deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Winkript_v10_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Winkript_v10_additional: PEiD
{
    strings:
        $a = { 33 C0 8B B8 00 ?? ?? ?? 8B 90 04 ?? ?? ?? 85 FF 74 1B 33 C9 50 EB 0C 8A 04 39 C0 C8 04 34 1B 88 04 39 41 3B CA 72 F0 58 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Crunch_v5_Bit_Arts
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00 }
        $b = { EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00 00 8B 56 3C 8D 8C 32 C8 00 00 00 83 39 00 74 50 8B D9 53 68 BB D4 C3 79 33 C0 50 E8 0E 04 00 00 50 8D 95 EC 07 00 00 52 6A 04 68 00 10 00 00 FF B5 E8 07 00 00 FF D0 58 5B C7 03 00 00 00 00 C7 43 04 00 00 00 00 8D 95 F0 07 00 00 52 FF B5 EC 07 00 00 68 00 10 00 00 FF B5 E8 07 00 00 FF D0 68 6C D9 B2 96 33 C0 50 E8 C1 03 00 00 89 85 ?? 46 00 00 68 EC 49 7B 79 33 C0 50 E8 AE 03 00 00 89 85 ?? 46 00 00 E8 04 06 00 00 E9 F3 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 D

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Crunch_v5_Bit_Arts: PEiD
{
    strings:
        $a = { EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00 }
        $b = { EB 15 03 00 00 00 06 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 FC 07 00 00 89 85 E8 07 00 00 FF 74 24 2C E8 20 02 00 00 0F 82 94 06 00 00 E8 F3 04 00 00 49 0F 88 88 06 00 00 8B B5 E8 07 00 00 8B 56 3C 8D 8C 32 C8 00 00 00 83 39 00 74 50 8B D9 53 68 BB D4 C3 79 33 C0 50 E8 0E 04 00 00 50 8D 95 EC 07 00 00 52 6A 04 68 00 10 00 00 FF B5 E8 07 00 00 FF D0 58 5B C7 03 00 00 00 00 C7 43 04 00 00 00 00 8D 95 F0 07 00 00 52 FF B5 EC 07 00 00 68 00 10 00 00 FF B5 E8 07 00 00 FF D0 68 6C D9 B2 96 33 C0 50 E8 C1 03 00 00 89 85 ?? 46 00 00 68 EC 49 7B 79 33 C0 50 E8 AE 03 00 00 89 85 ?? 46 00 00 E8 04 06 00 00 E9 F3 05 00 00 51 52 53 33 C9 49 8B D1 33 C0 33 DB AC 32 C1 8A CD 8A EA 8A D6 B6 08 66 D1 EB 66 D1 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: _PseudoSigner_01_REALBasic_Anorganix_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_REALBasic_Anorganix_additional: PEiD
{
    strings:
        $a = { 55 89 E5 90 90 90 90 90 90 90 90 90 90 50 90 90 90 90 90 00 01 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PolyBox_D_Anskya
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 33 C9 51 51 51 51 51 53 33 C0 55 68 84 2C 40 00 64 FF 30 64 89 20 C6 45 FF 00 B8 B8 46 40 00 BA 24 00 00 00 E8 8C F3 FF FF 6A 24 BA B8 46 40 00 8B 0D B0 46 40 00 A1 94 46 40 00 E8 71 FB FF FF 84 C0 0F 84 6E 01 00 00 8B 1D D0 46 40 00 8B C3 83 C0 24 03 05 D8 46 40 00 3B 05 B4 46 40 00 0F 85 51 01 00 00 8D 45 F4 BA B8 46 40 00 B9 10 00 00 00 E8 A2 EC FF FF 8B 45 F4 BA 9C 2C 40 00 E8 F1 ED FF FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule PolyBox_D_Anskya: PEiD
{
    strings:
        $a = { 55 8B EC 33 C9 51 51 51 51 51 53 33 C0 55 68 84 2C 40 00 64 FF 30 64 89 20 C6 45 FF 00 B8 B8 46 40 00 BA 24 00 00 00 E8 8C F3 FF FF 6A 24 BA B8 46 40 00 8B 0D B0 46 40 00 A1 94 46 40 00 E8 71 FB FF FF 84 C0 0F 84 6E 01 00 00 8B 1D D0 46 40 00 8B C3 83 C0 24 03 05 D8 46 40 00 3B 05 B4 46 40 00 0F 85 51 01 00 00 8D 45 F4 BA B8 46 40 00 B9 10 00 00 00 E8 A2 EC FF FF 8B 45 F4 BA 9C 2C 40 00 E8 F1 ED FF FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Nakedbind_10_nakedcrew
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B 4D 5A 74 08 81 EB 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Nakedbind_10_nakedcrew: PEiD
{
    strings:
        $a = { 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B 4D 5A 74 08 81 EB 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXE_Shield_V05_Smoke
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 }
        $b = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule EXE_Shield_V05_Smoke: PEiD
{
    strings:
        $a = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 }
        $b = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED BC 1A 40 00 EB 01 00 8D B5 46 1B 40 00 BA B3 0A 00 00 EB 01 00 8D 8D F9 25 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 50 C3 8A 06 46 EB 01 00 D0 C8 E8 14 00 00 00 83 EB 01 00 2A C2 E8 00 00 00 00 5B 83 C3 07 53 C3 00 EB 04 5B 43 53 C3 EB 01 00 32 C2 E8 0B 00 00 00 00 32 C1 EB 01 00 C0 C0 02 EB 09 2A C2 5B EB 01 00 43 53 C3 88 07 EB 01 00 47 4A 75 B4 90 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: PECompact_110_beta_8
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 00 87 DD 8B 85 9A 70 40 00 01 85 03 70 40 00 66 C7 85 00 70 40 00 90 90 01 85 92 70 40 00 BB 14 08 00 00 03 9D 9E 70 40 00 03 9D 9A 70 40 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_110_beta_8: PEiD
{
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 00 87 DD 8B 85 9A 70 40 00 01 85 03 70 40 00 66 C7 85 00 70 40 00 90 90 01 85 92 70 40 00 BB 14 08 00 00 03 9D 9E 70 40 00 03 9D 9A 70 40 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_110_beta_5
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 00 87 DD 8B 85 95 60 40 00 01 85 03 60 40 00 66 C7 85 00 60 40 00 90 90 BB 49 09 00 00 03 9D 99 60 40 00 03 9D 95 60 40 00 53 53 53 58 2D 6A }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_110_beta_5: PEiD
{
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 00 87 DD 8B 85 95 60 40 00 01 85 03 60 40 00 66 C7 85 00 60 40 00 90 90 BB 49 09 00 00 03 9D 99 60 40 00 03 9D 95 60 40 00 53 53 53 58 2D 6A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_110_beta_4
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 00 87 DD 8B 85 95 60 40 00 01 85 03 60 40 00 66 C7 85 00 60 40 00 90 90 BB 44 09 00 00 03 9D 99 60 40 00 03 9D 95 60 40 00 53 53 53 58 2D 6A }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_110_beta_4: PEiD
{
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 00 87 DD 8B 85 95 60 40 00 01 85 03 60 40 00 66 C7 85 00 60 40 00 90 90 BB 44 09 00 00 03 9D 99 60 40 00 03 9D 95 60 40 00 53 53 53 58 2D 6A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_110_beta_7
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 00 87 DD 8B 85 9A 60 40 00 01 85 03 60 40 00 66 C7 85 00 60 40 00 90 90 01 85 92 60 40 00 BB 14 08 00 00 03 9D 9E 60 40 00 03 9D 9A 60 40 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_110_beta_7: PEiD
{
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 00 87 DD 8B 85 9A 60 40 00 01 85 03 60 40 00 66 C7 85 00 60 40 00 90 90 01 85 92 60 40 00 BB 14 08 00 00 03 9D 9E 60 40 00 03 9D 9A 60 40 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_110_beta_6
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 00 87 DD 8B 85 9A 60 40 00 01 85 03 60 40 00 66 C7 85 00 60 40 00 90 90 01 85 92 60 40 00 BB B7 07 00 00 03 9D 9E 60 40 00 03 9D 9A 60 40 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_110_beta_6: PEiD
{
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 00 87 DD 8B 85 9A 60 40 00 01 85 03 60 40 00 66 C7 85 00 60 40 00 90 90 01 85 92 60 40 00 BB B7 07 00 00 03 9D 9E 60 40 00 03 9D 9A 60 40 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_110_beta_1
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 28 63 40 00 87 DD 8B 85 AD 63 40 00 01 85 1C 63 40 00 66 C7 85 19 63 40 00 90 90 BB D6 0A 00 00 03 9D B1 63 40 00 03 9D AD 63 40 00 53 53 53 58 2D 83 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_110_beta_1: PEiD
{
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 28 63 40 00 87 DD 8B 85 AD 63 40 00 01 85 1C 63 40 00 66 C7 85 19 63 40 00 90 90 BB D6 0A 00 00 03 9D B1 63 40 00 03 9D AD 63 40 00 53 53 53 58 2D 83 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_110_beta_3
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 00 87 DD 8B 85 95 60 40 00 01 85 03 60 40 00 66 C7 85 00 60 40 00 90 90 BB 95 0A 00 00 03 9D 99 60 40 00 03 9D 95 60 40 00 53 53 53 58 2D 6A }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_110_beta_3: PEiD
{
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 00 87 DD 8B 85 95 60 40 00 01 85 03 60 40 00 66 C7 85 00 60 40 00 90 90 BB 95 0A 00 00 03 9D 99 60 40 00 03 9D 95 60 40 00 53 53 53 58 2D 6A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_110_beta_2
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 00 87 DD 8B 85 94 60 40 00 01 85 03 60 40 00 66 C7 85 00 60 40 00 90 90 BB 7F 0A 00 00 03 9D 98 60 40 00 03 9D 94 60 40 00 53 53 53 58 2D 6A }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_110_beta_2: PEiD
{
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 60 40 00 87 DD 8B 85 94 60 40 00 01 85 03 60 40 00 66 C7 85 00 60 40 00 90 90 BB 7F 0A 00 00 03 9D 98 60 40 00 03 9D 94 60 40 00 53 53 53 58 2D 6A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: eXPressor_1451_CGSoftLabs
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14 }
        $b = { 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D 10 ?? ?? 00 00 74 16 A1 08 ?? ?? 00 8B 0D 0C ?? ?? 00 03 48 14 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule eXPressor_1451_CGSoftLabs: PEiD
{
    strings:
        $a = { 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? ?? 05 00 ?? ?? ?? A3 08 ?? ?? ?? A1 08 ?? ?? ?? B9 81 ?? ?? ?? 2B 48 18 89 0D 0C ?? ?? ?? 83 3D 10 ?? ?? ?? 00 74 16 A1 08 ?? ?? ?? 8B 0D 0C ?? ?? ?? 03 48 14 }
        $b = { 55 8B EC 83 EC 58 53 56 57 83 65 DC 00 F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 34 2E 00 A1 00 ?? ?? 00 05 00 ?? ?? 00 A3 08 ?? ?? 00 A1 08 ?? ?? 00 B9 81 ?? ?? 00 2B 48 18 89 0D 0C ?? ?? 00 83 3D 10 ?? ?? 00 00 74 16 A1 08 ?? ?? 00 8B 0D 0C ?? ?? 00 03 48 14 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Software_Compress_BG_Software
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Software_Compress_BG_Software: PEiD
{
    strings:
        $a = { E9 BE 00 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Gardian_Angel_10_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 06 8C C8 8E D8 8E C0 FC BF ?? ?? EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule Gardian_Angel_10_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 06 8C C8 8E D8 8E C0 FC BF ?? ?? EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Private_exe_Protector_V18X_V19X_SetiSoft_Team_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Private_exe_Protector_V18X_V19X_SetiSoft_Team_additional: PEiD
{
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: NsPack_23_Liu_Xing_Ping
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD }

Detection condition:
$a at pe.entry_point

Full rule:
rule NsPack_23_Liu_Xing_Ping: PEiD
{
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_02_ASProtect_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_02_ASProtect_Anorganix: PEiD
{
    strings:
        $a = { 60 90 90 90 90 90 90 5D 90 90 90 90 90 90 90 90 90 90 90 03 DD }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Special_EXE_Pasword_Protector_v101_Eng_Pavol_Cerven
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 00 00 8D 95 C6 77 00 00 8D 8D FF 77 00 00 55 68 00 20 00 00 51 52 6A 00 FF 95 04 7A 00 00 5D 6A 00 FF 95 FC 79 00 00 8D 8D 60 78 00 00 8D 95 85 01 00 00 55 68 00 }
        $b = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Special_EXE_Pasword_Protector_v101_Eng_Pavol_Cerven: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 00 00 8D 95 C6 77 00 00 8D 8D FF 77 00 00 55 68 00 20 00 00 51 52 6A 00 FF 95 04 7A 00 00 5D 6A 00 FF 95 FC 79 00 00 8D 8D 60 78 00 00 8D 95 85 01 00 00 55 68 00 }
        $b = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Microsoft_C_Library_1985_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BF ?? ?? 8B 36 ?? ?? 2B F7 81 FE ?? ?? 72 ?? BE ?? ?? FA 8E D7 81 C4 ?? ?? FB 73 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_C_Library_1985_additional: PEiD
{
    strings:
        $a = { BF ?? ?? 8B 36 ?? ?? 2B F7 81 FE ?? ?? 72 ?? BE ?? ?? FA 8E D7 81 C4 ?? ?? FB 73 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXECryptor_239_DLL_compressed_resources_wwwstrongbitcom
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 68 ?? ?? ?? ?? 58 C1 C0 0F E9 ?? ?? ?? 00 87 04 24 58 89 45 FC E9 ?? ?? ?? FF FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 18 E9 ?? ?? ?? ?? 8B 55 08 09 42 F8 E9 ?? ?? ?? FF 83 7D F0 01 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 34 24 5E 8B 45 FC 33 D2 56 8B F2 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXECryptor_239_DLL_compressed_resources_wwwstrongbitcom: PEiD
{
    strings:
        $a = { 50 68 ?? ?? ?? ?? 58 C1 C0 0F E9 ?? ?? ?? 00 87 04 24 58 89 45 FC E9 ?? ?? ?? FF FF 05 ?? ?? ?? ?? E9 ?? ?? ?? 00 C1 C3 18 E9 ?? ?? ?? ?? 8B 55 08 09 42 F8 E9 ?? ?? ?? FF 83 7D F0 01 0F 85 ?? ?? ?? ?? E9 ?? ?? ?? 00 87 34 24 5E 8B 45 FC 33 D2 56 8B F2 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PLINK86_1984_1985_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FA 8C C7 8C D6 8B CC BA ?? ?? 8E C2 26 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PLINK86_1984_1985_additional: PEiD
{
    strings:
        $a = { FA 8C C7 8C D6 8B CC BA ?? ?? 8E C2 26 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: TXT2COM
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? CD 20 }

Detection condition:
$a at pe.entry_point

Full rule:
rule TXT2COM: PEiD
{
    strings:
        $a = { E8 ?? ?? CD 20 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RCryptor_v11_Vaska_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B 04 24 83 E8 4F 68 ?? ?? ?? ?? FF D0 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RCryptor_v11_Vaska_additional: PEiD
{
    strings:
        $a = { 8B 04 24 83 E8 4F 68 ?? ?? ?? ?? FF D0 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_110_Eng_dulekxt_MASM32_TASM32_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_110_Eng_dulekxt_MASM32_TASM32_additional: PEiD
{
    strings:
        $a = { 1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 00 00 EB 02 CD 20 5E 0F B6 D0 80 CA 5C 8B 38 EB 01 35 EB 02 DC 97 81 EF F7 65 17 43 E8 02 00 00 00 97 CB 5B 81 C7 B2 8B A1 0C 8B D1 83 EF 17 EB 02 0C 65 83 EF 43 13 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPX_071_072_EXE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8C CB B9 00 00 BE 00 00 89 F7 1E A9 B5 80 8D 87 05 00 8E D8 05 00 00 8E C0 FD F3 A5 FC 2E 80 6C 13 10 73 E8 00 00 00 00 00 0E 0E 00 00 00 00 00 00 00 00 00 00 00 CB 55 50 58 21 09 00 02 07 }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPX_071_072_EXE: PEiD
{
    strings:
        $a = { 8C CB B9 00 00 BE 00 00 89 F7 1E A9 B5 80 8D 87 05 00 8E D8 05 00 00 8E C0 FD F3 A5 FC 2E 80 6C 13 10 73 E8 00 00 00 00 00 0E 0E 00 00 00 00 00 00 00 00 00 00 00 CB 55 50 58 21 09 00 02 07 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Eddie1530
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? 50 06 56 1E 33 C0 50 1F C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Eddie1530: PEiD
{
    strings:
        $a = { E8 ?? ?? 5E 81 EE ?? ?? FC 2E ?? ?? ?? ?? 4D 5A ?? ?? FA 8B E6 81 C4 ?? ?? FB 3B ?? ?? ?? ?? ?? 2E ?? ?? ?? ?? 50 06 56 1E 33 C0 50 1F C4 ?? ?? ?? 2E ?? ?? ?? ?? 2E }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_Visual_C_Basic_NET_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 01 DB 07 8B 1E 83 EE FC 11 DB ED B8 01 00 00 00 01 DB 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_Visual_C_Basic_NET_additional: PEiD
{
    strings:
        $a = { 01 DB 07 8B 1E 83 EE FC 11 DB ED B8 01 00 00 00 01 DB 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Shegerd_Dongle_V478_MSCo
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 32 00 00 00 B8 ?? ?? ?? ?? 8B 18 C1 CB 05 89 DA 36 8B 4C 24 0C }

Detection condition:
$a at pe.entry_point

Full rule:
rule Shegerd_Dongle_V478_MSCo: PEiD
{
    strings:
        $a = { E8 32 00 00 00 B8 ?? ?? ?? ?? 8B 18 C1 CB 05 89 DA 36 8B 4C 24 0C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Obsidium_V12X_Obsidium_Software
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 0E 00 00 00 33 C0 8B 54 24 0C 83 82 B8 00 00 00 0D C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsidium_V12X_Obsidium_Software: PEiD
{
    strings:
        $a = { E8 0E 00 00 00 33 C0 8B 54 24 0C 83 82 B8 00 00 00 0D C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00 }
    condition:
        $a at pe.entry_point

}