deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: EXE_Shield_v01b_v03b_v03_SMoKE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 }
        $b = { EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule EXE_Shield_v01b_v03b_v03_SMoKE: PEiD
{
    strings:
        $a = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 }
        $b = { EB 06 68 40 85 06 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 3F 90 40 00 87 DD 8B 85 E6 90 40 00 01 85 33 90 40 00 66 C7 85 30 90 40 00 90 90 01 85 DA 90 40 00 01 85 DE 90 40 00 01 85 E2 90 40 00 BB 7B 11 00 00 03 9D EA 90 40 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: WinUpack_v039_final_By_Dwing_c2005_h1_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 ?? ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule WinUpack_v039_final_By_Dwing_c2005_h1_additional: PEiD
{
    strings:
        $a = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 ?? ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Amiga_IFFILBM_Graphics_format_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 46 4F 52 4D ?? ?? ?? ?? 49 4C 42 4D 42 4D 48 44 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Amiga_IFFILBM_Graphics_format_Hint_FILE_START: PEiD
{
    strings:
        $a = { 46 4F 52 4D ?? ?? ?? ?? 49 4C 42 4D 42 4D 48 44 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: XPack_145_EXE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B EC EB 01 E8 B8 18 04 FF E0 FA 33 C0 8E D0 BC 10 00 2E 8F 06 57 04 2E 8F 06 5C 04 EB 01 9A 0E BB 4C 04 53 5F EB 01 9A 17 8B E5 FB 48 D1 E8 EB 01 9A CE 9A 9C EB 01 9A 59 80 CD 01 51 9D EB 01 9A 1E 33 DB 8E DB C7 47 10 00 00 C7 47 12 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule XPack_145_EXE: PEiD
{
    strings:
        $a = { 8B EC EB 01 E8 B8 18 04 FF E0 FA 33 C0 8E D0 BC 10 00 2E 8F 06 57 04 2E 8F 06 5C 04 EB 01 9A 0E BB 4C 04 53 5F EB 01 9A 17 8B E5 FB 48 D1 E8 EB 01 9A CE 9A 9C EB 01 9A 59 80 CD 01 51 9D EB 01 9A 1E 33 DB 8E DB C7 47 10 00 00 C7 47 12 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Apex_30_alpha_500mhz_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 5F B9 14 00 00 00 51 BE 00 10 40 00 B9 00 ?? ?? 00 8A 07 30 06 46 E2 FB 47 59 E2 EA 68 ?? ?? ?? 00 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Apex_30_alpha_500mhz_additional: PEiD
{
    strings:
        $a = { 5F B9 14 00 00 00 51 BE 00 10 40 00 B9 00 ?? ?? 00 8A 07 30 06 46 E2 FB 47 59 E2 EA 68 ?? ?? ?? 00 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RosAsm_2050a_Betov
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 60 8B 5D 08 B9 08 00 00 00 BF ?? ?? ?? ?? 83 C7 07 FD 8A C3 24 0F 04 30 3C 39 76 02 04 07 AA C1 EB 04 E2 EE FC 68 00 10 00 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 61 8B E5 5D C2 04 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RosAsm_2050a_Betov: PEiD
{
    strings:
        $a = { 55 8B EC 60 8B 5D 08 B9 08 00 00 00 BF ?? ?? ?? ?? 83 C7 07 FD 8A C3 24 0F 04 30 3C 39 76 02 04 07 AA C1 EB 04 E2 EE FC 68 00 10 00 00 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A 00 FF 15 ?? ?? ?? ?? 61 8B E5 5D C2 04 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXECryptor_239_minimum_protection_wwwstrongbitcom_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 51 68 ?? ?? ?? ?? 59 81 F1 12 3C CB 98 E9 53 2C 00 00 F7 D7 E9 EB 60 00 00 83 45 F8 02 E9 E3 36 00 00 F6 45 F8 20 0F 84 1E 21 00 00 55 E9 80 62 00 00 87 0C 24 8B E9 ?? ?? ?? ?? 00 00 23 C1 81 E9 ?? ?? ?? ?? 57 E9 ED 00 00 00 0F 88 ?? ?? ?? ?? E9 2C 0D 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXECryptor_239_minimum_protection_wwwstrongbitcom_additional: PEiD
{
    strings:
        $a = { 51 68 ?? ?? ?? ?? 59 81 F1 12 3C CB 98 E9 53 2C 00 00 F7 D7 E9 EB 60 00 00 83 45 F8 02 E9 E3 36 00 00 F6 45 F8 20 0F 84 1E 21 00 00 55 E9 80 62 00 00 87 0C 24 8B E9 ?? ?? ?? ?? 00 00 23 C1 81 E9 ?? ?? ?? ?? 57 E9 ED 00 00 00 0F 88 ?? ?? ?? ?? E9 2C 0D 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Unknown_packer_01_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB ?? ?? BE ?? ?? BF ?? ?? 2E }

Detection condition:
$a at pe.entry_point

Full rule:
rule Unknown_packer_01_additional: PEiD
{
    strings:
        $a = { EB ?? ?? BE ?? ?? BF ?? ?? 2E }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Trap_120_EXE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 00 00 5B 83 C3 28 90 8B D3 E8 01 00 01 5B 2E 80 3F 00 74 16 90 90 8B DA B9 A2 03 2E C0 07 39 2E 80 37 00 2E 80 2F 00 43 E2 F1 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Trap_120_EXE: PEiD
{
    strings:
        $a = { E8 00 00 5B 83 C3 28 90 8B D3 E8 01 00 01 5B 2E 80 3F 00 74 16 90 90 8B DA B9 A2 03 2E C0 07 39 2E 80 37 00 2E 80 2F 00 43 E2 F1 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_Yodas_Protector_102_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 03 00 00 00 EB 01 90 90 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_Yodas_Protector_102_Anorganix: PEiD
{
    strings:
        $a = { E8 03 00 00 00 EB 01 90 90 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: BITLOK_31
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 B0 65 B4 4C CD 21 B4 30 CD 21 3C 03 72 F2 2E 8C 1E 00 00 8C DB 83 C3 10 2E 01 1E 3A 00 0E 1F EB 25 EA 83 F9 01 EB 0C EA 5F EB 03 EB F5 EA BE 61 00 EB 3D 74 56 EB 34 EA BF D2 00 EB 38 EA EB 3D 81 FE CF 00 EB 08 33 C0 EB EE EA EB F1 EA }

Detection condition:
$a at pe.entry_point

Full rule:
rule BITLOK_31: PEiD
{
    strings:
        $a = { EB 06 B0 65 B4 4C CD 21 B4 30 CD 21 3C 03 72 F2 2E 8C 1E 00 00 8C DB 83 C3 10 2E 01 1E 3A 00 0E 1F EB 25 EA 83 F9 01 EB 0C EA 5F EB 03 EB F5 EA BE 61 00 EB 3D 74 56 EB 34 EA BF D2 00 EB 38 EA EB 3D 81 FE CF 00 EB 08 33 C0 EB EE EA EB F1 EA }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: DBPE_v153_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 55 57 56 52 51 53 9C FA E8 00 00 00 00 5D 81 ED 5B 53 40 00 B0 }

Detection condition:
$a at pe.entry_point

Full rule:
rule DBPE_v153_additional: PEiD
{
    strings:
        $a = { 9C 55 57 56 52 51 53 9C FA E8 00 00 00 00 5D 81 ED 5B 53 40 00 B0 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: E_language
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 06 00 00 00 50 E8 ?? 01 00 00 55 8B EC 81 C4 F0 FE FF FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule E_language: PEiD
{
    strings:
        $a = { E8 06 00 00 00 50 E8 ?? 01 00 00 55 8B EC 81 C4 F0 FE FF FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPX_v0896_v102_v105_v122_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 80 7C 24 08 01 0F 85 ?? ?? ?? 00 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPX_v0896_v102_v105_v122_additional: PEiD
{
    strings:
        $a = { 80 7C 24 08 01 0F 85 ?? ?? ?? 00 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: nPack_v11_250_Beta_NEOx_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule nPack_v11_250_Beta_NEOx_additional: PEiD
{
    strings:
        $a = { 83 3D 04 ?? ?? ?? 00 75 05 E9 01 00 00 00 C3 E8 46 00 00 00 E8 73 00 00 00 B8 2E ?? ?? ?? 2B 05 08 ?? ?? ?? A3 00 ?? ?? ?? E8 9C 00 00 00 E8 04 02 00 00 E8 FB 06 00 00 E8 1B 06 00 00 A1 00 ?? ?? ?? C7 05 04 ?? ?? ?? 01 00 00 00 01 05 00 ?? ?? ?? FF 35 00 ?? ?? ?? C3 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MingWin32_Dev_Cpp_v4991_h_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 ?? ?? 00 00 90 90 90 90 90 90 90 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MingWin32_Dev_Cpp_v4991_h_additional: PEiD
{
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 ?? ?? 00 00 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Enigma_protector_110_unregistered
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89 }
        $b = { 60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56 41 87 FC 0F F3 05 40 81 68 4B 93 71 40 BB 87 3C 40 40 8B 88 06 75 70 40 40 8B BB B3 43 C4 8F 93 2B F3 4A 88 06 07 30 F5 EA 2A 35 F0 4B 8A C3 07 C1 C6 02 C4 34 C0 74 74 32 02 C4 45 0B 3C 96 BE 0A 82 C3 DE 36 A9 7E 5A 51 A6 BC 63 A8 66 CB 30 58 20 8C CC 85 53 9F C1 E4 10 80 11 20 1E 48 D2 E8 F7 28 5C 26 89 5C 94 89 5A F8 1C 0B 74 7E 33 4E 9B 29 56 F2 2B 84 42 8A 95 16 76 64 08 7B 70 8F A0 0B A8 3A C1 C7 B5 3E D9 70 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Enigma_protector_110_unregistered: PEiD
{
    strings:
        $a = { 60 72 80 72 88 72 8C 72 90 72 94 72 98 72 9C 72 A0 72 A4 59 A8 B0 5C E8 39 D5 39 E4 39 F1 31 F9 5C 3D 58 CA 5F 56 B1 2D 20 7A 2E 30 16 32 72 2B 72 36 1C A5 33 A9 9C AD 9C B1 9C B5 9C B9 9C BD 9C C1 9C C5 9C C9 9C CD 9C D1 9C D5 9C D9 9C DD 9C E1 9C E5 89 }
        $b = { 60 8B DD E8 00 00 00 00 5D 95 32 C0 95 89 9D 80 00 00 00 B8 42 31 40 00 BB 41 30 40 00 2B C3 03 C5 33 D2 8A 10 40 B9 ?? ?? 00 00 8B F9 30 10 8A 10 40 49 75 F8 64 EF 86 3D 30 00 00 0F B9 FF 4B 89 52 5C 4C BD 77 C2 0C CE 88 4E 2D E8 00 00 00 5D 0D DB 5E 56 41 87 FC 0F F3 05 40 81 68 4B 93 71 40 BB 87 3C 40 40 8B 88 06 75 70 40 40 8B BB B3 43 C4 8F 93 2B F3 4A 88 06 07 30 F5 EA 2A 35 F0 4B 8A C3 07 C1 C6 02 C4 34 C0 74 74 32 02 C4 45 0B 3C 96 BE 0A 82 C3 DE 36 A9 7E 5A 51 A6 BC 63 A8 66 CB 30 58 20 8C CC 85 53 9F C1 E4 10 80 11 20 1E 48 D2 E8 F7 28 5C 26 89 5C 94 89 5A F8 1C 0B 74 7E 33 4E 9B 29 56 F2 2B 84 42 8A 95 16 76 64 08 7B 70 8F A0 0B A8 3A C1 C7 B5 3E D9 70 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: XPack_166_EXE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 8C D3 15 33 75 8B EC EB 01 E8 B8 99 03 FF E0 FA BC 10 00 33 C0 8E D0 2E 8F 06 D8 03 2E 8F 06 DD 03 EB 01 9A 0E BB CD 03 53 5F EB 01 9A 17 8B E5 FB 48 D1 E8 EB 01 9A CE 9A 9C EB 01 9A 59 80 CD 01 51 9D EB 01 9A 1E 33 DB 8E DB C7 47 10 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule XPack_166_EXE: PEiD
{
    strings:
        $a = { B8 8C D3 15 33 75 8B EC EB 01 E8 B8 99 03 FF E0 FA BC 10 00 33 C0 8E D0 2E 8F 06 D8 03 2E 8F 06 DD 03 EB 01 9A 0E BB CD 03 53 5F EB 01 9A 17 8B E5 FB 48 D1 E8 EB 01 9A CE 9A 9C EB 01 9A 59 80 CD 01 51 9D EB 01 9A 1E 33 DB 8E DB C7 47 10 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EmbedPE_V1X_cyclotron_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 EC 50 60 68 ?? ?? ?? ?? E8 ?? ?? 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EmbedPE_V1X_cyclotron_additional: PEiD
{
    strings:
        $a = { 83 EC 50 60 68 ?? ?? ?? ?? E8 ?? ?? 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RLPack_V119_Dll_LZMA_430_ap0x_Sign_by_fly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA }

Detection condition:
$a at pe.entry_point

Full rule:
rule RLPack_V119_Dll_LZMA_430_ap0x_Sign_by_fly: PEiD
{
    strings:
        $a = { 80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_02_Yodas_Protector_102_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 03 00 00 00 EB 01 90 90 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_02_Yodas_Protector_102_Anorganix: PEiD
{
    strings:
        $a = { E8 03 00 00 00 EB 01 90 90 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Password_Protector_for_the_UPX_030_g0d
Repository: Yara-Rules/rules

Pattern signatures:
$a = { C8 50 01 00 60 E8 EC 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 44 69 61 6C 6F 67 42 6F 78 49 6E 64 69 72 65 63 74 50 61 72 61 6D 41 00 53 65 6E 64 4D 65 73 73 61 67 65 41 00 45 6E 64 44 69 61 6C 6F 67 00 00 00 55 8B EC 57 BF 00 00 00 00 33 C0 81 6D 0C 10 01 00 00 75 03 40 EB 13 83 7D 0C 01 75 0D 66 83 7D 10 0B 75 0B FF 75 14 8F 47 E4 5F 5D C2 10 00 66 83 7D 10 02 77 F4 74 0E 8D 4F A0 51 6A 40 6A 0D FF 77 E4 FF 57 E8 50 FF 75 08 FF 57 EC EB DB 84 08 C8 90 00 00 00 00 01 00 64 00 64 00 64 00 14 00 00 00 00 00 45 00 6E 00 74 00 65 00 72 00 20 00 50 00 61 00 73 00 73 00 77 00 6F 00 72 00 64 00 00 00 A0 00 00 50 00 00 02 00 05 00 05 00 5A 00 0A 00 0B 00 FF FF 81 00 00 00 00 00 5E FC 8D BE AA FE FF FF 8D 86 }
        $b = { C8 50 01 00 60 E8 EC 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 44 69 61 6C 6F 67 42 6F 78 49 6E 64 69 72 65 63 74 50 61 72 61 6D 41 00 53 65 6E 64 4D 6

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Password_Protector_for_the_UPX_030_g0d: PEiD
{
    strings:
        $a = { C8 50 01 00 60 E8 EC 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 44 69 61 6C 6F 67 42 6F 78 49 6E 64 69 72 65 63 74 50 61 72 61 6D 41 00 53 65 6E 64 4D 65 73 73 61 67 65 41 00 45 6E 64 44 69 61 6C 6F 67 00 00 00 55 8B EC 57 BF 00 00 00 00 33 C0 81 6D 0C 10 01 00 00 75 03 40 EB 13 83 7D 0C 01 75 0D 66 83 7D 10 0B 75 0B FF 75 14 8F 47 E4 5F 5D C2 10 00 66 83 7D 10 02 77 F4 74 0E 8D 4F A0 51 6A 40 6A 0D FF 77 E4 FF 57 E8 50 FF 75 08 FF 57 EC EB DB 84 08 C8 90 00 00 00 00 01 00 64 00 64 00 64 00 14 00 00 00 00 00 45 00 6E 00 74 00 65 00 72 00 20 00 50 00 61 00 73 00 73 00 77 00 6F 00 72 00 64 00 00 00 A0 00 00 50 00 00 02 00 05 00 05 00 5A 00 0A 00 0B 00 FF FF 81 00 00 00 00 00 5E FC 8D BE AA FE FF FF 8D 86 }
        $b = { C8 50 01 00 60 E8 EC 00 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 55 53 45 52 33 32 2E 64 6C 6C 00 44 69 61 6C 6F 67 42 6F 78 49 6E 64 69 72 65 63 74 50 61 72 61 6D 41 00 53 65 6E 64 4D 65 73 73 61 67 65 41 00 45 6E 64 44 69 61 6C 6F }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Amiga_AIFF_8SFX_Audio_file_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 46 4F 52 4D ?? ?? ?? ?? 38 53 56 58 56 48 44 52 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Amiga_AIFF_8SFX_Audio_file_Hint_FILE_START: PEiD
{
    strings:
        $a = { 46 4F 52 4D ?? ?? ?? ?? 38 53 56 58 56 48 44 52 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_Visual_C_v20_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 53 56 57 BB ?? ?? ?? ?? 8B ?? ?? ?? 55 3B FB 75 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_Visual_C_v20_additional: PEiD
{
    strings:
        $a = { 53 56 57 BB ?? ?? ?? ?? 8B ?? ?? ?? 55 3B FB 75 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Obsidium_v1331_Obsidium_Software_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsidium_v1331_Obsidium_Software_h: PEiD
{
    strings:
        $a = { EB 01 ?? E8 29 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPX_290_LZMA_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPX_290_LZMA_additional: PEiD
{
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASPack_v102a
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 5D 81 ED 96 78 43 B8 90 78 43 03 C5 2B 85 7D 7C 43 89 85 89 7C 43 80 BD 74 7C }
        $b = { 60 E8 ?? ?? ?? ?? 5D 81 ED 3E D9 43 ?? B8 38 ?? ?? ?? 03 C5 2B 85 0B DE 43 ?? 89 85 17 DE 43 ?? 80 BD 01 DE 43 ?? ?? 75 15 FE 85 01 DE 43 ?? E8 1D ?? ?? ?? E8 79 02 ?? ?? E8 12 03 ?? ?? 8B 85 03 DE 43 ?? 03 85 17 DE 43 ?? 89 44 24 1C 61 FF }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule ASPack_v102a: PEiD
{
    strings:
        $a = { 60 E8 5D 81 ED 96 78 43 B8 90 78 43 03 C5 2B 85 7D 7C 43 89 85 89 7C 43 80 BD 74 7C }
        $b = { 60 E8 ?? ?? ?? ?? 5D 81 ED 3E D9 43 ?? B8 38 ?? ?? ?? 03 C5 2B 85 0B DE 43 ?? 89 85 17 DE 43 ?? 80 BD 01 DE 43 ?? ?? 75 15 FE 85 01 DE 43 ?? E8 1D ?? ?? ?? E8 79 02 ?? ?? E8 12 03 ?? ?? 8B 85 03 DE 43 ?? 03 85 17 DE 43 ?? 89 44 24 1C 61 FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: ASPack_v102b
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 ?? ?? ?? ?? 5D 81 ED 96 78 43 ?? B8 90 78 43 ?? 03 }
        $b = { 60 E8 00 00 00 00 5D 81 ED 96 78 43 00 B8 90 78 43 00 03 C5 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule ASPack_v102b: PEiD
{
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED 96 78 43 ?? B8 90 78 43 ?? 03 }
        $b = { 60 E8 00 00 00 00 5D 81 ED 96 78 43 00 B8 90 78 43 00 03 C5 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Unpacked_BS_SFX_Archive_v19_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 1E 33 C0 50 B8 ?? ?? 8E D8 FA 8E D0 BC ?? ?? FB B8 ?? ?? CD 21 3C 03 73 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Unpacked_BS_SFX_Archive_v19_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 1E 33 C0 50 B8 ?? ?? 8E D8 FA 8E D0 BC ?? ?? FB B8 ?? ?? CD 21 3C 03 73 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: fasm_Tomasz_Grysztar_flat
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 ?? 2B 8D EE 32 40 00 83 E9 0B 89 8D F2 32 40 ?? 80 BD D1 32 40 ?? 01 0F 84 }
        $b = { 6A 24 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule fasm_Tomasz_Grysztar_flat: PEiD
{
    strings:
        $a = { 53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 ?? 2B 8D EE 32 40 00 83 E9 0B 89 8D F2 32 40 ?? 80 BD D1 32 40 ?? 01 0F 84 }
        $b = { 6A 24 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Nullsoft_Install_System_1xx
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00 }
        $b = { 83 EC 0C 53 56 57 FF 15 20 71 40 00 05 E8 03 00 00 BE 60 FD 41 00 89 44 24 10 B3 20 FF 15 28 70 40 00 68 00 04 00 00 FF 15 28 71 40 00 50 56 FF 15 08 71 40 00 80 3D 60 FD 41 00 22 75 08 80 C3 02 BE 61 FD 41 00 8A 06 8B 3D F0 71 40 00 84 C0 74 0F 3A C3 74 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Nullsoft_Install_System_1xx: PEiD
{
    strings:
        $a = { 55 8B EC 83 EC 2C 53 56 33 F6 57 56 89 75 DC 89 75 F4 BB A4 9E 40 00 FF 15 60 70 40 00 BF C0 B2 40 00 68 04 01 00 00 57 50 A3 AC B2 40 00 FF 15 4C 70 40 00 56 56 6A 03 56 6A 01 68 00 00 00 80 57 FF 15 9C 70 40 00 8B F8 83 FF FF 89 7D EC 0F 84 C3 00 00 00 }
        $b = { 83 EC 0C 53 56 57 FF 15 20 71 40 00 05 E8 03 00 00 BE 60 FD 41 00 89 44 24 10 B3 20 FF 15 28 70 40 00 68 00 04 00 00 FF 15 28 71 40 00 50 56 FF 15 08 71 40 00 80 3D 60 FD 41 00 22 75 08 80 C3 02 BE 61 FD 41 00 8A 06 8B 3D F0 71 40 00 84 C0 74 0F 3A C3 74 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Go32Stub_v200_DOS_Extender
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 0E 1F 8C 1E ?? ?? 8C 06 ?? ?? FC B4 30 CD 21 80 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Go32Stub_v200_DOS_Extender: PEiD
{
    strings:
        $a = { 0E 1F 8C 1E ?? ?? 8C 06 ?? ?? FC B4 30 CD 21 80 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EncryptPE_V22004616_V22006630_WFS_Sign_by_fly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 9C 64 FF 35 00 00 00 00 E8 7A 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EncryptPE_V22004616_V22006630_WFS_Sign_by_fly: PEiD
{
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 00 E8 7A 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Alpha_BMP_graphics_file_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FF FF 00 01 64 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Alpha_BMP_graphics_file_Hint_FILE_START: PEiD
{
    strings:
        $a = { FF FF 00 01 64 00 00 00 }
    condition:
        $a at pe.entry_point

}