deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: PKLITE_v200c
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 B8 ?? ?? BA ?? ?? 3B C4 73 ?? 8B C4 2D ?? ?? 25 ?? ?? 8B F8 B9 ?? ?? BE ?? ?? FC }

Detection condition:
$a at pe.entry_point

Full rule:
rule PKLITE_v200c: PEiD
{
    strings:
        $a = { 50 B8 ?? ?? BA ?? ?? 3B C4 73 ?? 8B C4 2D ?? ?? 25 ?? ?? 8B F8 B9 ?? ?? BE ?? ?? FC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ZM_Exe_Executable_Image_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 5A 4D }

Detection condition:
$a at pe.entry_point

Full rule:
rule ZM_Exe_Executable_Image_Hint_FILE_START: PEiD
{
    strings:
        $a = { 5A 4D }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXECrypt_10_ReBirth_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 90 60 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 4E 28 40 00 8B F7 AC }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXECrypt_10_ReBirth_additional: PEiD
{
    strings:
        $a = { 90 90 60 E8 00 00 00 00 5D 81 ED D1 27 40 00 B9 15 00 00 00 83 C1 04 83 C1 01 EB 05 EB FE 83 C7 56 EB 00 EB 00 83 E9 02 81 C1 78 43 27 65 EB 00 81 C1 10 25 94 00 81 E9 63 85 00 00 B9 96 0C 00 00 90 8D BD 4E 28 40 00 8B F7 AC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ComProtector_v10_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? B9 ?? ?? BB ?? ?? BF ?? ?? 2E ?? ?? 34 ?? FE C8 C0 ?? ?? 2E ?? ?? 2E ?? ?? 2E ?? ?? 47 43 E2 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ComProtector_v10_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? B9 ?? ?? BB ?? ?? BF ?? ?? 2E ?? ?? 34 ?? FE C8 C0 ?? ?? 2E ?? ?? 2E ?? ?? 2E ?? ?? 47 43 E2 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Erdas_LANGIS_Image_graphics_format
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 48 45 41 44 37 34 00 00 03 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Erdas_LANGIS_Image_graphics_format: PEiD
{
    strings:
        $a = { 48 45 41 44 37 34 00 00 03 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_024_beta_Dwing_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE 88 01 40 00 AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_024_beta_Dwing_additional: PEiD
{
    strings:
        $a = { BE 88 01 40 00 AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_v285_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 68 ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_v285_additional: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 68 ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 28 ?? ?? ?? 33 D2 8A D4 89 15 24 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CrackStop_v101_c_Stefan_Esser_1997_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B4 48 BB FF FF B9 EB 27 8B EC CD 21 FA FC }

Detection condition:
$a at pe.entry_point

Full rule:
rule CrackStop_v101_c_Stefan_Esser_1997_additional: PEiD
{
    strings:
        $a = { B4 48 BB FF FF B9 EB 27 8B EC CD 21 FA FC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASProtect_v12_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 01 ?? ?? 00 E8 01 00 00 00 C3 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASProtect_v12_additional: PEiD
{
    strings:
        $a = { 68 01 ?? ?? 00 E8 01 00 00 00 C3 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: BAT2COM_v15_c_Douglas_Boling_PC_Magazine_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB ?? FC BD ?? ?? 8B ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? B4 4A CD 21 A1 ?? ?? 89 }

Detection condition:
$a at pe.entry_point

Full rule:
rule BAT2COM_v15_c_Douglas_Boling_PC_Magazine_Hint_DOS_EP: PEiD
{
    strings:
        $a = { EB ?? FC BD ?? ?? 8B ?? ?? 8B ?? ?? ?? 8B ?? ?? ?? B4 4A CD 21 A1 ?? ?? 89 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PE_Lock_NT_v202c
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 02 C7 85 1E EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 02 CD }

Detection condition:
$a at pe.entry_point

Full rule:
rule PE_Lock_NT_v202c: PEiD
{
    strings:
        $a = { EB 02 C7 85 1E EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 02 CD }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_v110_Eng_dulekxt_Microsoft_Visual_Cpp_4x_LCC_Win32_1x_
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 2C 71 1B CA EB 01 2A EB 01 65 8D 35 80 ?? ?? 00 80 C9 84 80 C9 68 BB F4 00 00 00 EB 01 EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Cpp_4x_LCC_Win32_1x_: PEiD
{
    strings:
        $a = { 2C 71 1B CA EB 01 2A EB 01 65 8D 35 80 ?? ?? 00 80 C9 84 80 C9 68 BB F4 00 00 00 EB 01 EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Mew_10_exe_coder_10_Northfox_HCC_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 33 C0 E9 ?? ?? FF FF 6A ?? ?? ?? ?? ?? 70 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Mew_10_exe_coder_10_Northfox_HCC_additional: PEiD
{
    strings:
        $a = { 33 C0 E9 ?? ?? FF FF 6A ?? ?? ?? ?? ?? 70 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_140b5_140b6
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 00 87 DD 8B 85 A6 A0 40 00 01 85 03 A0 40 00 66 C7 85 00 A0 40 00 90 90 01 85 9E A0 40 00 BB 8A 11 00 00 03 9D AA A0 40 00 03 9D A6 A0 40 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_140b5_140b6: PEiD
{
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 00 87 DD 8B 85 A6 A0 40 00 01 85 03 A0 40 00 66 C7 85 00 A0 40 00 90 90 01 85 9E A0 40 00 BB 8A 11 00 00 03 9D AA A0 40 00 03 9D A6 A0 40 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXE2COM_Limited_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE ?? ?? 8B 04 3D ?? ?? 74 ?? BA ?? ?? B4 09 CD 21 CD 20 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXE2COM_Limited_additional: PEiD
{
    strings:
        $a = { BE ?? ?? 8B 04 3D ?? ?? 74 ?? BA ?? ?? B4 09 CD 21 CD 20 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Splash_Bitmap_v100_BoB_Bobsoft
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 00 00 00 00 60 8B 6C 24 20 55 81 ED ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 29 F9 31 C0 FC F3 AA 8B 04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50 45 00 00 75 E8 89 85 ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 6A 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Splash_Bitmap_v100_BoB_Bobsoft: PEiD
{
    strings:
        $a = { E8 00 00 00 00 60 8B 6C 24 20 55 81 ED ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 8D 8D ?? ?? ?? ?? 29 F9 31 C0 FC F3 AA 8B 04 24 48 66 25 00 F0 66 81 38 4D 5A 75 F4 8B 48 3C 81 3C 01 50 45 00 00 75 E8 89 85 ?? ?? ?? ?? 8D BD ?? ?? ?? ?? 6A 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PEQuake_V006_forgat
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? FF FF E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? ?? 00 ?? ?? 00 ?? 00 ?? 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 }
        $b = { E8 A5 00 00 00 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule PEQuake_V006_forgat: PEiD
{
    strings:
        $a = { E8 ?? ?? FF FF E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? ?? 00 ?? ?? 00 ?? 00 ?? 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 }
        $b = { E8 A5 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Upx_Lock_10_12_CyberDoom_Team_X_BoB_BobSoft_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED 48 12 40 00 60 E8 2B 03 00 00 61 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upx_Lock_10_12_CyberDoom_Team_X_BoB_BobSoft_additional: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 48 12 40 00 60 E8 2B 03 00 00 61 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXEPACK_369
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B E8 8C C0 05 10 00 0E 1F A3 04 00 03 06 0C 00 8E C0 8B 0E 06 00 8B F9 4F 8B F7 FD F3 A4 50 B8 34 00 50 CB 8C C3 8C D8 48 8E D8 8E C0 BF 0F 00 B9 10 00 B0 FF F3 AE 47 8B F7 8B C3 48 8E C0 BF 0F 00 B1 04 8B C6 F7 D0 D3 E8 8C DA 2B D0 73 04 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXEPACK_369: PEiD
{
    strings:
        $a = { 8B E8 8C C0 05 10 00 0E 1F A3 04 00 03 06 0C 00 8E C0 8B 0E 06 00 8B F9 4F 8B F7 FD F3 A4 50 B8 34 00 50 CB 8C C3 8C D8 48 8E D8 8E C0 BF 0F 00 B9 10 00 B0 FF F3 AE 47 8B F7 8B C3 48 8E C0 BF 0F 00 B1 04 8B C6 F7 D0 D3 E8 8C DA 2B D0 73 04 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: from_NORMAN_Anti_Virus_Utilites_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? 5B 52 45 2F 4E 44 44 53 5D 0D 0A }

Detection condition:
$a at pe.entry_point

Full rule:
rule from_NORMAN_Anti_Virus_Utilites_additional: PEiD
{
    strings:
        $a = { E8 ?? ?? 5B 52 45 2F 4E 44 44 53 5D 0D 0A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UnderGround_Crypter_by_Booster2000_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 F0 B8 74 3C 00 11 E8 94 F9 FF FF E8 BF FE FF FF E8 0A F3 FF FF 8B C0 }

Detection condition:
$a at pe.entry_point

Full rule:
rule UnderGround_Crypter_by_Booster2000_additional: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 F0 B8 74 3C 00 11 E8 94 F9 FF FF E8 BF FE FF FF E8 0A F3 FF FF 8B C0 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PocketPC_ARM_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { F0 41 2D E9 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A0 E1 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 50 E3 ?? 00 00 0A ?? ?? ?? ?? ?? ?? A0 ?? ?? ?? ?? ?? ?? ?? A0 ?? ?? ?? A0 E1 00 80 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A0 E1 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PocketPC_ARM_h: PEiD
{
    strings:
        $a = { F0 41 2D E9 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A0 E1 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 50 E3 ?? 00 00 0A ?? ?? ?? ?? ?? ?? A0 ?? ?? ?? ?? ?? ?? ?? A0 ?? ?? ?? A0 E1 00 80 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A0 E1 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_Visual_Cpp_80_DLL_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 48 83 EC 28 83 FA 01 48 89 5C 24 38 48 89 74 24 40 48 89 7C 24 48 ?? ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_Visual_Cpp_80_DLL_additional: PEiD
{
    strings:
        $a = { 48 83 EC 28 83 FA 01 48 89 5C 24 38 48 89 74 24 40 48 89 7C 24 48 ?? ?? ?? 8B ?? ?? 8B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 48 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: DJoin_v07_public_xor_encryption_drmist_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { C6 05 00 80 40 00 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00 00 E8 C5 01 00 00 89 D8 E8 3E 02 00 00 E8 B9 01 00 00 E8 54 02 00 00 8B 5D FC C9 C3 8D 76 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 E5 C6 05 10 80 40 00 00 E8 D1 03 00 00 6A 00 64 FF 35 00 00 00 00 89 E0 A3 ?? 70 40 00 55 31 ED 89 E0 A3 20 80 40 00 66 8C D5 89 2D 30 80 40 00 E8 B9 03 00 00 31 ED E8 72 FF FF FF 5D E8 BC 03 00 00 C9 C3 00 00 00 00 00 00 00 00 00 00 55 89 E5 83 EC 08 E8 15 04 00 00 A1 ?? 70 40 00 89 45 F8 B8 01 00 00 00 89 45 FC 3B 45 F8 7F 2A FF 4D FC 90 FF 45 FC 8B 45 FC 83 3C C5 ?? 70 40 00 00 74 09 8B 04 C5 ?? 70 40 }

Detection condition:
$a at pe.entry_point

Full rule:
rule DJoin_v07_public_xor_encryption_drmist_additional: PEiD
{
    strings:
        $a = { C6 05 00 80 40 00 01 E8 74 00 00 00 C6 05 00 80 40 00 00 E8 68 00 00 00 50 E8 00 00 00 00 FF 25 D8 A1 40 00 90 90 90 90 90 90 90 90 90 90 90 90 55 89 E5 83 EC 04 89 5D FC E8 92 00 00 00 E8 ED 00 00 00 89 C3 B9 ?? 70 40 00 89 DA B8 00 00 00 00 E8 0A 01 00 00 E8 C5 01 00 00 89 D8 E8 3E 02 00 00 E8 B9 01 00 00 E8 54 02 00 00 8B 5D FC C9 C3 8D 76 00 00 00 00 00 00 00 00 00 00 00 00 00 55 89 E5 C6 05 10 80 40 00 00 E8 D1 03 00 00 6A 00 64 FF 35 00 00 00 00 89 E0 A3 ?? 70 40 00 55 31 ED 89 E0 A3 20 80 40 00 66 8C D5 89 2D 30 80 40 00 E8 B9 03 00 00 31 ED E8 72 FF FF FF 5D E8 BC 03 00 00 C9 C3 00 00 00 00 00 00 00 00 00 00 55 89 E5 83 EC 08 E8 15 04 00 00 A1 ?? 70 40 00 89 45 F8 B8 01 00 00 00 89 45 FC 3B 45 F8 7F 2A FF 4D FC 90 FF 45 FC 8B 45 FC 83 3C C5 ?? 70 40 00 00 74 09 8B 04 C5 ?? 70 40 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: The_Norton_Antivirus_Information_file_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 54 68 65 20 4E 6F 72 74 6F 6E 20 41 6E 74 69 56 69 72 75 73 20 49 6E 66 6F 72 6D 61 74 69 6F 6E 20 46 69 6C 65 }

Detection condition:
$a at pe.entry_point

Full rule:
rule The_Norton_Antivirus_Information_file_Hint_FILE_START: PEiD
{
    strings:
        $a = { 54 68 65 20 4E 6F 72 74 6F 6E 20 41 6E 74 69 56 69 72 75 73 20 49 6E 66 6F 72 6D 61 74 69 6F 6E 20 46 69 6C 65 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Simple_UPX_Cryptor_V3042005_MANtiCORE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? ?? ?? ?? ?? E2 FA 61 68 ?? ?? ?? ?? C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Simple_UPX_Cryptor_V3042005_MANtiCORE: PEiD
{
    strings:
        $a = { 60 B8 ?? ?? ?? ?? B9 ?? ?? ?? ?? ?? ?? ?? ?? E2 FA 61 68 ?? ?? ?? ?? C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Utah_RLE_Graphics_format
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 52 CC 00 00 00 00 ?? ?? ?? ?? 09 ?? 08 ?? 08 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Utah_RLE_Graphics_format: PEiD
{
    strings:
        $a = { 52 CC 00 00 00 00 ?? ?? ?? ?? 09 ?? 08 ?? 08 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ThemidaWinLicense_V1802_p_Oreans_Technologies_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 00 00 00 00 60 0B C0 74 68 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ThemidaWinLicense_V1802_p_Oreans_Technologies_additional: PEiD
{
    strings:
        $a = { B8 00 00 00 00 60 0B C0 74 68 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PESpin_v07_Cyberbob_
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 88 39 40 00 8B 42 3C 03 C2 89 85 92 39 40 00 EB 01 DB 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D A6 39 40 00 53 8F 85 4A 38 40 00 BB ?? 00 00 00 B9 EC 0A 00 00 8D BD 36 3A 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 56 44 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 B3 5F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D 99 39 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PESpin_v07_Cyberbob_: PEiD
{
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 88 39 40 00 8B 42 3C 03 C2 89 85 92 39 40 00 EB 01 DB 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D A6 39 40 00 53 8F 85 4A 38 40 00 BB ?? 00 00 00 B9 EC 0A 00 00 8D BD 36 3A 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 56 44 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 B3 5F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D 99 39 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASDPack_asd
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8D 49 00 1F 01 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 }
        $b = { 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8D 49 00 1F 01 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 90 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule ASDPack_asd: PEiD
{
    strings:
        $a = { 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8D 49 00 1F 01 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 }
        $b = { 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 8D 49 00 1F 01 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 90 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: WinZip_32_bit_6x_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FF 15 ?? ?? ?? 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10 38 08 74 06 40 80 38 00 75 F6 80 38 00 74 01 40 33 C9 ?? ?? ?? ?? FF 15 }

Detection condition:
$a at pe.entry_point

Full rule:
rule WinZip_32_bit_6x_additional: PEiD
{
    strings:
        $a = { FF 15 ?? ?? ?? 00 B1 22 38 08 74 02 B1 20 40 80 38 00 74 10 38 08 74 06 40 80 38 00 75 F6 80 38 00 74 01 40 33 C9 ?? ?? ?? ?? FF 15 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Windows_Animation_format
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 52 49 46 46 ?? ?? ?? ?? 41 43 4F 4E 4C 49 53 54 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Windows_Animation_format: PEiD
{
    strings:
        $a = { 52 49 46 46 ?? ?? ?? ?? 41 43 4F 4E 4C 49 53 54 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_Basic_Compiler_v560_1982_97_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9A ?? ?? ?? ?? 9A ?? ?? ?? ?? 9A ?? ?? ?? ?? 33 DB BA ?? ?? 9A ?? ?? ?? ?? C7 06 ?? ?? ?? ?? 33 DB }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_Basic_Compiler_v560_1982_97_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 9A ?? ?? ?? ?? 9A ?? ?? ?? ?? 9A ?? ?? ?? ?? 33 DB BA ?? ?? 9A ?? ?? ?? ?? C7 06 ?? ?? ?? ?? 33 DB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASPack_102b_Solodovnikov_Alexey
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED 96 78 43 00 B8 90 78 43 00 03 C5 2B 85 7D 7C 43 00 89 85 89 7C 43 00 80 BD 74 7C 43 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASPack_102b_Solodovnikov_Alexey: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 96 78 43 00 B8 90 78 43 00 03 C5 2B 85 7D 7C 43 00 89 85 89 7C 43 00 80 BD 74 7C 43 }
    condition:
        $a at pe.entry_point

}