deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: mkfpack_llydd_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 00 00 00 00 5B 81 EB 05 00 00 00 8B 93 9F 08 00 00 53 6A 40 68 00 10 00 00 52 6A 00 FF 93 32 08 00 00 5B 8B F0 8B BB 9B 08 00 00 03 FB 56 57 E8 86 08 00 00 83 C4 08 8D 93 BB 08 00 00 52 53 FF E6 }

Detection condition:
$a at pe.entry_point

Full rule:
rule mkfpack_llydd_additional: PEiD
{
    strings:
        $a = { E8 00 00 00 00 5B 81 EB 05 00 00 00 8B 93 9F 08 00 00 53 6A 40 68 00 10 00 00 52 6A 00 FF 93 32 08 00 00 5B 8B F0 8B BB 9B 08 00 00 03 FB 56 57 E8 86 08 00 00 83 C4 08 8D 93 BB 08 00 00 52 53 FF E6 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Watcom_CCpp_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? 00 00 03 10 40 00 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54 69 6D 65 20 73 79 73 74 65 6D 2E 20 28 63 29 20 43 6F 70 79 72 69 67 68 74 20 62 79 20 57 41 54 43 4F 4D 20 49 6E 74 65 72 6E 61 74 69 6F 6E 61 6C 20 43 6F 72 70 2E 20 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Watcom_CCpp_additional: PEiD
{
    strings:
        $a = { E9 ?? ?? 00 00 03 10 40 00 57 41 54 43 4F 4D 20 43 2F 43 2B 2B 33 32 20 52 75 6E 2D 54 69 6D 65 20 73 79 73 74 65 6D 2E 20 28 63 29 20 43 6F 70 79 72 69 67 68 74 20 62 79 20 57 41 54 43 4F 4D 20 49 6E 74 65 72 6E 61 74 69 6F 6E 61 6C 20 43 6F 72 70 2E 20 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Ice_100
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE 26 01 8B FE 8B 0E 08 01 8B 16 02 01 B8 77 01 50 FC AD 33 C2 AB 8B D0 E2 F8 00 00 00 00 00 8D 0F 47 8C 77 F4 37 C6 FE 41 FC 0F 4D 0C BD 59 78 53 CD 7C 48 8D 0F 47 8C 7F F4 3F 85 AD 7F 55 83 85 08 FF F1 81 86 01 94 15 7B 2A 45 48 D1 DE EF }

Detection condition:
$a at pe.entry_point

Full rule:
rule Ice_100: PEiD
{
    strings:
        $a = { BE 26 01 8B FE 8B 0E 08 01 8B 16 02 01 B8 77 01 50 FC AD 33 C2 AB 8B D0 E2 F8 00 00 00 00 00 8D 0F 47 8C 77 F4 37 C6 FE 41 FC 0F 4D 0C BD 59 78 53 CD 7C 48 8D 0F 47 8C 7F F4 3F 85 AD 7F 55 83 85 08 FF F1 81 86 01 94 15 7B 2A 45 48 D1 DE EF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CrypKey_v5_v6_CrypKey_Canada_Inc
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? ?? ?? 58 83 E8 05 50 5F 57 8B F7 81 EF ?? ?? ?? ?? 83 C6 39 BA ?? ?? ?? ?? 8B DF B9 0B ?? ?? ?? 8B 06 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CrypKey_v5_v6_CrypKey_Canada_Inc: PEiD
{
    strings:
        $a = { E8 ?? ?? ?? ?? 58 83 E8 05 50 5F 57 8B F7 81 EF ?? ?? ?? ?? 83 C6 39 BA ?? ?? ?? ?? 8B DF B9 0B ?? ?? ?? 8B 06 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MSLRH_v032a_fake_PC_Guard_4xx_emadicius
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 58 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule MSLRH_v032a_fake_PC_Guard_4xx_emadicius: PEiD
{
    strings:
        $a = { FC 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 58 5D EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_v032_Beta_Patch_Sign_by_hot_UNP_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE 88 01 ?? ?? AD 50 ?? AD 91 F3 A5 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_v032_Beta_Patch_Sign_by_hot_UNP_additional: PEiD
{
    strings:
        $a = { BE 88 01 ?? ?? AD 50 ?? AD 91 F3 A5 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SecurePE_1X_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B 04 24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00 53 C3 00 00 00 00 8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33 C3 AB 43 81 FB 8E 2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55 34 40 00 89 AD 68 34 40 00 8D 85 BA 2F 40 00 50 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule SecurePE_1X_additional: PEiD
{
    strings:
        $a = { 8B 04 24 E8 00 00 00 00 5D 81 ED 4C 2F 40 00 89 85 61 2F 40 00 8D 9D 65 2F 40 00 53 C3 00 00 00 00 8D B5 BA 2F 40 00 8B FE BB 65 2F 40 00 B9 C6 01 00 00 AD 2B C3 C1 C0 03 33 C3 AB 43 81 FB 8E 2F 40 00 75 05 BB 65 2F 40 00 E2 E7 89 AD 1A 31 40 00 89 AD 55 34 40 00 89 AD 68 34 40 00 8D 85 BA 2F 40 00 50 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Trap_119_EXE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8C D0 BB 99 CB 8E D3 33 D2 8E D0 B9 7D 04 EB 04 90 EA CD 20 E2 F8 33 D2 E5 21 50 B9 00 05 EB 03 90 CD 20 81 F9 E2 03 74 0F 90 90 83 C1 FE 83 C2 01 EB EB FA EB FE EA F0 FA B8 FE 00 E7 21 58 E7 21 66 8C E3 66 B8 00 00 01 00 8E E0 66 8C E0 8E }

Detection condition:
$a at pe.entry_point

Full rule:
rule Trap_119_EXE: PEiD
{
    strings:
        $a = { 8C D0 BB 99 CB 8E D3 33 D2 8E D0 B9 7D 04 EB 04 90 EA CD 20 E2 F8 33 D2 E5 21 50 B9 00 05 EB 03 90 CD 20 81 F9 E2 03 74 0F 90 90 83 C1 FE 83 C2 01 EB EB FA EB FE EA F0 FA B8 FE 00 E7 21 58 E7 21 66 8C E3 66 B8 00 00 01 00 8E E0 66 8C E0 8E }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Image_Systems_Technology_Graphics_format
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 03 3A ?? ?? 00 ?? 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Image_Systems_Technology_Graphics_format: PEiD
{
    strings:
        $a = { 03 3A ?? ?? 00 ?? 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CrunchPE_v50_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 15 03 ?? ?? ?? 06 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CrunchPE_v50_additional: PEiD
{
    strings:
        $a = { EB 15 03 ?? ?? ?? 06 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_v110_Eng_dulekxt_Microsoft_Visual_Cpp_60_70_ASM_
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 01 00 00 00 5A 5E E8 02 00 00 00 BA DD 5E 03 F2 EB 01 64 BB 80 ?? ?? 00 8B FA EB 01 A8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Cpp_60_70_ASM_: PEiD
{
    strings:
        $a = { E8 01 00 00 00 5A 5E E8 02 00 00 00 BA DD 5E 03 F2 EB 01 64 BB 80 ?? ?? 00 8B FA EB 01 A8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Turbo_Pascal_Help_File_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 54 55 52 ?? ?? ?? 50 41 53 ?? ?? ?? ?? 48 45 4C 50 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Turbo_Pascal_Help_File_additional: PEiD
{
    strings:
        $a = { 54 55 52 ?? ?? ?? 50 41 53 ?? ?? ?? ?? 48 45 4C 50 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: unknown_by_Woody
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 B9 0F 8E D8 8C 1E 04 00 8C 1E 08 00 8C C8 A3 00 00 E9 54 36 }

Detection condition:
$a at pe.entry_point

Full rule:
rule unknown_by_Woody: PEiD
{
    strings:
        $a = { B8 B9 0F 8E D8 8C 1E 04 00 8C 1E 08 00 8C C8 A3 00 00 E9 54 36 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ThemidaWinLicense_V2010_p_Hide_from_PE_scanners_Type2
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ThemidaWinLicense_V2010_p_Hide_from_PE_scanners_Type2: PEiD
{
    strings:
        $a = { 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CorelDraw_CMX_Graphics_format_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 52 49 46 46 ?? ?? ?? ?? 43 4D 58 31 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CorelDraw_CMX_Graphics_format_additional: PEiD
{
    strings:
        $a = { 52 49 46 46 ?? ?? ?? ?? 43 4D 58 31 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Rec_Small_103
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8C D8 1E E8 00 00 83 C0 0F 5D B9 00 00 81 ED EA 03 40 8E D8 2B DB B2 00 00 17 FE C2 43 83 FB 10 75 F6 E2 ED 1F 8C C0 03 C3 2E 01 86 27 04 2E 03 86 2B 04 FA BC 05 00 8E D0 2E 8B A6 29 04 EB 00 EA 01 00 00 00 7E 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Rec_Small_103: PEiD
{
    strings:
        $a = { 8C D8 1E E8 00 00 83 C0 0F 5D B9 00 00 81 ED EA 03 40 8E D8 2B DB B2 00 00 17 FE C2 43 83 FB 10 75 F6 E2 ED 1F 8C C0 03 C3 2E 01 86 27 04 2E 03 86 2B 04 FA BC 05 00 8E D0 2E 8B A6 29 04 EB 00 EA 01 00 00 00 7E 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Rec_Small_102
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8C D8 1E E8 00 00 83 C0 0F 5D B9 00 00 81 ED BA 03 40 8E D8 2B DB B2 00 00 17 FE C2 43 83 FB 10 75 F6 E2 ED 1F 8C C0 03 C3 2E 01 86 F5 03 2E 03 86 F9 03 FA 2E 8B A6 F7 03 8E D0 FB EB 00 EA }

Detection condition:
$a at pe.entry_point

Full rule:
rule Rec_Small_102: PEiD
{
    strings:
        $a = { 8C D8 1E E8 00 00 83 C0 0F 5D B9 00 00 81 ED BA 03 40 8E D8 2B DB B2 00 00 17 FE C2 43 83 FB 10 75 F6 E2 ED 1F 8C C0 03 C3 2E 01 86 F5 03 2E 03 86 F9 03 FA 2E 8B A6 F7 03 8E D0 FB EB 00 EA }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Rec_Small_101
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8C D8 1E E8 00 00 5D 83 C0 0F 81 ED BA 03 B9 00 00 40 8E D8 2B DB B2 00 00 17 FE C2 43 83 FB 10 75 F6 E2 ED 1F 8C C0 03 C3 2E 01 86 F5 03 2E 03 86 F9 03 FA 2E 8B A6 F7 03 8E D0 FB EB 00 EA 00 00 00 00 7E 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Rec_Small_101: PEiD
{
    strings:
        $a = { 8C D8 1E E8 00 00 5D 83 C0 0F 81 ED BA 03 B9 00 00 40 8E D8 2B DB B2 00 00 17 FE C2 43 83 FB 10 75 F6 E2 ED 1F 8C C0 03 C3 2E 01 86 F5 03 2E 03 86 F9 03 FA 2E 8B A6 F7 03 8E D0 FB EB 00 EA 00 00 00 00 7E 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPolyX_v05_
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC ?? 00 BD 46 00 8B ?? B9 ?? 00 00 00 80 ?? ?? 51 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPolyX_v05_: PEiD
{
    strings:
        $a = { 55 8B EC ?? 00 BD 46 00 8B ?? B9 ?? 00 00 00 80 ?? ?? 51 ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Thinstall_Embedded_V2717_V2719_Jitit_Sign_by_fly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 C1 FE FF FF E9 97 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 

Detection condition:
$a at pe.entry_point

Full rule:
rule Thinstall_Embedded_V2717_V2719_Jitit_Sign_by_fly: PEiD
{
    strings:
        $a = { 9C 60 E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 C1 FE FF FF E9 97 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 E8 04 01 00 00 0F 82 96 00 00 00 E8 F9 00 00 00 73 5B B9 04 00 00 00 E8 05 01 00 00 48 74 DE 0F 89 C6 00 00 00 E8 DF 00 00 00 73 1B 55 BD 00 01 00 00 E8 DF 00 00 00 88 07 47 4D 75 F5 E8 C7 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 D0 00 00 00 83 C0 07 89 45 F8 C6 45 F7 00 83 F8 08 74 89 E8 B1 00 00 00 88 45 F7 E9 7C FF FF FF B9 07 00 00 00 E8 AA 00 00 00 50 33 C9 B1 02 E8 A0 00 00 00 8B C8 41 41 58 0B C0 74 04 8B D8 EB 5E 83 F9 02 74 6A 41 E8 88 00 00 00 89 45 FC E9 48 FF FF FF E8 87 00 00 00 49 E2 09 8B C3 E8 7D 00 00 00 EB 3A 49 8B C1 55 8B 4D FC 8B E8 33 C0 D3 E5 E8 5D 00 00 00 0B C5 5D 8B D8 E8 5F 00 00 00 3D 00 00 01 00 73 14 3D FF 37 00 00 73 0E 3D 7F 02 00 00 73 08 83 F8 7F 77 04 41 41 41 41 56 8B F7 2B F0 F3 A4 5E E9 F0 FE FF FF 33 C0 EB 05 8B C7 2B 45 0C 5E 5F 5B C9 C2 08 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: VProtector_13X_vcasm_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 60 8B B4 24 24 00 00 00 8B BC 24 28 00 00 00 FC C6 C2 80 33 DB A4 C6 C3 02 E8 A9 00 00 00 0F 83 F1 FF FF FF 33 C9 E8 9C 00 00 00 0F 83 2D 00 00 00 33 C0 E8 8F 00 00 00 0F 83 37 00 00 00 C6 C3 02 41 C6 C0 10 E8 7D 00 00 00 10 C0 0F 83 F3 FF FF FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule VProtector_13X_vcasm_additional: PEiD
{
    strings:
        $a = { 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 60 8B B4 24 24 00 00 00 8B BC 24 28 00 00 00 FC C6 C2 80 33 DB A4 C6 C3 02 E8 A9 00 00 00 0F 83 F1 FF FF FF 33 C9 E8 9C 00 00 00 0F 83 2D 00 00 00 33 C0 E8 8F 00 00 00 0F 83 37 00 00 00 C6 C3 02 41 C6 C0 10 E8 7D 00 00 00 10 C0 0F 83 F3 FF FF FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: NsPack_31_North_Star_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule NsPack_31_North_Star_h: PEiD
{
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 60 6A 40 68 00 10 00 00 68 00 10 00 00 6A 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_v110_Eng_bartxt_WinRAR_SFX
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 80 E9 A1 C1 C1 13 68 E4 16 75 46 C1 C1 05 5E EB 01 9D 68 64 86 37 46 EB 02 8C E0 5F F7 D0 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_v110_Eng_bartxt_WinRAR_SFX: PEiD
{
    strings:
        $a = { 80 E9 A1 C1 C1 13 68 E4 16 75 46 C1 C1 05 5E EB 01 9D 68 64 86 37 46 EB 02 8C E0 5F F7 D0 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PEQuake_v006_by_fORGAT
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 A5 00 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 3D ?? 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? 00 00 5B ?? 00 00 6E ?? 00 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 }
        $b = { E8 A5 00 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 3D ?? 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? 00 00 5B ?? 00 00 6E ?? 00 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 81 00 00 00 56 50 FF 55 2D 89 85 8E 00 00 00 6A 04 68 00 10 00 00 68 ?? ?? 00 00 6A 00 FF 95 8E 00 00 00 50 8B 9D 7D 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule PEQuake_v006_by_fORGAT: PEiD
{
    strings:
        $a = { E8 A5 00 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 3D ?? 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? 00 00 5B ?? 00 00 6E ?? 00 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 }
        $b = { E8 A5 00 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 3D ?? 00 00 2D ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4A ?? 00 00 5B ?? 00 00 6E ?? 00 00 00 00 00 00 6B 45 72 4E 65 4C 33 32 2E 64 4C 6C 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 ?? ?? 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 00 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 5D 81 ED 05 00 00 00 8D 75 3D 56 FF 55 31 8D B5 81 00 00 00 56 50 FF 55 2D 89 85 8E 00 00 00 6A 04 68 00 10 00 00 68 ?? ?? 00 00 6A 00 FF 95 8E 00 00 00 50 8B 9D 7D 00 00 00 03 DD 50 53 E8 04 00 00 00 5A 55 FF E2 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: DCrypt_Private_09b_drmist_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B9 ?? ?? ?? 00 E8 00 00 00 00 58 68 ?? ?? ?? 00 83 E8 0B 0F 18 00 D0 00 48 E2 FB C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule DCrypt_Private_09b_drmist_additional: PEiD
{
    strings:
        $a = { B9 ?? ?? ?? 00 E8 00 00 00 00 58 68 ?? ?? ?? 00 83 E8 0B 0F 18 00 D0 00 48 E2 FB C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Fish_PE_Shield_112116_HellFish_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00 ?? ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 ?? ?? 00 ?? ?? 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 00 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Fish_PE_Shield_112116_HellFish_additional: PEiD
{
    strings:
        $a = { 60 E8 EA FD FF FF FF D0 C3 8D 40 00 ?? 00 00 00 2C 00 00 00 ?? ?? ?? 00 ?? ?? 00 00 ?? ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? 00 00 00 00 ?? ?? 00 ?? ?? 00 00 ?? 00 00 00 00 ?? ?? 00 00 10 00 00 ?? ?? ?? 00 40 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: eXPressorPacK_V150X_CGSoftLabs_Sign_by_fly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 83 A5 ?? ?? ?? ?? ?? F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C ?? 75 23 8B 45 08 A3 ?? ?? ?? ?? 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? EB 04 }

Detection condition:
$a at pe.entry_point

Full rule:
rule eXPressorPacK_V150X_CGSoftLabs_Sign_by_fly: PEiD
{
    strings:
        $a = { 55 8B EC 81 EC ?? ?? ?? ?? 53 56 57 83 A5 ?? ?? ?? ?? ?? F3 EB 0C 65 58 50 72 2D 76 2E 31 2E 35 2E 00 83 7D 0C ?? 75 23 8B 45 08 A3 ?? ?? ?? ?? 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? EB 04 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Borland_Graphics_Interface_Driver
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 46 42 47 44 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Borland_Graphics_Interface_Driver: PEiD
{
    strings:
        $a = { 46 42 47 44 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Quake518_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 1E 06 8C C8 8E D8 ?? ?? ?? ?? ?? ?? ?? B8 21 35 CD 21 81 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Quake518_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 1E 06 8C C8 8E D8 ?? ?? ?? ?? ?? ?? ?? B8 21 35 CD 21 81 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Free_Pascal_v106_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { C6 05 ?? ?? 40 00 ?? E8 ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Free_Pascal_v106_additional: PEiD
{
    strings:
        $a = { C6 05 ?? ?? 40 00 ?? E8 ?? ?? 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EPW_v12_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 06 57 1E 56 55 52 51 53 50 2E ?? ?? ?? ?? 8C C0 05 ?? ?? 2E ?? ?? ?? 8E D8 A1 ?? ?? 2E }

Detection condition:
$a at pe.entry_point

Full rule:
rule EPW_v12_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 06 57 1E 56 55 52 51 53 50 2E ?? ?? ?? ?? 8C C0 05 ?? ?? 2E ?? ?? ?? 8E D8 A1 ?? ?? 2E }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: TXTMaker_v122_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB ?? B4 ?? 33 DB CD 10 80 ?? ?? 74 ?? B0 ?? EB ?? 8B }

Detection condition:
$a at pe.entry_point

Full rule:
rule TXTMaker_v122_Hint_DOS_EP: PEiD
{
    strings:
        $a = { EB ?? B4 ?? 33 DB CD 10 80 ?? ?? 74 ?? B0 ?? EB ?? 8B }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_v024_v028_Alpha_Dwing
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE 88 01 40 00 AD ?? ?? 95 AD 91 F3 A5 AD }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_v024_v028_Alpha_Dwing: PEiD
{
    strings:
        $a = { BE 88 01 40 00 AD ?? ?? 95 AD 91 F3 A5 AD }
    condition:
        $a at pe.entry_point

}