deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: KGCrypt_vxx
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 64 A1 30 ?? ?? ?? 84 C0 74 ?? 64 A1 20 ?? ?? ?? 0B C0 74 }

Detection condition:
$a at pe.entry_point

Full rule:
rule KGCrypt_vxx: PEiD
{
    strings:
        $a = { E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 64 A1 30 ?? ?? ?? 84 C0 74 ?? 64 A1 20 ?? ?? ?? 0B C0 74 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Kuku448_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { AE 75 ED E2 F8 89 3E ?? ?? BA ?? ?? 0E 07 BF ?? ?? EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Kuku448_Hint_DOS_EP: PEiD
{
    strings:
        $a = { AE 75 ED E2 F8 89 3E ?? ?? BA ?? ?? 0E 07 BF ?? ?? EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Kuku448_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { AE 75 ED E2 F8 89 3E ?? ?? BA ?? ?? 0E 07 BF ?? ?? EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Kuku448_additional: PEiD
{
    strings:
        $a = { AE 75 ED E2 F8 89 3E ?? ?? BA ?? ?? 0E 07 BF ?? ?? EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MS_FORTRAN_Library_19_Hint_DOS_EP_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC B8 ?? ?? 8E C0 26 C7 ?? ?? ?? ?? ?? 26 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MS_FORTRAN_Library_19_Hint_DOS_EP_additional: PEiD
{
    strings:
        $a = { FC 1E B8 ?? ?? 8E D8 9A ?? ?? ?? ?? 81 ?? ?? ?? 8B EC B8 ?? ?? 8E C0 26 C7 ?? ?? ?? ?? ?? 26 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_Neolite_20
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_Neolite_20: PEiD
{
    strings:
        $a = { E9 A6 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Obsidium_V1300_Obsidium_Software
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 04 ?? ?? ?? ?? E8 29 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsidium_V1300_Obsidium_Software: PEiD
{
    strings:
        $a = { EB 04 ?? ?? ?? ?? E8 29 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: NsPack_31_by_North_Star_Liu_Xing_Ping_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 }

Detection condition:
$a at pe.entry_point

Full rule:
rule NsPack_31_by_North_Star_Liu_Xing_Ping_additional: PEiD
{
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D 83 ED 07 8D 9D ?? ?? FF FF 8A 03 3C 00 74 10 8D 9D ?? ?? FF FF 8A 03 3C 01 0F 84 42 02 00 00 C6 03 01 8B D5 2B 95 ?? ?? FF FF 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PCPEC_alpha_preview
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PCPEC_alpha_preview: PEiD
{
    strings:
        $a = { 53 51 52 56 57 55 E8 00 00 00 00 5D 8B CD 81 ED 33 30 40 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PIRIT_v15
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B4 4D CD 21 E8 ?? ?? FD E8 ?? ?? B4 51 CD 21 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PIRIT_v15: PEiD
{
    strings:
        $a = { B4 4D CD 21 E8 ?? ?? FD E8 ?? ?? B4 51 CD 21 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: aPack_073_074_m_EXE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 1E 06 8C C8 BA 00 00 03 C2 8B D8 05 00 00 FC 33 F6 33 FF 48 4B 8E C0 8E DB B9 08 00 F3 A5 4A 75 EE 8E D8 8E C3 33 FF 0E BE 32 00 05 00 00 50 6A 00 CB }

Detection condition:
$a at pe.entry_point

Full rule:
rule aPack_073_074_m_EXE: PEiD
{
    strings:
        $a = { 1E 06 8C C8 BA 00 00 03 C2 8B D8 05 00 00 FC 33 F6 33 FF 48 4B 8E C0 8E DB B9 08 00 F3 A5 4A 75 EE 8E D8 8E C3 33 FF 0E BE 32 00 05 00 00 50 6A 00 CB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PE_Pack_v099_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 ?? ?? ?? ?? 5D 83 ED 06 80 BD E0 04 ?? ?? 01 0F 84 F2 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PE_Pack_v099_additional: PEiD
{
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 83 ED 06 80 BD E0 04 ?? ?? 01 0F 84 F2 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: WebCops_EXE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 03 05 EB 02 EB FC 55 EB 03 EB 04 05 EB FB EB 53 E8 04 00 00 00 72 }

Detection condition:
$a at pe.entry_point

Full rule:
rule WebCops_EXE: PEiD
{
    strings:
        $a = { EB 03 05 EB 02 EB FC 55 EB 03 EB 04 05 EB FB EB 53 E8 04 00 00 00 72 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Turbo_Pascal_Configuration_File_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 54 75 72 62 6F 20 50 61 73 63 61 6C 20 43 6F 6E 66 69 67 75 72 61 74 69 6F 6E }

Detection condition:
$a at pe.entry_point

Full rule:
rule Turbo_Pascal_Configuration_File_Hint_FILE_START: PEiD
{
    strings:
        $a = { 54 75 72 62 6F 20 50 61 73 63 61 6C 20 43 6F 6E 66 69 67 75 72 61 74 69 6F 6E }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_02_Gleam_100
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_02_Gleam_100: PEiD
{
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_VirusConstructorIVPbased_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? E8 ?? ?? 5D ?? ?? ?? ?? ?? 81 ED ?? ?? ?? ?? ?? ?? E8 ?? ?? 81 FC ?? ?? ?? ?? 8D ?? ?? ?? BF ?? ?? 57 A4 A5 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_VirusConstructorIVPbased_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? E8 ?? ?? 5D ?? ?? ?? ?? ?? 81 ED ?? ?? ?? ?? ?? ?? E8 ?? ?? 81 FC ?? ?? ?? ?? 8D ?? ?? ?? BF ?? ?? 57 A4 A5 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXE_Shield_V01b_V08_SMoKE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 04 00 00 00 83 ?? ?? ?? 5D EB 05 45 55 EB 04 ?? EB F9 ?? C3 E8 00 00 00 00 5D EB 01 ?? 81 ?? ?? ?? ?? ?? EB 02 ?? ?? 8D ?? ?? ?? ?? ?? EB 02 ?? ?? BA 9F 11 00 00 EB 01 ?? 8D ?? ?? ?? ?? ?? 8B 09 E8 14 00 00 00 }
        $b = { E8 04 00 00 00 83 ?? ?? ?? 5D EB 05 45 55 EB 04 ?? EB F9 ?? C3 E8 00 00 00 00 5D EB 01 ?? 81 ?? ?? ?? ?? ?? EB 02 ?? ?? 8D ?? ?? ?? ?? ?? EB 02 ?? ?? BA 9F 11 00 00 EB 01 ?? 8D ?? ?? ?? ?? ?? 8B 09 E8 14 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 58 40 50 C3 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule EXE_Shield_V01b_V08_SMoKE: PEiD
{
    strings:
        $a = { E8 04 00 00 00 83 ?? ?? ?? 5D EB 05 45 55 EB 04 ?? EB F9 ?? C3 E8 00 00 00 00 5D EB 01 ?? 81 ?? ?? ?? ?? ?? EB 02 ?? ?? 8D ?? ?? ?? ?? ?? EB 02 ?? ?? BA 9F 11 00 00 EB 01 ?? 8D ?? ?? ?? ?? ?? 8B 09 E8 14 00 00 00 }
        $b = { E8 04 00 00 00 83 ?? ?? ?? 5D EB 05 45 55 EB 04 ?? EB F9 ?? C3 E8 00 00 00 00 5D EB 01 ?? 81 ?? ?? ?? ?? ?? EB 02 ?? ?? 8D ?? ?? ?? ?? ?? EB 02 ?? ?? BA 9F 11 00 00 EB 01 ?? 8D ?? ?? ?? ?? ?? 8B 09 E8 14 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 58 40 50 C3 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: VOB_ProtectCD
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 5F 81 EF ?? ?? ?? ?? BE ?? ?? 40 ?? 8B 87 ?? ?? ?? ?? 03 C6 57 56 8C A7 ?? ?? ?? ?? FF 10 89 87 ?? ?? ?? ?? 5E 5F }

Detection condition:
$a at pe.entry_point

Full rule:
rule VOB_ProtectCD: PEiD
{
    strings:
        $a = { 5F 81 EF ?? ?? ?? ?? BE ?? ?? 40 ?? 8B 87 ?? ?? ?? ?? 03 C6 57 56 8C A7 ?? ?? ?? ?? FF 10 89 87 ?? ?? ?? ?? 5E 5F }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_v02Beta
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE 88 01 ?? ?? AD 8B F8 95 A5 33 C0 33 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_v02Beta: PEiD
{
    strings:
        $a = { BE 88 01 ?? ?? AD 8B F8 95 A5 33 C0 33 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_02_CD_Cops_II_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_02_CD_Cops_II_Anorganix: PEiD
{
    strings:
        $a = { 53 60 BD 90 90 90 90 8D 45 90 8D 5D 90 E8 00 00 00 00 8D 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PrincessSandy_10_eMiNENCE_Process_Patcher_Patch
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 27 11 40 00 E8 3C 01 00 00 6A 00 E8 41 01 00 00 A3 00 20 40 00 8B 58 3C 03 D8 0F B7 43 14 0F B7 4B 06 8D 7C 18 18 81 3F 2E 4C 4F 41 74 0B 83 C7 28 49 75 F2 E9 A7 00 00 00 8B 5F 0C 03 1D 00 20 40 00 89 1D 04 20 40 00 8B FB 83 C7 04 68 4C 20 40 00 68 08 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PrincessSandy_10_eMiNENCE_Process_Patcher_Patch: PEiD
{
    strings:
        $a = { 68 27 11 40 00 E8 3C 01 00 00 6A 00 E8 41 01 00 00 A3 00 20 40 00 8B 58 3C 03 D8 0F B7 43 14 0F B7 4B 06 8D 7C 18 18 81 3F 2E 4C 4F 41 74 0B 83 C7 28 49 75 F2 E9 A7 00 00 00 8B 5F 0C 03 1D 00 20 40 00 89 1D 04 20 40 00 8B FB 83 C7 04 68 4C 20 40 00 68 08 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_DxPack_10_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_DxPack_10_Anorganix: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 8B FD 81 ED 90 90 90 90 2B B9 00 00 00 00 81 EF 90 90 90 90 83 BD 90 90 90 90 90 0F 84 00 00 00 00 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Anslym_Crypter_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A 68 30 1C 05 10 A1 60 56 05 10 50 E8 68 47 FB FF 8B }

Detection condition:
$a at pe.entry_point

Full rule:
rule Anslym_Crypter_additional: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 F0 53 56 B8 38 17 05 10 E8 5A 45 FB FF 33 C0 55 68 21 1C 05 10 64 FF 30 64 89 20 EB 08 FC FC FC FC FC FC 27 54 E8 85 4C FB FF 6A 00 E8 0E 47 FB FF 6A 0A E8 27 49 FB FF E8 EA 47 FB FF 6A 0A 68 30 1C 05 10 A1 60 56 05 10 50 E8 68 47 FB FF 8B }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPX_V200_V290_Markus_Oberhumer_amp_Laszlo_Molnar_amp_John_Reiser
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FF D5 8D 87 ?? ?? ?? ?? 80 20 ?? 80 60 ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPX_V200_V290_Markus_Oberhumer_amp_Laszlo_Molnar_amp_John_Reiser: PEiD
{
    strings:
        $a = { FF D5 8D 87 ?? ?? ?? ?? 80 20 ?? 80 60 ?? ?? 58 50 54 50 53 57 FF D5 58 61 8D 44 24 ?? 6A 00 39 C4 75 FA 83 EC 80 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PCPaintPictor_graphics_file_format
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 34 12 ?? ?? ?? ?? 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PCPaintPictor_graphics_file_format: PEiD
{
    strings:
        $a = { 34 12 ?? ?? ?? ?? 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: DEF_10_bartxt
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE ?? ?? 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule DEF_10_bartxt: PEiD
{
    strings:
        $a = { BE ?? ?? 40 00 6A ?? 59 80 7E 07 00 74 11 8B 46 0C 05 00 00 40 00 8B 56 10 30 10 40 4A 75 FA 83 C6 28 E2 E4 68 ?? ?? 40 00 C3 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RLPack_Full_Edition_117_DLL_aPLib
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RLPack_Full_Edition_117_DLL_aPLib: PEiD
{
    strings:
        $a = { 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 53 03 00 00 8D 9D 02 02 00 00 33 FF E8 ?? ?? ?? ?? EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 08 83 C7 08 83 3C 37 00 75 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_v036_alpha_Dwing
Repository: Yara-Rules/rules

Pattern signatures:
$a = { AB E2 E5 5D 59 8B 76 68 51 59 46 AD 85 C0 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_v036_alpha_Dwing: PEiD
{
    strings:
        $a = { AB E2 E5 5D 59 8B 76 68 51 59 46 AD 85 C0 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: GameGuard_nProtect
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE ?? ?? ?? ?? 31 FF 74 06 61 E9 4A 4D 50 30 8D BE ?? ?? ?? ?? 31 C9 74 06 61 E9 4A 4D 50 30 B8 7D 00 00 00 39 C2 B8 4C 00 00 00 F7 D0 75 3F 64 A1 30 00 00 00 85 C0 78 23 8B 40 0C 8B 40 0C C7 40 20 00 10 00 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 85 C0 75 16 E9 12 00 00 00 31 C0 64 A0 20 00 00 00 85 C0 75 05 E9 01 00 00 00 61 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 }
        $b = { 31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE ?? ?? ?? ?? 31 FF 74 06 61 E9 4A 4D 50 30 8D BE ?? ?? ?? ?? 31 C9 74 06 61 E9 4A 4D 50 30 B8 7D 00 00 00 39 C2 B8 4C 00 00 00 F7 D0 75 3F 64 A1 30 00 00 00 85 C0 78 23 8B }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule GameGuard_nProtect: PEiD
{
    strings:
        $a = { 31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE ?? ?? ?? ?? 31 FF 74 06 61 E9 4A 4D 50 30 8D BE ?? ?? ?? ?? 31 C9 74 06 61 E9 4A 4D 50 30 B8 7D 00 00 00 39 C2 B8 4C 00 00 00 F7 D0 75 3F 64 A1 30 00 00 00 85 C0 78 23 8B 40 0C 8B 40 0C C7 40 20 00 10 00 00 64 A1 18 00 00 00 8B 40 30 0F B6 40 02 85 C0 75 16 E9 12 00 00 00 31 C0 64 A0 20 00 00 00 85 C0 75 05 E9 01 00 00 00 61 57 83 CD FF EB 0B 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 }
        $b = { 31 FF 74 06 61 E9 4A 4D 50 30 5A BA 7D 00 00 00 80 7C 24 08 01 E9 00 00 00 00 60 BE ?? ?? ?? ?? 31 FF 74 06 61 E9 4A 4D 50 30 8D BE ?? ?? ?? ?? 31 C9 74 06 61 E9 4A 4D 50 30 B8 7D 00 00 00 39 C2 B8 4C 00 00 00 F7 D0 75 3F 64 A1 30 00 00 00 85 C0 78 23 8B }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: pirit_v15
Repository: Yara-Rules/rules

Pattern signatures:
$a = { ?? ?? ?? 5B 24 55 50 44 FB 32 2E 31 5D }
        $b = { 5B 24 55 50 44 FB 32 2E 31 5D }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule pirit_v15: PEiD
{
    strings:
        $a = { ?? ?? ?? 5B 24 55 50 44 FB 32 2E 31 5D }
        $b = { 5B 24 55 50 44 FB 32 2E 31 5D }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Metrowerks_CodeWarrior_DLL_v20_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 53 56 57 8B 75 0C 8B 5D 10 83 FE 01 74 05 83 FE 02 75 12 53 56 FF 75 08 E8 6E FF FF FF 09 C0 75 04 31 C0 EB 21 53 56 FF 75 08 E8 ?? ?? ?? ?? 89 C7 09 F6 74 05 83 FE 03 75 0A 53 56 FF 75 08 E8 47 FF FF FF 89 F8 8D 65 F4 5F 5E 5B 5D C2 0C 00 C9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Metrowerks_CodeWarrior_DLL_v20_additional: PEiD
{
    strings:
        $a = { 55 89 E5 53 56 57 8B 75 0C 8B 5D 10 83 FE 01 74 05 83 FE 02 75 12 53 56 FF 75 08 E8 6E FF FF FF 09 C0 75 04 31 C0 EB 21 53 56 FF 75 08 E8 ?? ?? ?? ?? 89 C7 09 F6 74 05 83 FE 03 75 0A 53 56 FF 75 08 E8 47 FF FF FF 89 F8 8D 65 F4 5F 5E 5B 5D C2 0C 00 C9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Berio_200_beta_h_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 01 74 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Berio_200_beta_h_additional: PEiD
{
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 01 74 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: hmimys_Packer_10_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule hmimys_Packer_10_additional: PEiD
{
    strings:
        $a = { 5E 83 C6 64 AD 50 AD 50 83 EE 6C AD 50 AD 50 AD 50 AD 50 AD 50 E8 E7 07 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ACProtect_V14X_risco_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 01 00 00 00 63 58 E8 01 00 00 00 7A 58 2D 0D 10 40 00 8D 90 C1 10 40 00 52 50 8D 80 49 10 40 00 5D 50 8D 85 65 10 40 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC }

Detection condition:
$a at pe.entry_point

Full rule:
rule ACProtect_V14X_risco_additional: PEiD
{
    strings:
        $a = { 60 E8 01 00 00 00 63 58 E8 01 00 00 00 7A 58 2D 0D 10 40 00 8D 90 C1 10 40 00 52 50 8D 80 49 10 40 00 5D 50 8D 85 65 10 40 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXE_Manager_Version_30_1994_c_Solar_Designer_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B4 30 1E 06 CD 21 2E ?? ?? ?? BF ?? ?? B9 ?? ?? 33 C0 2E ?? ?? 47 E2 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXE_Manager_Version_30_1994_c_Solar_Designer_additional: PEiD
{
    strings:
        $a = { B4 30 1E 06 CD 21 2E ?? ?? ?? BF ?? ?? B9 ?? ?? 33 C0 2E ?? ?? 47 E2 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Zortech_C_200_2
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FC BE 00 01 B9 FB 02 8B 3E F9 03 57 03 F9 81 C7 00 01 57 F3 A4 5F 81 C7 35 00 FF E7 BE FB 03 59 BF 00 01 57 F3 A4 C3 9C 50 51 52 56 57 55 1E FC 2E C7 06 00 00 FF FF 2E C7 06 06 00 12 00 8C C8 3D 00 A0 72 10 8E D8 BA CD 02 0E 1F B4 09 CD 21 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Zortech_C_200_2: PEiD
{
    strings:
        $a = { FC BE 00 01 B9 FB 02 8B 3E F9 03 57 03 F9 81 C7 00 01 57 F3 A4 5F 81 C7 35 00 FF E7 BE FB 03 59 BF 00 01 57 F3 A4 C3 9C 50 51 52 56 57 55 1E FC 2E C7 06 00 00 FF FF 2E C7 06 06 00 12 00 8C C8 3D 00 A0 72 10 8E D8 BA CD 02 0E 1F B4 09 CD 21 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Zortech_C_200_1
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FA B8 00 00 05 0F 00 B9 04 00 D3 E8 8C C9 03 C1 8E D8 8C 06 00 00 26 8B 1E 2C 00 89 1E 47 01 8B D8 2B 1E 00 00 89 1E AD 00 26 8B 1E 02 00 2B D8 81 FB 00 10 72 03 BB FF 0F 8B D0 03 D3 42 B1 04 D3 E3 8E D0 8B E3 81 EB 00 00 80 FF 02 73 06 BA }

Detection condition:
$a at pe.entry_point

Full rule:
rule Zortech_C_200_1: PEiD
{
    strings:
        $a = { FA B8 00 00 05 0F 00 B9 04 00 D3 E8 8C C9 03 C1 8E D8 8C 06 00 00 26 8B 1E 2C 00 89 1E 47 01 8B D8 2B 1E 00 00 89 1E AD 00 26 8B 1E 02 00 2B D8 81 FB 00 10 72 03 BB FF 0F 8B D0 03 D3 42 B1 04 D3 E3 8E D0 8B E3 81 EB 00 00 80 FF 02 73 06 BA }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PolyCrypt_PE_214b215_JLab_Software_Creations_h_signed
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 6F 6C 79 43 72 79 70 74 20 50 45 20 28 63 29 20 32 30 30 34 2D 32 30 30 35 2C 20 4A 4C 61 62 53 6F 66 74 77 61 72 65 2E 00 50 00 43 00 50 00 45 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PolyCrypt_PE_214b215_JLab_Software_Creations_h_signed: PEiD
{
    strings:
        $a = { 50 6F 6C 79 43 72 79 70 74 20 50 45 20 28 63 29 20 32 30 30 34 2D 32 30 30 35 2C 20 4A 4C 61 62 53 6F 66 74 77 61 72 65 2E 00 50 00 43 00 50 00 45 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: IBM_PictureMaker_graphics_file_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 ?? C1 ?? 00 ?? ?? ?? ?? 02 00 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule IBM_PictureMaker_graphics_file_additional: PEiD
{
    strings:
        $a = { 00 ?? C1 ?? 00 ?? ?? ?? ?? 02 00 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: YZPack_12_UsAr
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 4D 5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule YZPack_12_UsAr: PEiD
{
    strings:
        $a = { 4D 5A 52 45 60 83 EC 18 8B EC 8B FC 33 C0 64 8B 40 30 78 0C 8B 40 0C 8B 70 1C AD 8B 40 08 EB 09 8B 40 34 83 C0 7C 8B 40 3C AB E9 }
    condition:
        $a at pe.entry_point

}