 2D ?? ?? 25 ?? ?? 8B F8 B9 ?? ?? BE ?? ?? FC }

Detection condition:
$a at pe.entry_point

Full rule:
rule PKLITE_v200c_additional: PEiD
{
    strings:
        $a = { 50 B8 ?? ?? BA ?? ?? 3B C4 73 ?? 8B C4 2D ?? ?? 25 ?? ?? 8B F8 B9 ?? ?? BE ?? ?? FC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_FSG_131_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_FSG_131_Anorganix: PEiD
{
    strings:
        $a = { BE 90 90 90 00 BF 90 90 90 00 BB 90 90 90 00 53 BB 90 90 90 00 B2 80 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: WATCOM_C_Protected_Mode_386_486_1988_92_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? FB B9 ?? ?? 8E C1 BB ?? ?? 83 ?? ?? 80 ?? ?? 26 89 ?? ?? ?? 26 8C ?? ?? ?? 03 DC }

Detection condition:
$a at pe.entry_point

Full rule:
rule WATCOM_C_Protected_Mode_386_486_1988_92_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? FB B9 ?? ?? 8E C1 BB ?? ?? 83 ?? ?? 80 ?? ?? 26 89 ?? ?? ?? 26 8C ?? ?? ?? 03 DC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: TrueVision_Targa_Graphics_format
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 02 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule TrueVision_Targa_Graphics_format: PEiD
{
    strings:
        $a = { 00 00 02 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Thinstall_25_h_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A7 1A 00 00 B9 6C 1A 00 00 BA 20 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD EC 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Thinstall_25_h_additional: PEiD
{
    strings:
        $a = { 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D A7 1A 00 00 B9 6C 1A 00 00 BA 20 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD EC 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_02_Gleam_100_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_02_Gleam_100_Anorganix: PEiD
{
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MSLRH_v032a_fake_MSVCpp_DLL_Method_4_emadicius
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 56 57 BF 01 00 00 00 8B 75 0C 85 F6 5F 5E 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule MSLRH_v032a_fake_MSVCpp_DLL_Method_4_emadicius: PEiD
{
    strings:
        $a = { 55 8B EC 56 57 BF 01 00 00 00 8B 75 0C 85 F6 5F 5E 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Packman_V10_Brandon_LaCombe_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA }

Detection condition:
$a at pe.entry_point

Full rule:
rule Packman_V10_Brandon_LaCombe_additional: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5B 8D 5B C6 01 1B 8B 13 8D 73 14 6A 08 59 01 16 AD 49 75 FA }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: DIET_v144_v145f_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { F9 9C EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule DIET_v144_v145f_Hint_DOS_EP: PEiD
{
    strings:
        $a = { F9 9C EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PESpin_07_Cyberbob_h_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule PESpin_07_Cyberbob_h_additional: PEiD
{
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASProtect_133_21_Registered_Alexey_Solodovnikov
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 01 ?? ?? ?? E8 01 00 00 00 C3 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASProtect_133_21_Registered_Alexey_Solodovnikov: PEiD
{
    strings:
        $a = { 68 01 ?? ?? ?? E8 01 00 00 00 C3 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: X3
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 5E BF 00 01 57 B9 00 00 AC 34 00 AA E2 FA C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule X3: PEiD
{
    strings:
        $a = { 5E BF 00 01 57 B9 00 00 AC 34 00 AA E2 FA C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PNG_Graphics_format_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 89 50 4E 47 0D 0A 1A 0A }

Detection condition:
$a at pe.entry_point

Full rule:
rule PNG_Graphics_format_Hint_FILE_START: PEiD
{
    strings:
        $a = { 89 50 4E 47 0D 0A 1A 0A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Themida_18xx_19xx_Oreans_Technologies
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Themida_18xx_19xx_Oreans_Technologies: PEiD
{
    strings:
        $a = { B8 ?? ?? ?? ?? 60 0B C0 74 68 E8 00 00 00 00 58 05 53 00 00 00 80 38 E9 75 13 61 EB 45 DB 2D 37 ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 58 25 00 F0 FF FF 33 FF 66 BB 19 5A 66 83 C3 34 66 39 18 75 12 0F B7 50 3C 03 D0 BB E9 44 00 00 83 C3 67 39 1A 74 07 2D 00 10 00 00 EB DA 8B F8 B8 ?? ?? ?? ?? 03 C7 B9 ?? ?? ?? ?? 03 CF EB 0A B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? 50 51 E8 84 00 00 00 E8 00 00 00 00 58 2D 26 00 00 00 B9 EF 01 00 00 C6 00 E9 83 E9 05 89 48 01 61 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: LGLZ_v104_com
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BF ?? ?? 3B FC 72 19 B4 09 BA 12 01 CD 21 B4 4C CD 21 }

Detection condition:
$a at pe.entry_point

Full rule:
rule LGLZ_v104_com: PEiD
{
    strings:
        $a = { BF ?? ?? 3B FC 72 19 B4 09 BA 12 01 CD 21 B4 4C CD 21 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Private_exe_Protector_215_SetiSoft_Team_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Private_exe_Protector_215_SetiSoft_Team_additional: PEiD
{
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_v160a_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 98 71 40 00 68 48 2D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_v160a_additional: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 98 71 40 00 68 48 2D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_v029_Beta_v031_Beta_Sign_by_hot_UNP_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE 88 01 ?? ?? AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_v029_Beta_v031_Beta_Sign_by_hot_UNP_additional: PEiD
{
    strings:
        $a = { BE 88 01 ?? ?? AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_02_PENightMare_2_Beta_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_02_PENightMare_2_Beta_Anorganix: PEiD
{
    strings:
        $a = { 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vpacker_ttui
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 89 C6 C7 45 E0 01 00 00 00 F7 03 00 00 FF FF 75 18 0F B7 03 50 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 EB 13 53 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 83 C7 04 FF 45 E0 4E 75 C4 8B F3 83 3E 00 75 88 8B 45 E4 8B 40 10 03 45 DC 8B 55 14 83 C2 20 89 02 68 00 80 00 00 6A 00 8B 45 D4 50 FF 55 EC 8B 55 DC 8B 42 3C 03 45 DC 83 C0 04 8B D8 83 C3 14 8D 45 E0 50 6A 40 68 00 10 00 00 52 FF 55 E8 8D 43 60 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vpacker_ttui: PEiD
{
    strings:
        $a = { 89 C6 C7 45 E0 01 00 00 00 F7 03 00 00 FF FF 75 18 0F B7 03 50 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 EB 13 53 8B 45 D8 50 FF 55 F8 89 07 8B C3 E8 ?? FE FF FF 8B D8 83 C7 04 FF 45 E0 4E 75 C4 8B F3 83 3E 00 75 88 8B 45 E4 8B 40 10 03 45 DC 8B 55 14 83 C2 20 89 02 68 00 80 00 00 6A 00 8B 45 D4 50 FF 55 EC 8B 55 DC 8B 42 3C 03 45 DC 83 C0 04 8B D8 83 C3 14 8D 45 E0 50 6A 40 68 00 10 00 00 52 FF 55 E8 8D 43 60 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MSLRH_v032a_fake_PESHiELD_025_emadicius_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 2B 00 00 00 0D 0A 0D 0A 0D 0A 52 65 67 69 73 74 41 72 65 64 20 74 6F 3A 20 4E 4F 4E 2D 43 4F 4D 4D 45 52 43 49 41 4C 21 21 0D 0A 0D 0A 0D 00 58 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule MSLRH_v032a_fake_PESHiELD_025_emadicius_h: PEiD
{
    strings:
        $a = { 60 E8 2B 00 00 00 0D 0A 0D 0A 0D 0A 52 65 67 69 73 74 41 72 65 64 20 74 6F 3A 20 4E 4F 4E 2D 43 4F 4D 4D 45 52 43 49 41 4C 21 21 0D 0A 0D 0A 0D 00 58 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CC_v261_Beta_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BA ?? ?? B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB }

Detection condition:
$a at pe.entry_point

Full rule:
rule CC_v261_Beta_Hint_DOS_EP: PEiD
{
    strings:
        $a = { BA ?? ?? B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Scodl_Graphics_format_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E0 01 ?? 00 ?? ?? 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Scodl_Graphics_format_Hint_FILE_START: PEiD
{
    strings:
        $a = { E0 01 ?? 00 ?? ?? 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PE_Crypt32_Console_v10_v101_v102
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule PE_Crypt32_Console_v10_v101_v102: PEiD
{
    strings:
        $a = { E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PE_Crypt_v102_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PE_Crypt_v102_additional: PEiD
{
    strings:
        $a = { E8 ?? ?? ?? ?? 5B 83 EB 05 EB 04 52 4E 44 }
    condition:
        $a at pe.entry_point

}