deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: ChinaProtect_dummy_Sign_by_fly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { C3 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 56 8B ?? ?? ?? 6A 40 68 00 10 00 00 8D ?? ?? 50 6A 00 E8 ?? ?? ?? ?? 89 30 83 C0 04 5E C3 8B 44 ?? ?? 56 8D ?? ?? 68 00 40 00 00 FF 36 56 E8 ?? ?? ?? ?? 68 00 80 00 00 6A 00 56 E8 ?? ?? ?? ?? 5E C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ChinaProtect_dummy_Sign_by_fly: PEiD
{
    strings:
        $a = { C3 E8 ?? ?? ?? ?? B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? FF 30 C3 56 8B ?? ?? ?? 6A 40 68 00 10 00 00 8D ?? ?? 50 6A 00 E8 ?? ?? ?? ?? 89 30 83 C0 04 5E C3 8B 44 ?? ?? 56 8D ?? ?? 68 00 40 00 00 FF 36 56 E8 ?? ?? ?? ?? 68 00 80 00 00 6A 00 56 E8 ?? ?? ?? ?? 5E C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Metrowerks_CodeWarrior_v20_Console
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 55 B8 FF FF FF FF 50 50 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Metrowerks_CodeWarrior_v20_Console: PEiD
{
    strings:
        $a = { 55 89 E5 55 B8 FF FF FF FF 50 50 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? ?? 00 00 E8 ?? ?? 00 00 E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Adys_Glue_v010
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 2E 8C 06 ?? ?? 0E 07 33 C0 8E D8 BE ?? ?? BF ?? ?? FC B9 ?? ?? 56 F3 A5 1E 07 5F }

Detection condition:
$a at pe.entry_point

Full rule:
rule Adys_Glue_v010: PEiD
{
    strings:
        $a = { 2E 8C 06 ?? ?? 0E 07 33 C0 8E D8 BE ?? ?? BF ?? ?? FC B9 ?? ?? 56 F3 A5 1E 07 5F }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _v10_Li_Jianjun
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _v10_Li_Jianjun: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 0A 4A 44 00 BB 04 4A 44 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Shrink_20_2
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 9C FC BE 27 01 8B FE 8C C8 05 00 10 8E C0 06 57 B9 41 00 F3 A4 8B 0E 23 01 BE 68 01 F3 A4 CB 00 00 00 00 BE 68 01 8B 0E 23 01 8A 26 25 01 1E 06 1F 07 BF 00 01 57 AC 3A C4 74 13 8A D8 AA E2 F6 5B 9D 58 06 53 8B D9 8B F1 8B F9 06 1F CB AC }

Detection condition:
$a at pe.entry_point

Full rule:
rule Shrink_20_2: PEiD
{
    strings:
        $a = { 50 9C FC BE 27 01 8B FE 8C C8 05 00 10 8E C0 06 57 B9 41 00 F3 A4 8B 0E 23 01 BE 68 01 F3 A4 CB 00 00 00 00 BE 68 01 8B 0E 23 01 8A 26 25 01 1E 06 1F 07 BF 00 01 57 AC 3A C4 74 13 8A D8 AA E2 F6 5B 9D 58 06 53 8B D9 8B F1 8B F9 06 1F CB AC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Ionic_Wind_Software_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9B DB E3 9B DB E2 D9 2D 00 ?? ?? 00 55 89 E5 E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Ionic_Wind_Software_additional: PEiD
{
    strings:
        $a = { 9B DB E3 9B DB E2 D9 2D 00 ?? ?? 00 55 89 E5 E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Shrink_20_1
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 00 00 50 9C FC BE 27 01 8B FE 8C C8 05 00 10 8E C0 06 57 B9 41 00 F3 A4 8B 0E 23 01 BE 68 01 F3 A4 CB 00 00 00 00 BE 68 01 8B 0E 23 01 8A 26 25 01 1E 06 1F 07 BF 00 01 57 AC 3A C4 74 13 8A D8 AA E2 F6 5B 9D 58 06 53 8B D9 8B F1 8B F9 06 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Shrink_20_1: PEiD
{
    strings:
        $a = { E9 00 00 50 9C FC BE 27 01 8B FE 8C C8 05 00 10 8E C0 06 57 B9 41 00 F3 A4 8B 0E 23 01 BE 68 01 F3 A4 CB 00 00 00 00 BE 68 01 8B 0E 23 01 8A 26 25 01 1E 06 1F 07 BF 00 01 57 AC 3A C4 74 13 8A D8 AA E2 F6 5B 9D 58 06 53 8B D9 8B F1 8B F9 06 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_V2X_Bitsum_Technologies
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_V2X_Bitsum_Technologies: PEiD
{
    strings:
        $a = { B8 ?? ?? ?? ?? 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ExeCode_v10_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? FA 8C C3 02 DF 50 33 C0 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 8E D0 BC ?? ?? BE ?? ?? B9 ?? ?? 33 FF 2E ?? ?? ?? ?? ?? ?? 32 DB B0 ?? E6 64 AC }

Detection condition:
$a at pe.entry_point

Full rule:
rule ExeCode_v10_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? FA 8C C3 02 DF 50 33 C0 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 8E D0 BC ?? ?? BE ?? ?? B9 ?? ?? 33 FF 2E ?? ?? ?? ?? ?? ?? 32 DB B0 ?? E6 64 AC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Erdas_LANGIS_Image_graphics_format_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 48 45 41 44 37 34 00 00 03 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Erdas_LANGIS_Image_graphics_format_additional: PEiD
{
    strings:
        $a = { 48 45 41 44 37 34 00 00 03 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PC_Guard_v303d_v305d_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C }

Detection condition:
$a at pe.entry_point

Full rule:
rule PC_Guard_v303d_v305d_additional: PEiD
{
    strings:
        $a = { FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_02_Code_Lock_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_02_Code_Lock_Anorganix: PEiD
{
    strings:
        $a = { 43 4F 44 45 2D 4C 4F 43 4B 2E 4F 43 58 00 01 28 01 50 4B 47 05 4C 3F B4 04 4D 4C 47 4B }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AntiDote_10_Demo_12_SIS_Team
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C }

Detection condition:
$a at pe.entry_point

Full rule:
rule AntiDote_10_Demo_12_SIS_Team: PEiD
{
    strings:
        $a = { 00 00 00 00 09 01 47 65 74 43 6F 6D 6D 61 6E 64 4C 69 6E 65 41 00 DB 01 47 65 74 56 65 72 73 69 6F 6E 45 78 41 00 73 01 47 65 74 4D 6F 64 75 6C 65 46 69 6C 65 4E 61 6D 65 41 00 00 7A 03 57 61 69 74 46 6F 72 53 69 6E 67 6C 65 4F 62 6A 65 63 74 00 BF 02 52 65 73 75 6D 65 54 68 72 65 61 64 00 00 29 03 53 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 94 03 57 72 69 74 65 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 00 6B 03 56 69 72 74 75 61 6C 41 6C 6C 6F 63 45 78 00 00 A6 02 52 65 61 64 50 72 6F 63 65 73 73 4D 65 6D 6F 72 79 00 CA 01 47 65 74 54 68 72 65 61 64 43 6F 6E 74 65 78 74 00 00 62 00 43 72 65 61 74 65 50 72 6F 63 65 73 73 41 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Mask_23
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 57 CD 03 FC 4D 41 53 4B FA 8B EC 83 6E 06 03 FF 76 06 5D 49 E8 00 00 5B 81 EB A6 05 50 D6 51 52 56 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Mask_23: PEiD
{
    strings:
        $a = { 55 57 CD 03 FC 4D 41 53 4B FA 8B EC 83 6E 06 03 FF 76 06 5D 49 E8 00 00 5B 81 EB A6 05 50 D6 51 52 56 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MoleBox_V23X_MoleStudiocom
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 00 00 00 00 60 E8 4F 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MoleBox_V23X_MoleStudiocom: PEiD
{
    strings:
        $a = { E8 00 00 00 00 60 E8 4F 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ProPack_208_m2_EXE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8C D3 8E C3 8C CA 8E DA 8B 0E 08 00 8B F1 83 EE 02 8B FE D1 E9 FD F3 A5 53 B8 2E 00 50 8B 2E 0A 00 CB B8 00 10 3B C5 76 02 8B C5 2B E8 2B D0 2B D8 8E DA 8E C3 B1 03 D3 E0 8B C8 D1 E0 48 48 8B F0 8B F8 F3 A5 0B ED 75 D9 FC 8E C2 8E DB BE 12 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ProPack_208_m2_EXE: PEiD
{
    strings:
        $a = { 8C D3 8E C3 8C CA 8E DA 8B 0E 08 00 8B F1 83 EE 02 8B FE D1 E9 FD F3 A5 53 B8 2E 00 50 8B 2E 0A 00 CB B8 00 10 3B C5 76 02 8B C5 2B E8 2B D0 2B D8 8E DA 8E C3 B1 03 D3 E0 8B C8 D1 E0 48 48 8B F0 8B F8 F3 A5 0B ED 75 D9 FC 8E C2 8E DB BE 12 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Mask_25
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 57 CD 03 FC 4D 41 53 4B FD 50 FA 8B C4 F7 DC BC 01 00 94 49 FB D6 51 52 1F 52 56 B4 30 CD 21 C7 06 00 00 0D 0A C7 06 00 00 07 24 BA 00 00 B4 09 EB 00 B9 53 01 56 5D BE 00 00 56 5F B8 15 35 CD 21 06 53 BA 00 00 0E 07 B4 25 CD 21 EB 1B 05 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Mask_25: PEiD
{
    strings:
        $a = { 55 57 CD 03 FC 4D 41 53 4B FD 50 FA 8B C4 F7 DC BC 01 00 94 49 FB D6 51 52 1F 52 56 B4 30 CD 21 C7 06 00 00 0D 0A C7 06 00 00 07 24 BA 00 00 B4 09 EB 00 B9 53 01 56 5D BE 00 00 56 5F B8 15 35 CD 21 06 53 BA 00 00 0E 07 B4 25 CD 21 EB 1B 05 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_v0399_Dwing
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 02 00 00 00 00 00 00 ?? 00 00 00 00 00 10 00 00 ?? 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? 00 14 00 00 00 00 ?? ?? 00 ?? ?? 00 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? 00 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? 00 ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 }
        $b = { 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 02 00 00 00 00 00 00 ?? 00 00 00 00 00 10 00 00 ?? 00 00 00 00 10 00 00 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Upack_v0399_Dwing: PEiD
{
    strings:
        $a = { 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 02 00 00 00 00 00 00 ?? 00 00 00 00 00 10 00 00 ?? 00 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? 00 14 00 00 00 00 ?? ?? 00 ?? ?? 00 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? 00 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? 00 ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 }
        $b = { 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? 00 00 00 40 00 00 10 00 00 00 02 00 00 04 00 00 00 00 00 3A 00 04 00 00 00 00 00 00 00 00 ?? ?? 00 00 02 00 00 00 00 00 00 ?? 00 00 00 00 00 10 00 00 ?? 00 00 00 00 10 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Matrix_Dongle_TDi_GmbH
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 E8 B6 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? E8 00 00 00 00 5B 2B D9 8B F8 8B 4C 24 2C 33 C0 2B CF F2 AA 8B 3C 24 8B 0A 2B CF 89 5C 24 20 80 37 A2 47 49 75 F9 8D 64 24 04 FF 64 24 FC 60 C7 42 08 ?? ?? ?? ?? E8 C5 FF FF FF C3 C2 F7 29 4E 29 5A 29 E6 86 8A 89 63 5C A2 65 E2 A3 A2 }
        $b = { E8 00 00 00 00 E8 00 00 00 00 59 5A 2B CA 2B D1 E8 1A FF FF FF }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Matrix_Dongle_TDi_GmbH: PEiD
{
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 E8 B6 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? E8 00 00 00 00 5B 2B D9 8B F8 8B 4C 24 2C 33 C0 2B CF F2 AA 8B 3C 24 8B 0A 2B CF 89 5C 24 20 80 37 A2 47 49 75 F9 8D 64 24 04 FF 64 24 FC 60 C7 42 08 ?? ?? ?? ?? E8 C5 FF FF FF C3 C2 F7 29 4E 29 5A 29 E6 86 8A 89 63 5C A2 65 E2 A3 A2 }
        $b = { E8 00 00 00 00 E8 00 00 00 00 59 5A 2B CA 2B D1 E8 1A FF FF FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Trilobytes_RNR_graphics_library
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 84 10 ?? ?? ?? ?? ?? ?? ?? 10 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Trilobytes_RNR_graphics_library: PEiD
{
    strings:
        $a = { 84 10 ?? ?? ?? ?? ?? ?? ?? 10 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ILUCRYPT_v4015_exe
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B EC FA C7 46 F7 ?? ?? 42 81 FA ?? ?? 75 F9 FF 66 F7 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ILUCRYPT_v4015_exe: PEiD
{
    strings:
        $a = { 8B EC FA C7 46 F7 ?? ?? 42 81 FA ?? ?? 75 F9 FF 66 F7 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MSLRH_032a_fake_nSPack_13_emadicius
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D3 FE FF FF 8B 06 83 F8 00 74 11 8D B5 DF FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MSLRH_032a_fake_nSPack_13_emadicius: PEiD
{
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 D3 FE FF FF 8B 06 83 F8 00 74 11 8D B5 DF FE FF FF 8B 06 83 F8 01 0F 84 F1 01 00 00 61 9D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: BAFF_BMPs_graphics_library_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 42 41 46 46 01 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule BAFF_BMPs_graphics_library_Hint_FILE_START: PEiD
{
    strings:
        $a = { 42 41 46 46 01 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_v0399_Dwing_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_v0399_Dwing_additional: PEiD
{
    strings:
        $a = { BE B0 11 ?? ?? AD 50 FF 76 34 EB 7C 48 01 ?? ?? 0B 01 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 18 10 00 00 10 00 00 00 00 ?? ?? ?? 00 00 ?? ?? 00 10 00 00 00 02 00 00 04 00 00 00 00 00 39 00 04 00 00 00 00 00 00 00 00 ?? ?? ?? 00 02 00 00 00 00 00 00 ?? 00 00 ?? 00 00 ?? 00 00 ?? ?? 00 00 00 10 00 00 10 00 00 00 00 00 00 0A 00 00 00 00 00 00 00 00 00 00 00 EE ?? ?? ?? 14 00 00 00 00 ?? ?? ?? ?? ?? ?? 00 FF 76 38 AD 50 8B 3E BE F0 ?? ?? ?? 6A 27 59 F3 A5 FF 76 04 83 C8 FF 8B DF AB EB 1C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 ?? ?? ?? ?? ?? 00 00 00 40 AB 40 B1 04 F3 AB C1 E0 0A B5 ?? F3 AB 8B 7E 0C 57 51 E9 ?? ?? ?? ?? 56 10 E2 E3 B1 04 D3 E0 03 E8 8D 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 99 59 D1 E8 13 D2 E2 FA 5D 03 EA 45 59 89 6B 08 56 8B F7 2B F5 F3 A4 AC 5E B1 80 AA 3B 7E 34 0F 82 AC FE FF FF 58 5F 59 E3 1B 8A 07 47 04 18 3C 02 73 F7 8B 07 3C ?? 75 F3 B0 00 0F C8 03 46 38 2B C7 AB E2 E5 5E 5D 59 46 AD 85 C0 74 1F 51 56 97 FF D1 93 AC 84 C0 75 FB 38 06 74 EA 8B C6 79 05 46 33 C0 66 AD 50 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Obsidium_V125_Obsidium_Software
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsidium_V125_Obsidium_Software: PEiD
{
    strings:
        $a = { E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Obsidium_V1304_Obsidium_Software
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 02 ?? ?? E8 ?? 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsidium_V1304_Obsidium_Software: PEiD
{
    strings:
        $a = { EB 02 ?? ?? E8 ?? 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Inset_Systems_IGF_graphics_file
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 01 80 04 00 01 00 58 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Inset_Systems_IGF_graphics_file: PEiD
{
    strings:
        $a = { 01 80 04 00 01 00 58 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_022_023_beta_Dwing_
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 59 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_022_023_beta_Dwing_: PEiD
{
    strings:
        $a = { 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 59 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: NsPack_30_by_North_Star_Liu_Xing_Ping_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 55 F9 FF FF 66 8B 06 66 83 F8 00 74 15 8B F5 8D B5 7D F9 FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 11 F9 FF FF 89 95 }

Detection condition:
$a at pe.entry_point

Full rule:
rule NsPack_30_by_North_Star_Liu_Xing_Ping_additional: PEiD
{
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 55 F9 FF FF 66 8B 06 66 83 F8 00 74 15 8B F5 8D B5 7D F9 FF FF 66 8B 06 66 83 F8 01 0F 84 42 02 00 00 C6 06 01 8B D5 2B 95 11 F9 FF FF 89 95 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Turbo_Pascal_v50_Unit_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 54 50 55 35 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Turbo_Pascal_v50_Unit_Hint_FILE_START: PEiD
{
    strings:
        $a = { 54 50 55 35 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: DzA_Patcher_13_Loader
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35 }

Detection condition:
$a at pe.entry_point

Full rule:
rule DzA_Patcher_13_Loader: PEiD
{
    strings:
        $a = { BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CopyControl_v303_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13 D6 83 C7 32 F7 DA 03 FE EB 02 CD 20 87 FA 88 10 EB 02 CD 20 40 E8 02 00 00 00 F1 F8 5B 4E 2B D2 85 F6 75 AF EB 02 DE 09 EB 01 EF 34 4A 7C BC 7D 3D 7F 90 C1 82 41 ?? ?? ?? 87 DB 71 94 8B 8C 8D 90 61 05 96 1C A9 DA A7 68 5A 4A 19 CD 76 40 50 A0 9E B4 C5 15 9B D7 6E A5 BB CC 1C C2 DE 6C AC C2 D3 23 D2 65 B5 F5 65 C6 B6 CC DD CC 7B 2F B6 33 FE 6A AC 9E AB 07 C5 C6 C7 F3 94 3F DB B4 05 CE CF D0 BC FA 7F A5 BD 4A 18 EB A2 C5 F7 6D 25 9F BF E8 8D CA 05 E4 E5 E6 24 E8 66 EA EB 5F F7 6E EB F5 64 F8 76 EC 74 6D F9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CopyControl_v303_additional: PEiD
{
    strings:
        $a = { 1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13 D6 83 C7 32 F7 DA 03 FE EB 02 CD 20 87 FA 88 10 EB 02 CD 20 40 E8 02 00 00 00 F1 F8 5B 4E 2B D2 85 F6 75 AF EB 02 DE 09 EB 01 EF 34 4A 7C BC 7D 3D 7F 90 C1 82 41 ?? ?? ?? 87 DB 71 94 8B 8C 8D 90 61 05 96 1C A9 DA A7 68 5A 4A 19 CD 76 40 50 A0 9E B4 C5 15 9B D7 6E A5 BB CC 1C C2 DE 6C AC C2 D3 23 D2 65 B5 F5 65 C6 B6 CC DD CC 7B 2F B6 33 FE 6A AC 9E AB 07 C5 C6 C7 F3 94 3F DB B4 05 CE CF D0 BC FA 7F A5 BD 4A 18 EB A2 C5 F7 6D 25 9F BF E8 8D CA 05 E4 E5 E6 24 E8 66 EA EB 5F F7 6E EB F5 64 F8 76 EC 74 6D F9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Datafile_from_Norton_Utilities
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 4E 43 49 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Datafile_from_Norton_Utilities: PEiD
{
    strings:
        $a = { 50 4E 43 49 }
    condition:
        $a at pe.entry_point

}