deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: AZProtect
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30 }

Detection condition:
$a at pe.entry_point

Full rule:
rule AZProtect: PEiD
{
    strings:
        $a = { EB 70 FC 60 8C 80 4D 11 00 70 25 81 00 40 0D 91 BB 60 8C 80 4D 11 00 70 21 81 1D 61 0D 81 00 40 CE 60 8C 80 4D 11 00 70 25 81 25 81 25 81 25 81 29 61 41 81 31 61 1D 61 00 40 B7 30 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Packman_0001_bubba_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 58 8D A8 ?? FE FF FF 8D 98 ?? ?? ?? FF 8D ?? ?? 01 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Packman_0001_bubba_additional: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 58 8D A8 ?? FE FF FF 8D 98 ?? ?? ?? FF 8D ?? ?? 01 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Xenocode_Virtual_Application_Studio_Xenocode_20090203
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 58 00 65 00 6E 00 6F 00 63 00 6F 00 64 00 65 00 20 00 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 20 00 41 00 70 00 70 00 6C 00 69 00 61 00 6E 00 63 00 65 00 20 00 52 00 75 00 6E 00 74 00 69 00 6D 00 65 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 31 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 32 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 33 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 34 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 35 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Xenocode_Virtual_Application_Studio_Xenocode_20090203: PEiD
{
    strings:
        $a = { 58 00 65 00 6E 00 6F 00 63 00 6F 00 64 00 65 00 20 00 56 00 69 00 72 00 74 00 75 00 61 00 6C 00 20 00 41 00 70 00 70 00 6C 00 69 00 61 00 6E 00 63 00 65 00 20 00 52 00 75 00 6E 00 74 00 69 00 6D 00 65 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 31 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 32 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 33 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 34 00 00 00 00 00 30 00 78 00 30 00 30 00 31 00 35 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Private_EXE_20a
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 53 E8 00 00 00 00 5B 8B C3 2D 00 00 00 00 50 81 EB 06 10 40 00 8B 83 E7 10 40 00 81 38 E8 2F F5 FD 0F 85 A4 00 00 00 8D 83 23 11 40 00 50 FF 93 EB 10 40 00 0B C0 74 78 90 90 90 90 89 83 1F 11 40 00 8D 83 27 11 40 00 50 FF B3 1F 11 40 00 FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule Private_EXE_20a: PEiD
{
    strings:
        $a = { 53 E8 00 00 00 00 5B 8B C3 2D 00 00 00 00 50 81 EB 06 10 40 00 8B 83 E7 10 40 00 81 38 E8 2F F5 FD 0F 85 A4 00 00 00 8D 83 23 11 40 00 50 FF 93 EB 10 40 00 0B C0 74 78 90 90 90 90 89 83 1F 11 40 00 8D 83 27 11 40 00 50 FF B3 1F 11 40 00 FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Crunch_40
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Crunch_40: PEiD
{
    strings:
        $a = { EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 18 00 00 00 8B C5 55 60 9C 2B 85 E9 06 00 00 89 85 E1 06 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 92 05 00 00 E8 F1 03 00 00 49 0F 88 86 05 00 00 68 6C D9 B2 96 33 C0 50 E8 24 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: nSpack_V23_LiuXingPing
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 60 70 61 63 6B 24 40 }

Detection condition:
$a at pe.entry_point

Full rule:
rule nSpack_V23_LiuXingPing: PEiD
{
    strings:
        $a = { 9C 60 70 61 63 6B 24 40 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_110_Eng_dulekxt_Borland_Cpp
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 }
        $b = { 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule FSG_110_Eng_dulekxt_Borland_Cpp: PEiD
{
    strings:
        $a = { BB D0 01 40 00 BF 00 10 40 00 BE ?? ?? ?? 00 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 B2 80 A4 6A 02 5B FF 14 24 73 F7 33 C9 FF 14 24 73 18 33 C0 FF 14 24 73 21 B3 02 41 B0 10 FF 14 24 12 C0 73 F9 75 3F AA EB DC E8 43 00 00 00 2B CB 75 10 E8 38 00 }
        $b = { 23 CA EB 02 5A 0D E8 02 00 00 00 6A 35 58 C1 C9 10 BE 80 ?? ?? 00 0F B6 C9 EB 02 CD 20 BB F4 00 00 00 EB 02 04 FA EB 01 FA EB 01 5F EB 02 CD 20 8A 16 EB 02 11 31 80 E9 31 EB 02 30 11 C1 E9 11 80 EA 04 EB 02 F0 EA 33 CB 81 EA AB AB 19 08 04 D5 03 C2 80 EA }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Pelles_C_300_400_450_EXE_X86_CRT_LIB
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 02 E8 ?? ?? ?? ?? 59 A3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Pelles_C_300_400_450_EXE_X86_CRT_LIB: PEiD
{
    strings:
        $a = { 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 02 E8 ?? ?? ?? ?? 59 A3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MS_Run_Time_Library_1992_14
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 1E 06 8C C8 8E D8 8C C0 A3 ?? ?? 83 C0 ?? A3 ?? ?? B4 30 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MS_Run_Time_Library_1992_14: PEiD
{
    strings:
        $a = { 1E 06 8C C8 8E D8 8C C0 A3 ?? ?? 83 C0 ?? A3 ?? ?? B4 30 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MS_Run_Time_Library_1992_11
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B4 51 CD 21 8E DB B8 ?? ?? 83 E8 ?? 8E C0 33 F6 33 FF B9 ?? ?? FC F3 A5 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MS_Run_Time_Library_1992_11: PEiD
{
    strings:
        $a = { B4 51 CD 21 8E DB B8 ?? ?? 83 E8 ?? 8E C0 33 F6 33 FF B9 ?? ?? FC F3 A5 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MS_Run_Time_Library_1992_13
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BF ?? ?? 8E DF FA 8E D7 81 C4 ?? ?? FB 33 DB B8 ?? ?? CD 21 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MS_Run_Time_Library_1992_13: PEiD
{
    strings:
        $a = { BF ?? ?? 8E DF FA 8E D7 81 C4 ?? ?? FB 33 DB B8 ?? ?? CD 21 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PROTECT_EXECOM_v40_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? E8 ?? ?? 5D 81 ED ?? ?? 33 C0 8E D8 8B F0 BF ?? ?? B9 ?? ?? FC F3 A5 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PROTECT_EXECOM_v40_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? E8 ?? ?? 5D 81 ED ?? ?? 33 C0 8E D8 8B F0 BF ?? ?? B9 ?? ?? FC F3 A5 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_02_Microsoft_Visual_Basic_50_60
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_02_Microsoft_Visual_Basic_50_60: PEiD
{
    strings:
        $a = { 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RE_Crypt_v07x_Crudd_RET_h2_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B 17 33 55 58 89 17 83 C7 04 83 C1 FC EB EC 8B }

Detection condition:
$a at pe.entry_point

Full rule:
rule RE_Crypt_v07x_Crudd_RET_h2_additional: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 55 81 04 24 0A 00 00 00 C3 8B F5 81 C5 ?? ?? 00 00 89 6D 34 89 75 38 8B 7D 38 81 E7 00 FF FF FF 81 C7 48 00 00 00 47 03 7D 60 8B 4D 5C 83 F9 00 7E 0F 8B 17 33 55 58 89 17 83 C7 04 83 C1 FC EB EC 8B }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: fEaRzCrypter_v10_fEaRz
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 ?? 53 56 57 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 BA ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 85 DB 75 ?? 6A 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule fEaRzCrypter_v10_fEaRz: PEiD
{
    strings:
        $a = { 55 8B EC B9 09 00 00 00 6A 00 6A 00 49 75 ?? 53 56 57 B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 BA ?? ?? ?? ?? B8 ?? ?? ?? ?? E8 ?? ?? ?? ?? 8B D8 85 DB 75 ?? 6A 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Borland_Cpp_1994_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8C CA 2E 89 ?? ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA A3 ?? ?? 8C }

Detection condition:
$a at pe.entry_point

Full rule:
rule Borland_Cpp_1994_additional: PEiD
{
    strings:
        $a = { 8C CA 2E 89 ?? ?? ?? B4 30 CD 21 8B 2E ?? ?? 8B 1E ?? ?? 8E DA A3 ?? ?? 8C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MS_Run_Time_Library_1990_07_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 2E 8C 1E ?? ?? BB ?? ?? 8E DB 1E E8 ?? ?? 1F 8B 1E ?? ?? 0B DB 74 ?? 8C D1 8B D4 FA 8E D3 BC ?? ?? FB }

Detection condition:
$a at pe.entry_point

Full rule:
rule MS_Run_Time_Library_1990_07_additional: PEiD
{
    strings:
        $a = { 2E 8C 1E ?? ?? BB ?? ?? 8E DB 1E E8 ?? ?? 1F 8B 1E ?? ?? 0B DB 74 ?? 8C D1 8B D4 FA 8E D3 BC ?? ?? FB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_v098
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D7 84 40 ?? 87 DD 8B 85 5C 85 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_v098: PEiD
{
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB D7 84 40 ?? 87 DD 8B 85 5C 85 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_v099
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 2F 85 40 ?? 87 DD 8B 85 B4 85 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_v099: PEiD
{
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 2F 85 40 ?? 87 DD 8B 85 B4 85 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Borland_Cpp_for_Win16_1991_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9A FF FF 00 00 0B C0 75 ?? E9 ?? ?? 8C ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? B8 FF FF 50 9A FF FF 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Borland_Cpp_for_Win16_1991_additional: PEiD
{
    strings:
        $a = { 9A FF FF 00 00 0B C0 75 ?? E9 ?? ?? 8C ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? B8 FF FF 50 9A FF FF 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_v090
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 ?? ?? 40 00 C3 9C 60 BD ?? ?? 00 00 B9 02 00 00 00 B0 90 8D BD 7A 42 40 00 F3 AA 01 AD D9 43 40 00 FF B5 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_v090: PEiD
{
    strings:
        $a = { EB 06 68 ?? ?? 40 00 C3 9C 60 BD ?? ?? 00 00 B9 02 00 00 00 B0 90 8D BD 7A 42 40 00 F3 AA 01 AD D9 43 40 00 FF B5 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_v092
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 BD ?? ?? ?? ?? B9 02 ?? ?? ?? B0 90 8D BD A5 4F 40 ?? F3 AA 01 AD 04 51 40 ?? FF B5 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_v092: PEiD
{
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 BD ?? ?? ?? ?? B9 02 ?? ?? ?? B0 90 8D BD A5 4F 40 ?? F3 AA 01 AD 04 51 40 ?? FF B5 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_v094
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 ?? ?? ?? ?? 5D 55 58 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 01 85 ?? ?? ?? ?? 50 B9 02 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_v094: PEiD
{
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 ?? ?? ?? ?? 5D 55 58 81 ED ?? ?? ?? ?? 2B 85 ?? ?? ?? ?? 01 85 ?? ?? ?? ?? 50 B9 02 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: deep_CRyPTer_v01c_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? E8 ?? ?? 59 8B E9 81 ?? ?? ?? 81 ?? ?? ?? BE ?? ?? 8D ?? ?? ?? 66 ?? ?? 66 ?? ?? 8D ?? ?? ?? 8B D7 8B DF }

Detection condition:
$a at pe.entry_point

Full rule:
rule deep_CRyPTer_v01c_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? E8 ?? ?? 59 8B E9 81 ?? ?? ?? 81 ?? ?? ?? BE ?? ?? 8D ?? ?? ?? 66 ?? ?? 66 ?? ?? 8D ?? ?? ?? 8B D7 8B DF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_Visual_Cpp_vxx
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 53 55 56 8B 85 F6 57 B8 75 8B 85 C9 75 33 C0 5F 5E 5D 5B }
        $b = { 53 55 56 8B ?? ?? ?? 85 F6 57 B8 ?? ?? ?? ?? 75 ?? 8B ?? ?? ?? ?? ?? 85 C9 75 ?? 33 C0 5F 5E 5D 5B C2 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Microsoft_Visual_Cpp_vxx: PEiD
{
    strings:
        $a = { 53 55 56 8B 85 F6 57 B8 75 8B 85 C9 75 33 C0 5F 5E 5D 5B }
        $b = { 53 55 56 8B ?? ?? ?? 85 F6 57 B8 ?? ?? ?? ?? 75 ?? 8B ?? ?? ?? ?? ?? 85 C9 75 ?? 33 C0 5F 5E 5D 5B C2 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: InstallShield_Archive_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 2A AB 79 D8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule InstallShield_Archive_Hint_FILE_START: PEiD
{
    strings:
        $a = { 2A AB 79 D8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_v110_Eng_dulekxt_Borland_Delphi_Microsoft_Visual_Cpp_ASM_
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 02 CD 20 EB 02 CD 20 EB 02 CD 20 C1 E6 18 BB 80 ?? ?? 00 EB 02 82 B8 EB 01 10 8D 05 F4 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_v110_Eng_dulekxt_Borland_Delphi_Microsoft_Visual_Cpp_ASM_: PEiD
{
    strings:
        $a = { EB 02 CD 20 EB 02 CD 20 EB 02 CD 20 C1 E6 18 BB 80 ?? ?? 00 EB 02 82 B8 EB 01 10 8D 05 F4 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASPack_v101b_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 ?? ?? ?? ?? 5D 81 ED CE 3A 44 ?? B8 C8 3A 44 ?? 03 C5 2B 85 B5 3E 44 ?? 89 85 C1 3E 44 ?? 80 BD AC 3E 44 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASPack_v101b_additional: PEiD
{
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED CE 3A 44 ?? B8 C8 3A 44 ?? 03 C5 2B 85 B5 3E 44 ?? 89 85 C1 3E 44 ?? 80 BD AC 3E 44 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: NoobyProtect_V1290_Nooby_20090218
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? 00 00 00 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E 32 2E 39 2E 30 }

Detection condition:
$a at pe.entry_point

Full rule:
rule NoobyProtect_V1290_Nooby_20090218: PEiD
{
    strings:
        $a = { E9 ?? 00 00 00 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E 32 2E 39 2E 30 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_01_Morphine_12
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 E2 90 90 90 EB 08 82 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 01 E9 }
        $b = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule PseudoSigner_01_Morphine_12: PEiD
{
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 E2 90 90 90 EB 08 82 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 01 E9 }
        $b = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 06 00 90 90 90 90 90 90 90 90 EB 08 E8 90 00 00 00 66 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 51 66 90 90 90 59 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: _v10_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 64 A1 00 00 00 00 55 89 E5 6A FF 68 1C 30 40 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _v10_additional: PEiD
{
    strings:
        $a = { 64 A1 00 00 00 00 55 89 E5 6A FF 68 1C 30 40 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Exe_Guarder_v18_Exeiconcom_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Exe_Guarder_v18_Exeiconcom_additional: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 D0 53 56 57 8D 75 FC 8B 44 24 30 25 00 00 FF FF 81 38 4D 5A 90 00 74 07 2D 00 10 00 00 EB F1 89 45 FC E8 C8 FF FF FF 2D B2 04 00 00 89 45 F4 8B 06 8B 40 3C 03 06 8B 40 78 03 06 8B C8 8B 51 20 03 16 8B 59 24 03 1E 89 5D F0 8B 59 1C 03 1E 89 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MoleBox_v20_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? ?? ?? 60 E8 4F }

Detection condition:
$a at pe.entry_point

Full rule:
rule MoleBox_v20_additional: PEiD
{
    strings:
        $a = { E8 ?? ?? ?? ?? 60 E8 4F }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Mew_501_NorthFox_HCC
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0 ?? 04 ?? C0 C8 ?? AA E2 F4 C3 00 ?? ?? 00 ?? ?? ?? 00 00 10 40 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D }
        $b = { BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0 ?? 04 ?? C0 C8 ?? AA E2 F4 C3 00 ?? ?? 00 ?? ?? ?? 00 00 10 40 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Mew_501_NorthFox_HCC: PEiD
{
    strings:
        $a = { BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0 ?? 04 ?? C0 C8 ?? AA E2 F4 C3 00 ?? ?? 00 ?? ?? ?? 00 00 10 40 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D }
        $b = { BE 5B 00 40 00 AD 91 AD 93 53 AD 96 56 5F AC C0 C0 ?? 04 ?? C0 C8 ?? AA E2 F4 C3 00 ?? ?? 00 ?? ?? ?? 00 00 10 40 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E 31 20 62 79 20 4E 6F 72 74 68 66 6F 78 00 4D 45 57 20 30 2E }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: EXECryptor_2xx_compressed_resources_wwwstrongbitcom
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F C1 EA 05 74 2D 4A 74 15 8D 5C 13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3 05 8D 5C 03 04 46 89 FA 0F B7 0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1 E8 05 73 07 43 89 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXECryptor_2xx_compressed_resources_wwwstrongbitcom: PEiD
{
    strings:
        $a = { 56 57 53 31 DB 89 C6 89 D7 0F B6 06 89 C2 83 E0 1F C1 EA 05 74 2D 4A 74 15 8D 5C 13 02 46 C1 E0 08 89 FA 0F B6 0E 46 29 CA 4A 29 C2 EB 32 C1 E3 05 8D 5C 03 04 46 89 FA 0F B7 0E 29 CA 4A 83 C6 02 EB 1D C1 E3 04 46 89 C1 83 E1 0F 01 CB C1 E8 05 73 07 43 89 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PC_Shrinker_v071
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 60 BD ?? ?? ?? ?? 01 AD 54 3A 40 ?? FF B5 50 3A 40 ?? 6A 40 FF 95 88 3A 40 ?? 50 50 2D ?? ?? ?? ?? 89 85 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PC_Shrinker_v071: PEiD
{
    strings:
        $a = { 9C 60 BD ?? ?? ?? ?? 01 AD 54 3A 40 ?? FF B5 50 3A 40 ?? 6A 40 FF 95 88 3A 40 ?? 50 50 2D ?? ?? ?? ?? 89 85 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EP_v01_CoDe_Inside
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC AA 86 C4 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EP_v01_CoDe_Inside: PEiD
{
    strings:
        $a = { 50 83 C0 17 8B F0 97 33 C0 33 C9 B1 24 AC AA 86 C4 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Symantec_WinFax_PRO_75_Coverpage_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 0C BD 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C0 06 80 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Symantec_WinFax_PRO_75_Coverpage_additional: PEiD
{
    strings:
        $a = { 0C BD 03 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? C0 06 80 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PESHiELD_v01b_MTE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B9 1B 01 ?? ?? D1 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PESHiELD_v01b_MTE: PEiD
{
    strings:
        $a = { E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B9 1B 01 ?? ?? D1 }
    condition:
        $a at pe.entry_point

}