deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: _PseudoSigner_02_PE_Protect_09_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_02_PE_Protect_09_Anorganix: PEiD
{
    strings:
        $a = { 52 51 55 57 64 67 A1 30 00 85 C0 78 0D E8 07 00 00 00 58 83 C0 07 C6 90 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Compiler_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8C C3 83 C3 10 2E 01 1E ?? 02 2E 03 1E ?? 02 53 1E }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Compiler_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 8C C3 83 C3 10 2E 01 1E ?? 02 2E 03 1E ?? 02 53 1E }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASPack_v10802_Hint_WIN_EP_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 90 75 01 90 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASPack_v10802_Hint_WIN_EP_additional: PEiD
{
    strings:
        $a = { 90 90 75 01 90 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: NeoLite_v200
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B 44 24 04 23 05 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 04 FE 05 ?? ?? ?? ?? 0B C0 74 }

Detection condition:
$a at pe.entry_point

Full rule:
rule NeoLite_v200: PEiD
{
    strings:
        $a = { 8B 44 24 04 23 05 ?? ?? ?? ?? 50 E8 ?? ?? ?? ?? 83 C4 04 FE 05 ?? ?? ?? ?? 0B C0 74 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASProtect_SKE_23_Alexey_Solodovnikov_h_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 E5 0B 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASProtect_SKE_23_Alexey_Solodovnikov_h_additional: PEiD
{
    strings:
        $a = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 E5 0B 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? 00 00 00 00 B8 F8 C0 A5 23 50 50 03 45 4E 5B 85 C0 74 1C EB 01 E8 81 FB F8 C0 A5 23 74 35 33 D2 56 6A 00 56 FF 75 4E FF D0 5E 83 FE 00 75 24 33 D2 8B 45 41 85 C0 74 07 52 52 FF 75 35 FF D0 8B 45 35 85 C0 74 0D 68 00 80 00 00 6A 00 FF 75 35 FF 55 3D 5B 0B DB 61 75 06 6A 01 58 C2 0C 00 33 C0 F7 D8 1B C0 40 C2 0C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FMC_Faust_Module_music_file_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 46 4D 43 21 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FMC_Faust_Module_music_file_Hint_FILE_START: PEiD
{
    strings:
        $a = { 46 4D 43 21 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PESpin_V10_cyberbobnbsp_nbsp_SignByfly_20080312
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 C8 DC 46 00 0B E4 74 9E 75 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 19 77 00 43 B7 F6 C3 ?? ?? ?? ?? ?? ?? ?? C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 ?? EB FB FF 8B ?? ?? ?? ?? ?? 8B 42 3C 03 C2 89 ?? ?? ?? ?? ?? EB 02 ?? ?? F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 ?? ?? ?? ?? 83 04 24 0C C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PESpin_V10_cyberbobnbsp_nbsp_SignByfly_20080312: PEiD
{
    strings:
        $a = { EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 C8 DC 46 00 0B E4 74 9E 75 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 19 77 00 43 B7 F6 C3 ?? ?? ?? ?? ?? ?? ?? C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 ?? EB FB FF 8B ?? ?? ?? ?? ?? 8B 42 3C 03 C2 89 ?? ?? ?? ?? ?? EB 02 ?? ?? F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 ?? ?? ?? ?? 83 04 24 0C C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: kryptor_3
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 03 E9 EB 6C 58 40 FF }
        $b = { EB 66 87 DB }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule kryptor_3: PEiD
{
    strings:
        $a = { E8 03 E9 EB 6C 58 40 FF }
        $b = { EB 66 87 DB }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: kryptor_6
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 03 ?? ?? ?? E9 EB 68 58 33 D2 74 02 E9 E9 40 42 75 02 }

Detection condition:
$a at pe.entry_point

Full rule:
rule kryptor_6: PEiD
{
    strings:
        $a = { E8 03 ?? ?? ?? E9 EB 68 58 33 D2 74 02 E9 E9 40 42 75 02 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: kryptor_5
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 03 ?? ?? ?? E9 EB 6C 58 40 FF E0 }

Detection condition:
$a at pe.entry_point

Full rule:
rule kryptor_5: PEiD
{
    strings:
        $a = { E8 03 ?? ?? ?? E9 EB 6C 58 40 FF E0 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: kryptor_9
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 ?? ?? ?? ?? 5E B9 ?? ?? ?? ?? 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 ?? 66 B9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule kryptor_9: PEiD
{
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5E B9 ?? ?? ?? ?? 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 ?? 66 B9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: kryptor_8
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 5E B9 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 66 }
        $b = { EB 6A 87 DB }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule kryptor_8: PEiD
{
    strings:
        $a = { 60 E8 5E B9 2B C0 02 04 0E D3 C0 49 79 F8 41 8D 7E 2C 33 46 66 }
        $b = { EB 6A 87 DB }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: ASPack_212withouth_Poly_Solodovnikov_Alexey
Repository: Yara-Rules/rules

Pattern signatures:
$a = { ?? E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASPack_212withouth_Poly_Solodovnikov_Alexey: PEiD
{
    strings:
        $a = { ?? E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_C_for_Windows_1
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 33 ED 55 9A ?? ?? ?? ?? 0B C0 74 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_C_for_Windows_1: PEiD
{
    strings:
        $a = { 33 ED 55 9A ?? ?? ?? ?? 0B C0 74 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_C_for_Windows_2
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8C D8 ?? 45 55 8B EC 1E 8E D8 57 56 89 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_C_for_Windows_2: PEiD
{
    strings:
        $a = { 8C D8 ?? 45 55 8B EC 1E 8E D8 57 56 89 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_v110_Eng_dulekxt_Microsoft_Visual_Cpp_60_ASM_
Repository: Yara-Rules/rules

Pattern signatures:
$a = { F7 D0 EB 02 CD 20 BE BB 74 1C FB EB 02 CD 20 BF 3B ?? ?? FB C1 C1 03 33 F7 EB 02 CD 20 68 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Cpp_60_ASM_: PEiD
{
    strings:
        $a = { F7 D0 EB 02 CD 20 BE BB 74 1C FB EB 02 CD 20 BF 3B ?? ?? FB C1 C1 03 33 F7 EB 02 CD 20 68 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: TXT2COM_v206
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8D 26 ?? ?? E8 ?? ?? B8 ?? ?? CD 21 CD 20 54 58 54 32 43 4F 4D 20 }

Detection condition:
$a at pe.entry_point

Full rule:
rule TXT2COM_v206: PEiD
{
    strings:
        $a = { 8D 26 ?? ?? E8 ?? ?? B8 ?? ?? CD 21 CD 20 54 58 54 32 43 4F 4D 20 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SLVc0deProtector_v11_SLV_h_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule SLVc0deProtector_v11_SLV_h_additional: PEiD
{
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 94 73 42 00 8B D5 81 C2 E3 73 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: VMProtect_07x_08_PolyTech
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 5B 20 56 4D 50 72 6F 74 65 63 74 20 76 20 30 2E 38 20 28 43 29 20 50 6F 6C 79 54 65 63 68 20 5D }

Detection condition:
$a at pe.entry_point

Full rule:
rule VMProtect_07x_08_PolyTech: PEiD
{
    strings:
        $a = { 5B 20 56 4D 50 72 6F 74 65 63 74 20 76 20 30 2E 38 20 28 43 29 20 50 6F 6C 79 54 65 63 68 20 5D }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: WinUpack_v030_beta_By_Dwing_
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 }

Detection condition:
$a at pe.entry_point

Full rule:
rule WinUpack_v030_beta_By_Dwing_: PEiD
{
    strings:
        $a = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Eddie1028_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? 5E FC 83 ?? ?? 81 ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E B8 FE 4B CD 21 81 FF BB 55 ?? ?? 07 ?? ?? ?? 07 B4 49 CD 21 BB FF FF B4 48 CD 21 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Eddie1028_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E8 ?? ?? 5E FC 83 ?? ?? 81 ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 50 06 56 1E B8 FE 4B CD 21 81 FF BB 55 ?? ?? 07 ?? ?? ?? 07 B4 49 CD 21 BB FF FF B4 48 CD 21 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: LHICE_SFX_Archive_v113_v117_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB ?? FC BC ?? ?? BB ?? ?? E8 ?? ?? 8C C8 2E ?? ?? ?? ?? 8E D8 8E C0 05 ?? ?? 2E ?? ?? ?? ?? 76 ?? BB }

Detection condition:
$a at pe.entry_point

Full rule:
rule LHICE_SFX_Archive_v113_v117_Hint_DOS_EP: PEiD
{
    strings:
        $a = { EB ?? FC BC ?? ?? BB ?? ?? E8 ?? ?? 8C C8 2E ?? ?? ?? ?? 8E D8 8E C0 05 ?? ?? 2E ?? ?? ?? ?? 76 ?? BB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: NoobyProtect_V1XXX_Nooby_20090201
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E ?? 2E ?? 2E ?? 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule NoobyProtect_V1XXX_Nooby_20090201: PEiD
{
    strings:
        $a = { 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E ?? 2E ?? 2E ?? 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: InstallShield_Cabinet_Archive
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 49 53 63 }

Detection condition:
$a at pe.entry_point

Full rule:
rule InstallShield_Cabinet_Archive: PEiD
{
    strings:
        $a = { 49 53 63 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXE2COM_Method_1_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8C DB BE ?? ?? 8B C6 B1 ?? D3 E8 03 C3 03 ?? ?? A3 ?? ?? 8C C8 05 ?? ?? A3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXE2COM_Method_1_additional: PEiD
{
    strings:
        $a = { 8C DB BE ?? ?? 8B C6 B1 ?? D3 E8 03 C3 03 ?? ?? A3 ?? ?? 8C C8 05 ?? ?? A3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RLPack_V119_Dll_LZMA_430_ap0x_SignByfly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RLPack_V119_Dll_LZMA_430_ap0x_SignByfly: PEiD
{
    strings:
        $a = { 80 7C 24 08 01 0F 85 C7 01 00 00 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 49 0B 00 00 EB 0C 8B 85 45 0B 00 00 89 85 49 0B 00 00 8D B5 6D 0B 00 00 8D 9D 2F 03 00 00 33 FF 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 DA 0A 00 00 89 85 41 0B 00 00 E8 76 01 00 00 EB 20 60 8B 85 49 0B 00 00 FF B5 41 0B 00 00 FF 34 37 01 04 24 FF 74 37 04 01 04 24 FF D3 61 83 C7 08 83 3C 37 00 75 DA 83 BD 55 0B 00 00 00 74 0E 83 BD 59 0B 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A 40 68 00 10 00 00 68 ?? ?? ?? ?? 6A 00 FF 95 DA 0A 00 00 89 85 69 0B 00 00 5B 60 FF B5 41 0B 00 00 56 FF B5 69 0B 00 00 FF D3 61 8B B5 69 0B 00 00 8B C6 EB 01 40 80 38 01 75 FA 40 8B 38 03 BD 49 0B 00 00 83 C0 04 89 85 65 0B 00 00 E9 98 00 00 00 56 FF 95 D2 0A 00 00 89 85 61 0B 00 00 85 C0 0F 84 C8 00 00 00 8B C6 EB 5F 8B 85 65 0B 00 00 8B 00 A9 00 00 00 80 74 14 35 00 00 00 80 50 8B 85 65 0B 00 00 C7 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_TravJack883_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB ?? 9C 9E 26 ?? ?? 51 04 ?? 7D ?? 00 ?? 2E ?? ?? ?? ?? 8C C8 8E C0 8E D8 80 ?? ?? ?? ?? 74 ?? 8A ?? ?? ?? BB ?? ?? 8A ?? 32 C2 88 ?? FE C2 43 81 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_TravJack883_Hint_DOS_EP: PEiD
{
    strings:
        $a = { EB ?? 9C 9E 26 ?? ?? 51 04 ?? 7D ?? 00 ?? 2E ?? ?? ?? ?? 8C C8 8E C0 8E D8 80 ?? ?? ?? ?? 74 ?? 8A ?? ?? ?? BB ?? ?? 8A ?? 32 C2 88 ?? FE C2 43 81 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_01_CrunchPE_Heuristic_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_01_CrunchPE_Heuristic_Anorganix: PEiD
{
    strings:
        $a = { 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CPAV_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? 4D 5A B1 01 93 01 00 00 02 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CPAV_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E8 ?? ?? 4D 5A B1 01 93 01 00 00 02 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PE_Spin_v0b
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9 }
        $b = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9 8B 95 68 20 40 00 8B 42 3C 03 C2 89 85 76 20 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D 8A 20 40 00 8B 59 24 03 DA 8B 1B 89 9D 8E 20 40 00 53 8F 85 E2 1F 40 00 8D 85 92 20 40 00 6A 0C 5B 6A 17 59 30 0C 03 02 CB 4B 75 F8 40 8D 9D 41 8F 4E 00 50 53 81 2C 24 01 78 0E 00 FF B5 8A 20 40 00 C3 92 EB 15 68 BB ?? 00 00 00 B9 90 08 00 00 8D BD FF 20 40 00 4F 30 1C 39 FE CB E2 F9 68 1D 01 00 00 59 8D BD 2F 28 40 00 C0 0C 39 02 E2 FA 68 A0 20 40 00 50 01 6

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule PE_Spin_v0b: PEiD
{
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9 }
        $b = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 72 C8 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 26 E8 01 00 00 00 EA 5A 33 C9 8B 95 68 20 40 00 8B 42 3C 03 C2 89 85 76 20 40 00 41 C1 E1 07 8B 0C 01 03 CA 8B 59 10 03 DA 8B 1B 89 9D 8A 20 40 00 8B 59 24 03 DA 8B 1B 89 9D 8E 20 40 00 53 8F 85 E2 1F 40 00 8D 85 92 20 40 00 6A 0C 5B 6A 17 59 30 0C 03 02 CB 4B 75 F8 40 8D 9D 41 8F 4E 00 50 53 81 2C 24 01 78 0E 00 FF B5 8A 20 40 00 C3 92 EB 15 68 BB ?? 00 00 00 B9 90 08 00 00 8D BD FF 20 40 00 4F 30 1C 39 FE CB E2 F9 68 1D 01 00 00 59 8D BD 2F 28 40 00 C0 0C 39 02 E2 FA 68 A0 20 40 00 50 01 6C 24 04 E8 BD 09 00 00 33 C0 0F 84 C0 08 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: ASPack_v10803_Alexey_Solodovnikov
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASPack_v10803_Alexey_Solodovnikov: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 00 03 DD }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Adobe_PDF_Portable_document_Version_v3v4
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 25 50 44 46 2D ?? 2E }

Detection condition:
$a at pe.entry_point

Full rule:
rule Adobe_PDF_Portable_document_Version_v3v4: PEiD
{
    strings:
        $a = { 25 50 44 46 2D ?? 2E }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: HACKSTOP_v119_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? D6 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule HACKSTOP_v119_additional: PEiD
{
    strings:
        $a = { 52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? D6 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PKLITE_v112_v115_v120_2_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? BA ?? ?? 3B C4 73 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PKLITE_v112_v115_v120_2_Hint_DOS_EP: PEiD
{
    strings:
        $a = { B8 ?? ?? BA ?? ?? 3B C4 73 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_V01X_V02X_Dwing
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 1E B8 CD 7B CD 21 81 FB CD 7B 75 03 E9 87 00 33 DB 0E 1F 8C }
        $b = { BE 88 01 ?? ?? AD 8B F8 95 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Upack_V01X_V02X_Dwing: PEiD
{
    strings:
        $a = { 1E B8 CD 7B CD 21 81 FB CD 7B 75 03 E9 87 00 33 DB 0E 1F 8C }
        $b = { BE 88 01 ?? ?? AD 8B F8 95 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: PeCompact2_253_276_Slim_Loader_BitSum_Technologies
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PeCompact2_253_276_Slim_Loader_BitSum_Technologies: PEiD
{
    strings:
        $a = { B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 32 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_v120_Eng_dulekxt_Borland_Delphi_Borland_Cpp_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 ?? ?? 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB EE 90 14 2C 77 2A D3 EB 01 87 2A D3 E8 01 00 00 00 92 59 88 16 EB 02 52 08 46 EB 02 CD 20 4B 80 F1 C2 85 DB 75 AE C1 E0 04 EB 00 DA B2 82 5C 9B C7 89 98 4F 8A F7 ?? ?? ?? B1 4D DF B8 AD AC AB D4 07 27 D4 50 CF 9A D5 1C EC F2 27 77 18 40 4E A4 A8 B4 CB 9F 1D D9 EC 1F AD BC 82 AA C0 4C 0A A2 15 45 18 8F BB 07 93 BE C0 BC A3 B0 9D 51 D4 F1 08 22 62 96 6D 09 73 7E 71 A5 3A E5 7D 94 A3 96 99 98 72 B2 31 57 7B FA AE 9D 28 4F 99 EF A3 25 49 60 03 42 8B 54 53 5E 92 50 D4 52 4D C1 55 76 FD F7 8A FC 78 0C 82 87 0F }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_v120_Eng_dulekxt_Borland_Delphi_Borland_Cpp_additional: PEiD
{
    strings:
        $a = { 0F BE C1 EB 01 0E 8D 35 C3 BE B6 22 F7 D1 68 43 ?? ?? 22 EB 02 B5 15 5F C1 F1 15 33 F7 80 E9 F9 BB F4 00 00 00 EB 02 8F D0 EB 02 08 AD 8A 16 2B C7 1B C7 80 C2 7A 41 80 EA 10 EB 01 3C 81 EA CF AE F1 AA EB 01 EC 81 EA BB C6 AB EE 2C E3 32 D3 0B CB 81 EA AB EE 90 14 2C 77 2A D3 EB 01 87 2A D3 E8 01 00 00 00 92 59 88 16 EB 02 52 08 46 EB 02 CD 20 4B 80 F1 C2 85 DB 75 AE C1 E0 04 EB 00 DA B2 82 5C 9B C7 89 98 4F 8A F7 ?? ?? ?? B1 4D DF B8 AD AC AB D4 07 27 D4 50 CF 9A D5 1C EC F2 27 77 18 40 4E A4 A8 B4 CB 9F 1D D9 EC 1F AD BC 82 AA C0 4C 0A A2 15 45 18 8F BB 07 93 BE C0 BC A3 B0 9D 51 D4 F1 08 22 62 96 6D 09 73 7E 71 A5 3A E5 7D 94 A3 96 99 98 72 B2 31 57 7B FA AE 9D 28 4F 99 EF A3 25 49 60 03 42 8B 54 53 5E 92 50 D4 52 4D C1 55 76 FD F7 8A FC 78 0C 82 87 0F }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: A3E_TXT2COM_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 1E 33 C0 50 BE ?? ?? 81 C6 ?? ?? B8 ?? ?? 8E C0 BF ?? ?? B9 ?? ?? F3 A5 CB }

Detection condition:
$a at pe.entry_point

Full rule:
rule A3E_TXT2COM_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 1E 33 C0 50 BE ?? ?? 81 C6 ?? ?? B8 ?? ?? 8E C0 BF ?? ?? B9 ?? ?? F3 A5 CB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: May_be_Pklite_Header_Version_v6v2_extra_0_v5_1_Hint_HDR_END
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 4B }

Detection condition:
$a at pe.entry_point

Full rule:
rule May_be_Pklite_Header_Version_v6v2_extra_0_v5_1_Hint_HDR_END: PEiD
{
    strings:
        $a = { 50 4B }
    condition:
        $a at pe.entry_point

}