deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: PECompact_133
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 00 87 DD 8B 85 A6 80 40 00 01 85 03 80 40 00 66 C7 85 00 80 40 00 90 90 01 85 9E 80 40 00 BB E8 0E 00 00 03 9D AA 80 40 00 03 9D A6 80 40 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_133: PEiD
{
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 00 87 DD 8B 85 A6 80 40 00 01 85 03 80 40 00 66 C7 85 00 80 40 00 90 90 01 85 9E 80 40 00 BB E8 0E 00 00 03 9D AA 80 40 00 03 9D A6 80 40 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: eXPressor_V145x_CGSoftLabs
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 EC ?? 53 56 57 83 65 ?? 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 ?? ?? ?? 00 A1 ?? ?? ?? 00 B9 ?? ?? ?? 00 2B 48 18 89 0D ?? ?? ?? 00 83 3D }

Detection condition:
$a at pe.entry_point

Full rule:
rule eXPressor_V145x_CGSoftLabs: PEiD
{
    strings:
        $a = { 55 8B EC 83 EC ?? 53 56 57 83 65 ?? 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 ?? ?? ?? 00 A1 ?? ?? ?? 00 B9 ?? ?? ?? 00 2B 48 18 89 0D ?? ?? ?? 00 83 3D }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Borland_Delphi_Setup_Module_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 E8 ?? ?? ?? ?? C9 C3 ?? ?? 45 58 45 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Borland_Delphi_Setup_Module_additional: PEiD
{
    strings:
        $a = { 55 89 E5 E8 ?? ?? ?? ?? C9 C3 ?? ?? 45 58 45 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CGM_Graphics_format_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 2A 08 48 69 4A 61 61 6B 20 32 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CGM_Graphics_format_additional: PEiD
{
    strings:
        $a = { 00 2A 08 48 69 4A 61 61 6B 20 32 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_4000053_Silicon_Realms_Toolworks
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 20 8B 4B 00 68 80 E4 48 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4B 00 33 D2 8A D4 89 15 A4 A1 4B 00 8B C8 81 E1 FF 00 00 00 89 0D A0 A1 4B 00 C1 E1 08 03 CA 89 0D 9C A1 4B 00 C1 E8 10 A3 98 A1 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_4000053_Silicon_Realms_Toolworks: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 20 8B 4B 00 68 80 E4 48 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4B 00 33 D2 8A D4 89 15 A4 A1 4B 00 8B C8 81 E1 FF 00 00 00 89 0D A0 A1 4B 00 C1 E1 08 03 CA 89 0D 9C A1 4B 00 C1 E8 10 A3 98 A1 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PassLock_2000_v10_Eng_Moonlight_Software_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01 00 00 C7 43 60 01 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 83 EC 44 C7 04 24 44 00 00 00 C7 44 24 2C 00 00 00 00 54 FF 15 E8 61 40 00 B8 0A 00 00 00 F7 44 24 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PassLock_2000_v10_Eng_Moonlight_Software_additional: PEiD
{
    strings:
        $a = { 55 8B EC 53 56 57 BB 00 50 40 00 66 2E F7 05 34 20 40 00 04 00 0F 85 98 00 00 00 E8 1F 01 00 00 C7 43 60 01 00 00 00 8D 83 E4 01 00 00 50 FF 15 F0 61 40 00 83 EC 44 C7 04 24 44 00 00 00 C7 44 24 2C 00 00 00 00 54 FF 15 E8 61 40 00 B8 0A 00 00 00 F7 44 24 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ACProtect_109_Risco_Software
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 01 00 00 00 E8 83 C4 04 85 DF E8 01 00 00 00 76 83 04 24 06 C3 0F 81 02 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ACProtect_109_Risco_Software: PEiD
{
    strings:
        $a = { 60 E8 01 00 00 00 E8 83 C4 04 85 DF E8 01 00 00 00 76 83 04 24 06 C3 0F 81 02 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_021_beta_Dwing
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE 88 01 40 00 AD 8B F8 6A 04 95 A5 33 C0 AB 48 AB F7 D8 59 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_021_beta_Dwing: PEiD
{
    strings:
        $a = { BE 88 01 40 00 AD 8B F8 6A 04 95 A5 33 C0 AB 48 AB F7 D8 59 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PESpin_v03_Cyberbob
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 CB 2C 40 00 8B 42 3C 03 C2 89 85 D5 2C 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D E9 2C 40 00 53 8F 85 B6 2B 40 00 BB ?? 00 00 00 B9 75 0A 00 00 8D BD 7E 2D 40 00 4F 30 1C 39 FE CB E2 F9 68 3C 01 00 00 59 8D BD B6 36 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 1F 53 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D DC 2C 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PESpin_v03_Cyberbob: PEiD
{
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 B7 CD 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 8B 95 CB 2C 40 00 8B 42 3C 03 C2 89 85 D5 2C 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D E9 2C 40 00 53 8F 85 B6 2B 40 00 BB ?? 00 00 00 B9 75 0A 00 00 8D BD 7E 2D 40 00 4F 30 1C 39 FE CB E2 F9 68 3C 01 00 00 59 8D BD B6 36 40 00 C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 1F 53 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D DC 2C 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Inno_Installer_v405
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 D2 55 68 ?? ?? ?? ?? 64 FF 32 64 89 22 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Inno_Installer_v405: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 D2 55 68 ?? ?? ?? ?? 64 FF 32 64 89 22 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Nullsoft_Install_System_v20b2_v20b3_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 EC 0C 53 55 56 57 FF 15 ?? 70 40 00 8B 35 ?? 92 40 00 05 E8 03 00 00 89 44 24 14 B3 20 FF 15 2C 70 40 00 BF 00 04 00 00 68 ?? ?? ?? 00 57 FF 15 ?? ?? 40 00 57 FF 15 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Nullsoft_Install_System_v20b2_v20b3_additional: PEiD
{
    strings:
        $a = { 83 EC 0C 53 55 56 57 FF 15 ?? 70 40 00 8B 35 ?? 92 40 00 05 E8 03 00 00 89 44 24 14 B3 20 FF 15 2C 70 40 00 BF 00 04 00 00 68 ?? ?? ?? 00 57 FF 15 ?? ?? 40 00 57 FF 15 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CrunchPE_40
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 E9 06 ?? ?? 89 85 E1 06 ?? ?? FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CrunchPE_40: PEiD
{
    strings:
        $a = { EB 10 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 55 E8 ?? ?? ?? ?? 5D 81 ED 18 ?? ?? ?? 8B C5 55 60 9C 2B 85 E9 06 ?? ?? 89 85 E1 06 ?? ?? FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_01_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_01_Anorganix: PEiD
{
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_ACProtect_109
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_ACProtect_109: PEiD
{
    strings:
        $a = { 60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PESpin_v11_Cyberbob_
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 C3 4B 40 00 8B 42 3C 03 C2 89 85 CD 4B 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D E1 4B 40 00 53 8F 85 D7 49 40 00 BB ?? 00 00 00 B9 FE 11 00 00 8D BD 71 4C 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 83 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 BD 2D 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC FF EA EB 01 C8 E8 01 00 00 00 68 58 FE 48 1F 0F 84 94 02 00 00 75 01 9A 81 70 03 E8 

Detection condition:
$a at pe.entry_point

Full rule:
rule PESpin_v11_Cyberbob_: PEiD
{
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 C3 4B 40 00 8B 42 3C 03 C2 89 85 CD 4B 40 00 EB 02 12 77 F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 9A 72 ED 1F EB 07 F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D E1 4B 40 00 53 8F 85 D7 49 40 00 BB ?? 00 00 00 B9 FE 11 00 00 8D BD 71 4C 40 00 4F EB 07 FA EB 01 FF EB 04 E3 EB F8 69 30 1C 39 FE CB 49 9C C1 2C 24 06 F7 14 24 83 24 24 01 50 52 B8 83 B2 DC 12 05 44 4D 23 ED F7 64 24 08 8D 84 28 BD 2D 40 00 89 44 24 08 5A 58 8D 64 24 04 FF 64 24 FC FF EA EB 01 C8 E8 01 00 00 00 68 58 FE 48 1F 0F 84 94 02 00 00 75 01 9A 81 70 03 E8 98 68 EA 83 C0 21 8? }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Paybackdropper_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? B9 ?? ?? B8 ?? ?? BE ?? ?? 49 78 ?? 30 04 86 E0 D3 C8 4E EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Paybackdropper_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? B9 ?? ?? B8 ?? ?? BE ?? ?? 49 78 ?? 30 04 86 E0 D3 C8 4E EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Banners_font_file_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { AB CD 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Banners_font_file_Hint_FILE_START: PEiD
{
    strings:
        $a = { AB CD 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_02x_Dwing
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE 88 01 40 00 AD 8B F8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_02x_Dwing: PEiD
{
    strings:
        $a = { BE 88 01 40 00 AD 8B F8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SDProtector_11x_Randy_Li_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule SDProtector_11x_Randy_Li_additional: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MSLRH_v031a
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F CA C0 C7 91 0F CB C1 D9 0C 86 F9 86 D7 D1 D9 EB 01 A5 EB 01 11 EB 01 1D 0F C1 C2 0F CB 0F C1 C2 EB 01 A1 C0 E9 FD 0F C1 D1 EB 01 E3 0F CA 87 D9 EB 01 F3 0F CB 87 C2 0F C0 F9 D0 F7 EB 01 2F 0F C9 C0 DC C4 EB 01 35 0F CA D3 D1 86 C8 EB 01 01 0F C0 F5 87 C8 D0 DE EB 01 95 EB 01 E1 EB 01 FD EB 01 EC 87 D3 0F CB C1 DB 35 D3 E2 0F C8 86 E2 86 EC C1 FB 12 D2 EE 0F C9 D2 F6 0F CA 87 C3 C1 D3 B3 EB 01 BF D1 CB 87 C9 0F CA 0F C1 DB EB 01 44 C0 CA F2 0F C1 D1 0F CB EB 01 D3 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 }
        $b = { 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule MSLRH_v031a: PEiD
{
    strings:
        $a = { 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F CA C0 C7 91 0F CB C1 D9 0C 86 F9 86 D7 D1 D9 EB 01 A5 EB 01 11 EB 01 1D 0F C1 C2 0F CB 0F C1 C2 EB 01 A1 C0 E9 FD 0F C1 D1 EB 01 E3 0F CA 87 D9 EB 01 F3 0F CB 87 C2 0F C0 F9 D0 F7 EB 01 2F 0F C9 C0 DC C4 EB 01 35 0F CA D3 D1 86 C8 EB 01 01 0F C0 F5 87 C8 D0 DE EB 01 95 EB 01 E1 EB 01 FD EB 01 EC 87 D3 0F CB C1 DB 35 D3 E2 0F C8 86 E2 86 EC C1 FB 12 D2 EE 0F C9 D2 F6 0F CA 87 C3 C1 D3 B3 EB 01 BF D1 CB 87 C9 0F CA 0F C1 DB EB 01 44 C0 CA F2 0F C1 D1 0F CB EB 01 D3 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 }
        $b = { 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 0F C1 C0 D3 DA C0 D6 A8 EB 01 DE D0 EC 0F C1 CB D0 CF 0F C1 D1 D2 DB 0F C8 EB 01 BC C0 E9 C6 C1 D0 91 0F CB EB 01 73 0F CA 87 D9 87 D2 D0 CF 87 D9 0F C8 EB 01 C1 EB 01 A2 86 CA D0 E1 0F C0 CB 0F }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: FSG_v110_Eng_dulekxt_Borland_Delphi_Borland_Cpp_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_v110_Eng_dulekxt_Borland_Delphi_Borland_Cpp_additional: PEiD
{
    strings:
        $a = { B8 ?? ?? ?? ?? 6A ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 66 9C 60 50 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MZ0oPE_106b_TaskFall
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MZ0oPE_106b_TaskFall: PEiD
{
    strings:
        $a = { EB CA 89 03 83 C3 04 87 FE 32 C0 AE 75 FD 87 FE 80 3E FF 75 E2 46 5B 83 C3 04 53 8B 1B 80 3F FF 75 C9 8B E5 61 68 ?? ?? ?? ?? C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPolyX_v05
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC ?? 00 BD 46 00 8B ?? B9 ?? 00 00 00 80 ?? ?? 51 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
        $b = { 83 EC 04 89 ?? 24 59 ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
        $c = { 83 EC 04 89 ?? 24 59 ?? ?? 00 00 00 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule UPolyX_v05: PEiD
{
    strings:
        $a = { 55 8B EC ?? 00 BD 46 00 8B ?? B9 ?? 00 00 00 80 ?? ?? 51 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
        $b = { 83 EC 04 89 ?? 24 59 ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
        $c = { 83 EC 04 89 ?? 24 59 ?? ?? 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Thinstall_2403_Jitit
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Thinstall_2403_Jitit: PEiD
{
    strings:
        $a = { 6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: V_Load_09used_in_Kartz_03
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 33 F6 2E F6 06 B0 06 FF 74 12 0E 58 8B D8 81 E3 00 F0 75 08 B1 04 D3 E0 2B F0 D3 EE 06 5B 0E 58 2B C3 B1 04 BB 35 07 8B D3 D3 EB 81 E2 0F 00 74 01 43 2B F3 7D 02 03 F3 03 D8 03 DE B8 00 4A CD 21 73 04 B4 4C CD 21 A1 2C 00 2E A3 05 07 2E 8C }

Detection condition:
$a at pe.entry_point

Full rule:
rule V_Load_09used_in_Kartz_03: PEiD
{
    strings:
        $a = { 33 F6 2E F6 06 B0 06 FF 74 12 0E 58 8B D8 81 E3 00 F0 75 08 B1 04 D3 E0 2B F0 D3 EE 06 5B 0E 58 2B C3 B1 04 BB 35 07 8B D3 D3 EB 81 E2 0F 00 74 01 43 2B F3 7D 02 03 F3 03 D8 03 DE B8 00 4A CD 21 73 04 B4 4C CD 21 A1 2C 00 2E A3 05 07 2E 8C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Packman_V0001_Bubbasoft
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 58 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? 48 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Packman_V0001_Bubbasoft: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 58 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? ?? ?? ?? 8D ?? ?? 48 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MSLRH_032a_fake_PESHiELD_025_emadicius_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 2E A8 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A }

Detection condition:
$a at pe.entry_point

Full rule:
rule MSLRH_032a_fake_PESHiELD_025_emadicius_additional: PEiD
{
    strings:
        $a = { EB 06 68 2E A8 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PocketPC_MIB_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF ?? ?? ?? 0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F ?? ?? ?? 0C 24 00 A7 8F ?? ?? ?? 0C 25 20 40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF }

Detection condition:
$a at pe.entry_point

Full rule:
rule PocketPC_MIB_additional: PEiD
{
    strings:
        $a = { E8 FF BD 27 14 00 BF AF 18 00 A4 AF 1C 00 A5 AF 20 00 A6 AF 24 00 A7 AF ?? ?? ?? 0C 00 00 00 00 18 00 A4 8F 1C 00 A5 8F 20 00 A6 8F ?? ?? ?? 0C 24 00 A7 8F ?? ?? ?? 0C 25 20 40 00 14 00 BF 8F 08 00 E0 03 18 00 BD 27 ?? FF BD 27 18 00 ?? AF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: WWPACK_v302_v302a_Extractable_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 33 C9 B1 ?? 51 06 06 BB ?? ?? 53 8C D3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule WWPACK_v302_v302a_Extractable_Hint_DOS_EP: PEiD
{
    strings:
        $a = { B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 33 C9 B1 ?? 51 06 06 BB ?? ?? 53 8C D3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PEncrypt_10_JunkCode
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 9C BE 00 10 40 00 8B FE B9 ?? ?? ?? ?? BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61 E9 ?? ?? ?? FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule PEncrypt_10_JunkCode: PEiD
{
    strings:
        $a = { 60 9C BE 00 10 40 00 8B FE B9 ?? ?? ?? ?? BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61 E9 ?? ?? ?? FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Trap_113_COM
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8A F6 87 C9 B8 01 FA BA 45 59 87 C9 E8 00 00 8B FC 33 D2 36 8B 2D 87 DB 81 ED 0F 01 87 D2 44 44 8C D1 BA 99 CB 8E D2 33 D2 8E D1 8B CA 33 D2 B9 00 05 EB 02 CD 20 81 F9 E2 03 74 58 83 C1 FE 83 C2 01 EB EE 20 DC DC DC DC DC DC DC DC DC DC DC }

Detection condition:
$a at pe.entry_point

Full rule:
rule Trap_113_COM: PEiD
{
    strings:
        $a = { 8A F6 87 C9 B8 01 FA BA 45 59 87 C9 E8 00 00 8B FC 33 D2 36 8B 2D 87 DB 81 ED 0F 01 87 D2 44 44 8C D1 BA 99 CB 8E D2 33 D2 8E D1 8B CA 33 D2 B9 00 05 EB 02 CD 20 81 F9 E2 03 74 58 83 C1 FE 83 C2 01 EB EE 20 DC DC DC DC DC DC DC DC DC DC DC }
    condition:
        $a at pe.entry_point

}