deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Armadillo_v410_Silicon_Realms_Toolworks_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 F8 8E 4C 00 68 D0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 7C A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 78 A5 4C 00 C1 E1 08 03 CA 89 0D 74 A5 4C 00 C1 E8 10 A3 70 A5 4C 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C 30 4C 00 A3 84 BB 4C 00 E8 01 12 00 00 A3 D0 A5 4C 00 E8 AA 0F 00 00 E8 EC 0E 00 00 E8 2D FA FF FF 89 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_v410_Silicon_Realms_Toolworks_additional: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 F8 8E 4C 00 68 D0 EA 49 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 31 4C 00 33 D2 8A D4 89 15 7C A5 4C 00 8B C8 81 E1 FF 00 00 00 89 0D 78 A5 4C 00 C1 E1 08 03 CA 89 0D 74 A5 4C 00 C1 E8 10 A3 70 A5 4C 00 33 F6 56 E8 78 16 00 00 59 85 C0 75 08 6A 1C E8 B0 00 00 00 59 89 75 FC E8 43 13 00 00 FF 15 8C 30 4C 00 A3 84 BB 4C 00 E8 01 12 00 00 A3 D0 A5 4C 00 E8 AA 0F 00 00 E8 EC 0E 00 00 E8 2D FA FF FF 89 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PEtite_v12_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 60 E8 CA ?? ?? ?? 03 ?? 04 ?? 05 ?? 06 ?? 07 ?? 08 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PEtite_v12_additional: PEiD
{
    strings:
        $a = { 9C 60 E8 CA ?? ?? ?? 03 ?? 04 ?? 05 ?? 06 ?? 07 ?? 08 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_ACProtect_109_Anorganix_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_ACProtect_109_Anorganix_additional: PEiD
{
    strings:
        $a = { 60 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 04 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_v2xx
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_v2xx: PEiD
{
    strings:
        $a = { B8 ?? ?? ?? 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Borland_Cpp_DLL
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 }
        $b = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Borland_Cpp_DLL: PEiD
{
    strings:
        $a = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 }
        $b = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Microsoft_Visual_Cpp_30_old_crap
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89 ?? ?? FF }
        $b = { 64 A1 00 00 00 00 55 ?? ?? 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? 00 00 83 EC 10 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Microsoft_Visual_Cpp_30_old_crap: PEiD
{
    strings:
        $a = { 64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 ?? ?? ?? ?? ?? ?? 83 ?? ?? 53 56 57 89 ?? ?? FF }
        $b = { 64 A1 00 00 00 00 55 ?? ?? 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 ?? ?? ?? ?? ?? 00 00 83 EC 10 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: _PseudoSigner_01_CD_Cops_II_Anorganix_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_CD_Cops_II_Anorganix_additional: PEiD
{
    strings:
        $a = { 53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ACProtect_V13X_V14X_RiSco_SignByfly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ACProtect_V13X_V14X_RiSco_SignByfly: PEiD
{
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 55 53 45 52 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 4D 65 73 73 61 67 65 42 6F 78 41 00 90 4D 69 6E 65 49 6D 70 6F 72 74 5F 45 6E 64 73 73 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: eXPressor_v15x_CGSoftLabs_h_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 81 EC 58 02 00 00 53 56 57 83 A5 CC FD FF FF 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C 01 75 23 }

Detection condition:
$a at pe.entry_point

Full rule:
rule eXPressor_v15x_CGSoftLabs_h_additional: PEiD
{
    strings:
        $a = { 55 8B EC 81 EC 58 02 00 00 53 56 57 83 A5 CC FD FF FF 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C 01 75 23 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MetaWare_High_C_p_Phar_Lap_DOS_Extender_1983_89_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? 8E D8 B8 ?? ?? CD 21 A3 ?? ?? 3C 03 7D ?? B4 09 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MetaWare_High_C_p_Phar_Lap_DOS_Extender_1983_89_additional: PEiD
{
    strings:
        $a = { B8 ?? ?? 8E D8 B8 ?? ?? CD 21 A3 ?? ?? 3C 03 7D ?? B4 09 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Go32Stub_v200T_DOS_Extender
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 0E 1F 8C 1E ?? ?? 8C 06 ?? ?? FC B4 30 CD 21 3C }

Detection condition:
$a at pe.entry_point

Full rule:
rule Go32Stub_v200T_DOS_Extender: PEiD
{
    strings:
        $a = { 0E 1F 8C 1E ?? ?? 8C 06 ?? ?? FC B4 30 CD 21 3C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASPack_v2000_Alexey_Solodovnikov
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 70 05 00 00 EB 4C }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASPack_v2000_Alexey_Solodovnikov: PEiD
{
    strings:
        $a = { 60 E8 70 05 00 00 EB 4C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_v261_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 28 ?? ?? ?? 68 E4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 0C }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_v261_additional: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 28 ?? ?? ?? 68 E4 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 6C ?? ?? ?? 33 D2 8A D4 89 15 0C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_DEF_10
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_DEF_10: PEiD
{
    strings:
        $a = { BE 00 01 40 00 6A 05 59 80 7E 07 00 74 11 8B 46 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 83 C1 01 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SoftDefender_V11X_Randy_Li
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 }

Detection condition:
$a at pe.entry_point

Full rule:
rule SoftDefender_V11X_Randy_Li: PEiD
{
    strings:
        $a = { 74 07 75 05 19 32 67 E8 E8 74 1F 75 1D E8 68 39 44 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CrypWrap_CrypKey_Canada_Inc
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 B8 ?? ?? ?? E8 90 02 ?? ?? 83 F8 ?? 75 07 6A ?? E8 ?? ?? ?? ?? FF 15 49 8F 40 ?? A9 ?? ?? ?? 80 74 0E }

Detection condition:
$a at pe.entry_point

Full rule:
rule CrypWrap_CrypKey_Canada_Inc: PEiD
{
    strings:
        $a = { E8 B8 ?? ?? ?? E8 90 02 ?? ?? 83 F8 ?? 75 07 6A ?? E8 ?? ?? ?? ?? FF 15 49 8F 40 ?? A9 ?? ?? ?? 80 74 0E }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Utah_RLE_Graphics_format_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 52 CC 00 00 00 00 ?? ?? ?? ?? 09 ?? 08 ?? 08 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Utah_RLE_Graphics_format_Hint_FILE_START: PEiD
{
    strings:
        $a = { 52 CC 00 00 00 00 ?? ?? ?? ?? 09 ?? 08 ?? 08 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Turbo_C_1987_or_Borland_Cpp_1991_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FB BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Turbo_C_1987_or_Borland_Cpp_1991_Hint_DOS_EP: PEiD
{
    strings:
        $a = { FB BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Morphine_27_Holy_Father_Ratter29A_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Morphine_27_Holy_Father_Ratter29A_additional: PEiD
{
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: nPack_V112752006Beta_NEOx_SignByfly_200800212
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 51 51 56 57 BE ?? ?? ?? ?? 8D 7D F8 66 A5 A4 BE ?? ?? ?? ?? 8D 7D FC 8D 45 FC 66 A5 50 8D 45 F8 50 A4 FF 15 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 5F 5E 75 05 E8 02 00 00 00 C9 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 1A 02 00 00 E8 CA 06 00 00 E8 19 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3 }
        $b = { 55 8B EC 51 51 56 57 BE ?? ?? ?? ?? 8D 7D F8 66 A5 A4 BE ?? ?? ?? ?? 8D 7D FC 8D 45 FC 66 A5 50 8D 45 F8 50 A4 FF 15 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 5F 5E 75 05 E8 02 00 00 00 C9 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule nPack_V112752006Beta_NEOx_SignByfly_200800212: PEiD
{
    strings:
        $a = { 55 8B EC 51 51 56 57 BE ?? ?? ?? ?? 8D 7D F8 66 A5 A4 BE ?? ?? ?? ?? 8D 7D FC 8D 45 FC 66 A5 50 8D 45 F8 50 A4 FF 15 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 5F 5E 75 05 E8 02 00 00 00 C9 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? E8 9C 00 00 00 E8 1A 02 00 00 E8 CA 06 00 00 E8 19 06 00 00 A1 ?? ?? ?? ?? C7 05 ?? ?? ?? ?? ?? ?? ?? ?? 01 05 ?? ?? ?? ?? FF 35 ?? ?? ?? ?? C3 C3 56 57 68 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B ?? ?? ?? ?? ?? 8B F8 68 ?? ?? ?? ?? 57 FF D6 68 ?? ?? ?? ?? 57 A3 ?? ?? ?? ?? FF D6 5F A3 ?? ?? ?? ?? 5E C3 }
        $b = { 55 8B EC 51 51 56 57 BE ?? ?? ?? ?? 8D 7D F8 66 A5 A4 BE ?? ?? ?? ?? 8D 7D FC 8D 45 FC 66 A5 50 8D 45 F8 50 A4 FF 15 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? ?? 5F 5E 75 05 E8 02 00 00 00 C9 C3 E8 46 00 00 00 E8 73 00 00 00 B8 ?? ?? ?? ?? 2B 05 ?? ?? ?? ?? A3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Phonebook_configuration_file_Version_v3v4
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 68 6F 6E 65 62 6F 6F 6B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 63 6F }
        $b = { 02 6F ?? ?? ?? 0A 0A 06 8D ?? ?? ?? 01 0B 16 0C 38 36 00 00 00 02 08 6F ?? ?? ?? 0A 0D 09 06 08 59 61 D2 13 04 09 1E 63 08 61 D2 13 05 07 08 11 05 1E 62 11 04 60 D1 9D 08 17 58 0C 08 07 8E 69 38 0B 00 00 00 28 ?? ?? ?? 0A 2A 38 EC FF FF FF 3F C0 FF FF FF }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Phonebook_configuration_file_Version_v3v4: PEiD
{
    strings:
        $a = { 50 68 6F 6E 65 62 6F 6F 6B ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 63 6F }
        $b = { 02 6F ?? ?? ?? 0A 0A 06 8D ?? ?? ?? 01 0B 16 0C 38 36 00 00 00 02 08 6F ?? ?? ?? 0A 0D 09 06 08 59 61 D2 13 04 09 1E 63 08 61 D2 13 05 07 08 11 05 1E 62 11 04 60 D1 9D 08 17 58 0C 08 07 8E 69 38 0B 00 00 00 28 ?? ?? ?? 0A 2A 38 EC FF FF FF 3F C0 FF FF FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: FSG_120_Eng_dulekxt_Microsoft_Visual_Cpp_60_70
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_120_Eng_dulekxt_Microsoft_Visual_Cpp_60_70: PEiD
{
    strings:
        $a = { EB 02 CD 20 EB 01 91 8D 35 80 ?? ?? 00 33 C2 68 83 93 7E 7D 0C A4 5B 23 C3 68 77 93 7E 7D EB 01 FA 5F E8 02 00 00 00 F7 FB 58 33 DF EB 01 3F E8 02 00 00 00 11 88 58 0F B6 16 EB 02 CD 20 EB 02 86 2F 2A D3 EB 02 CD 20 80 EA 2F EB 01 52 32 D3 80 E9 CD 80 EA }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_LCC_Win32_1x_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_LCC_Win32_1x_Anorganix: PEiD
{
    strings:
        $a = { 64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_v25_Retail_Bitsum_Technologies_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_v25_Retail_Bitsum_Technologies_additional: PEiD
{
    strings:
        $a = { B8 ?? ?? ?? 01 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 33 C0 89 08 50 45 43 6F 6D 70 61 63 74 32 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: aPack_090_m_p_COM
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8C C8 05 00 00 8E C0 59 8E D0 51 BE 00 01 BF 00 01 50 57 FC B2 80 BD 00 01 50 A4 FF D5 73 FB FF D5 73 14 FF D5 73 00 33 DB B1 04 FF D5 13 DB E2 FA 75 00 93 AA EB E4 E8 00 00 49 E2 07 5B 53 E8 00 00 EB 00 49 AC 8A E1 93 E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule aPack_090_m_p_COM: PEiD
{
    strings:
        $a = { 8C C8 05 00 00 8E C0 59 8E D0 51 BE 00 01 BF 00 01 50 57 FC B2 80 BD 00 01 50 A4 FF D5 73 FB FF D5 73 14 FF D5 73 00 33 DB B1 04 FF D5 13 DB E2 FA 75 00 93 AA EB E4 E8 00 00 49 E2 07 5B 53 E8 00 00 EB 00 49 AC 8A E1 93 E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Guardant_Stealth_aka_Novex_Dongle
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 53 51 52 57 56 8B 75 1C 8B 3E 8B 5D 08 8A FB 03 5D 10 8B 45 0C 8B 4D 14 8B 55 18 80 FF }
        $b = { 55 8B EC 83 C4 F0 60 E8 51 FF FF FF }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Guardant_Stealth_aka_Novex_Dongle: PEiD
{
    strings:
        $a = { 50 53 51 52 57 56 8B 75 1C 8B 3E 8B 5D 08 8A FB 03 5D 10 8B 45 0C 8B 4D 14 8B 55 18 80 FF }
        $b = { 55 8B EC 83 C4 F0 60 E8 51 FF FF FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Upack_v02Beta_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE 88 01 ?? ?? AD 8B F8 95 A5 33 C0 33 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_v02Beta_additional: PEiD
{
    strings:
        $a = { BE 88 01 ?? ?? AD 8B F8 95 A5 33 C0 33 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_KBDflags1024_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B EC 2E 89 2E 24 03 BC 00 04 8C D5 2E 89 2E 22 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_KBDflags1024_additional: PEiD
{
    strings:
        $a = { 8B EC 2E 89 2E 24 03 BC 00 04 8C D5 2E 89 2E 22 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Unknown_encryptor_3_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? 1E 06 8C D8 05 ?? ?? 8E D8 8E C0 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 8B E8 2E }

Detection condition:
$a at pe.entry_point

Full rule:
rule Unknown_encryptor_3_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? 1E 06 8C D8 05 ?? ?? 8E D8 8E C0 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? 8B E8 2E }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PKLITE32_11_PKWARE_Inc_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 00 00 00 00 E8 ?? ?? ?? ?? E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PKLITE32_11_PKWARE_Inc_additional: PEiD
{
    strings:
        $a = { 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 00 00 00 00 E8 ?? ?? ?? ?? E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPX_Modified_stub_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPX_Modified_stub_additional: PEiD
{
    strings:
        $a = { 50 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 83 CD }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PESpin_v07_Cyberbob
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
        $b = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 88 39 40 00 8B 42 3C 03 C2 89 85 92 39 40 00 EB 01 DB 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D A6 39 40 00 53 8F 85 4A 38 40 00 BB ?? 00 00 00 B9 EC 0A 00 00 8D BD 36 3A 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 56 44 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 0

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule PESpin_v07_Cyberbob: PEiD
{
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
        $b = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 83 D5 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF E8 01 00 00 00 EA 5A 83 EA 0B FF E2 EB 04 9A EB 04 00 EB FB FF 8B 95 88 39 40 00 8B 42 3C 03 C2 89 85 92 39 40 00 EB 01 DB 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 9A EB FB 00 83 04 24 0C C3 3B 8B 59 10 03 DA 8B 1B 89 9D A6 39 40 00 53 8F 85 4A 38 40 00 BB ?? 00 00 00 B9 EC 0A 00 00 8D BD 36 3A 40 00 4F EB 01 AB 30 1C 39 FE CB E2 F9 EB 01 C8 68 CB 00 00 00 59 8D BD 56 44 40 00 E8 03 00 00 00 EB 04 FA EB FB 68 83 04 24 0C C3 8D C0 0C 39 02 E2 FA E8 02 00 00 00 FF 15 5A 8D 85 B3 5F 56 00 BB 54 13 0B 00 D1 E3 2B C3 FF E0 E8 01 00 00 00 68 E8 1A 00 00 00 8D 34 28 B9 08 00 00 00 B8 ?? ?? ?? ?? 2B C9 83 C9 15 0F A3 C8 0F 83 81 00 00 00 8D B4 0D 99 39 40 00 8B D6 B9 10 00 00 00 AC 84 C0 74 06 C0 4E FF 03 E2 F5 E8 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Upack_v032_Beta_Patch
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE 88 01 ?? ?? AD 50 ?? AD 91 F3 A5 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_v032_Beta_Patch: PEiD
{
    strings:
        $a = { BE 88 01 ?? ?? AD 50 ?? AD 91 F3 A5 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Escargot_01_final_ppMeat
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 04 40 30 2E 31 60 68 61 ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 92 ?? ?? ?? 8B 00 FF D0 50 B8 CD ?? ?? ?? 81 38 DE C0 37 13 75 2D 68 C9 ?? ?? ?? 6A 40 68 00 ?? 00 00 68 00 00 ?? ?? B8 96 ?? ?? ?? 8B 00 FF D0 8B 44 24 F0 8B 4C 24 F4 EB 05 49 C6 04 01 40 0B C9 75 F7 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B 46 0C BB 00 00 ?? ?? 03 C3 50 50 }
        $b = { EB 04 40 30 2E 31 60 68 61 ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 92 ?? ?? ?? 8B 00 FF D0 50 B8 CD ?? ?? ?? 81 38 DE C0 37 13 75 2D 68 C9 ?? ?? ?? 6A 40 68 00 ?? 00 00 68 00 00 ?? ?? B8 96 ?? ?? ?? 8B 00 FF D0 8B 44 24 F0 8B 4C 24 F4 EB 05 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Escargot_01_final_ppMeat: PEiD
{
    strings:
        $a = { EB 04 40 30 2E 31 60 68 61 ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 92 ?? ?? ?? 8B 00 FF D0 50 B8 CD ?? ?? ?? 81 38 DE C0 37 13 75 2D 68 C9 ?? ?? ?? 6A 40 68 00 ?? 00 00 68 00 00 ?? ?? B8 96 ?? ?? ?? 8B 00 FF D0 8B 44 24 F0 8B 4C 24 F4 EB 05 49 C6 04 01 40 0B C9 75 F7 BE 00 10 ?? ?? B9 00 ?? ?? 00 EB 05 49 80 34 31 40 0B C9 75 F7 58 0B C0 74 08 33 C0 C7 00 DE C0 AD 0B BE ?? ?? ?? ?? E9 AC 00 00 00 8B 46 0C BB 00 00 ?? ?? 03 C3 50 50 }
        $b = { EB 04 40 30 2E 31 60 68 61 ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 B8 92 ?? ?? ?? 8B 00 FF D0 50 B8 CD ?? ?? ?? 81 38 DE C0 37 13 75 2D 68 C9 ?? ?? ?? 6A 40 68 00 ?? 00 00 68 00 00 ?? ?? B8 96 ?? ?? ?? 8B 00 FF D0 8B 44 24 F0 8B 4C 24 F4 EB 05 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}