deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Xtreme_Protector_100_105_Rafael_Ahucha_Sergio_Lara
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? 00 00 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Xtreme_Protector_100_105_Rafael_Ahucha_Sergio_Lara: PEiD
{
    strings:
        $a = { E9 ?? ?? 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: y0das_Crypter_v11_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED 8A 1C 40 00 B9 9E 00 00 00 8D BD 4C 23 40 00 8B F7 33 }

Detection condition:
$a at pe.entry_point

Full rule:
rule y0das_Crypter_v11_additional: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 8A 1C 40 00 B9 9E 00 00 00 8D BD 4C 23 40 00 8B F7 33 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Gem_VDI_Image_graphics_file_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 01 00 ?? 00 ?? 00 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Gem_VDI_Image_graphics_file_Hint_FILE_START: PEiD
{
    strings:
        $a = { 00 01 00 ?? 00 ?? 00 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Turbo_C_1987_or_Borland_Cpp_1991_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FB BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Turbo_C_1987_or_Borland_Cpp_1991_additional: PEiD
{
    strings:
        $a = { FB BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PESHiELD_v0251
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 5D 83 ED 06 EB 02 EA 04 8D }

Detection condition:
$a at pe.entry_point

Full rule:
rule PESHiELD_v0251: PEiD
{
    strings:
        $a = { 5D 83 ED 06 EB 02 EA 04 8D }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: aPack_v098b_com_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE ?? ?? BF ?? ?? 8B CF FC 57 F3 A4 C3 BF ?? ?? 57 57 BE ?? ?? B2 ?? BD ?? ?? 50 A4 }

Detection condition:
$a at pe.entry_point

Full rule:
rule aPack_v098b_com_additional: PEiD
{
    strings:
        $a = { BE ?? ?? BF ?? ?? 8B CF FC 57 F3 A4 C3 BF ?? ?? 57 57 BE ?? ?? B2 ?? BD ?? ?? 50 A4 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PE_Lock_NT_v203_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 02 C7 85 1E EB 03 CD 20 C7 9C EB 02 69 B1 60 EB 02 EB 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PE_Lock_NT_v203_additional: PEiD
{
    strings:
        $a = { EB 02 C7 85 1E EB 03 CD 20 C7 9C EB 02 69 B1 60 EB 02 EB 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPX_v071_DLL_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 83 }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPX_v071_DLL_additional: PEiD
{
    strings:
        $a = { 80 7C 24 08 01 0F 85 95 01 00 00 60 E8 00 00 00 00 83 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Sphinx_C_v_19_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? B4 34 CD 21 8C 06 ?? ?? 89 1E ?? ?? B8 ?? ?? E8 ?? ?? B8 ?? ?? BB }

Detection condition:
$a at pe.entry_point

Full rule:
rule Sphinx_C_v_19_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? B4 34 CD 21 8C 06 ?? ?? 89 1E ?? ?? B8 ?? ?? E8 ?? ?? B8 ?? ?? BB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: VProtect_2050618Cloud_CoooLie
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 F6 D3 66 F7 D2 66 F7 D2 F6 D3 61 66 91 60 F7 D3 F7 D3 61 66 91 8B 67 28 8B C9 66 55 66 5D 61 66 8B FF 66 52 66 5A 66 50 66 58 8D 80 F3 FF FF FF 9C 9D 8D 80 0D 00 00 00 60 61 9D 51 8D 80 E5 FF FF FF 8D 80 1B 00 00 00 59 8D 9B ED FF FF FF 50 66 87 CE 8B D2 66 87 CE 58 8D 9B 13 00 00 00 8D 89 FB FF FF FF 60 66 F7 D3 8D 89 FD FF FF FF 8D 89 03 00 00 00 66 F7 D3 61 8D 89 05 00 00 00 66 53 8D AD F5 FF FF FF 8A FF 8D AD 0B 00 00 00 66 5B }

Detection condition:
$a at pe.entry_point

Full rule:
rule VProtect_2050618Cloud_CoooLie: PEiD
{
    strings:
        $a = { 60 F6 D3 66 F7 D2 66 F7 D2 F6 D3 61 66 91 60 F7 D3 F7 D3 61 66 91 8B 67 28 8B C9 66 55 66 5D 61 66 8B FF 66 52 66 5A 66 50 66 58 8D 80 F3 FF FF FF 9C 9D 8D 80 0D 00 00 00 60 61 9D 51 8D 80 E5 FF FF FF 8D 80 1B 00 00 00 59 8D 9B ED FF FF FF 50 66 87 CE 8B D2 66 87 CE 58 8D 9B 13 00 00 00 8D 89 FB FF FF FF 60 66 F7 D3 8D 89 FD FF FF FF 8D 89 03 00 00 00 66 F7 D3 61 8D 89 05 00 00 00 66 53 8D AD F5 FF FF FF 8A FF 8D AD 0B 00 00 00 66 5B }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Keypress1212_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? E8 ?? ?? E8 ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EA ?? ?? ?? ?? 1E 33 DB 8E DB BB }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Keypress1212_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E8 ?? ?? E8 ?? ?? E8 ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? EA ?? ?? ?? ?? 1E 33 DB 8E DB BB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: WIBU_Key_V410A_WIBU_SYSTEMS_AG_Sign_by_fly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { F7 05 ?? ?? ?? ?? FF 00 00 00 75 12 }

Detection condition:
$a at pe.entry_point

Full rule:
rule WIBU_Key_V410A_WIBU_SYSTEMS_AG_Sign_by_fly: PEiD
{
    strings:
        $a = { F7 05 ?? ?? ?? ?? FF 00 00 00 75 12 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_Microsoft_Visual_Cue_50p_MFC
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_Microsoft_Visual_Cue_50p_MFC: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: GHF_Protector_GPcH_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 A0 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 }

Detection condition:
$a at pe.entry_point

Full rule:
rule GHF_Protector_GPcH_additional: PEiD
{
    strings:
        $a = { 60 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? FF 10 68 ?? ?? ?? ?? 50 B8 ?? ?? ?? ?? FF 10 68 00 A0 00 00 6A 40 FF D0 89 05 ?? ?? ?? ?? 89 C7 BE ?? ?? ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_120_Eng_dulekxt_Borland_Cpp
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE }
        $b = { C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule FSG_120_Eng_dulekxt_Borland_Cpp: PEiD
{
    strings:
        $a = { 03 DE EB 01 F8 B8 80 ?? 42 00 EB 02 CD 20 68 17 A0 B3 AB EB 01 E8 59 0F B6 DB 68 0B A1 B3 AB EB 02 CD 20 5E 80 CB AA 2B F1 EB 02 CD 20 43 0F BE 38 13 D6 80 C3 47 2B FE EB 01 F4 03 FE EB 02 4F 4E 81 EF 93 53 7C 3C 80 C3 29 81 F7 8A 8F 67 8B 80 C3 C7 2B FE }
        $b = { C1 F0 07 EB 02 CD 20 BE 80 ?? ?? 00 1B C6 8D 1D F4 00 00 00 0F B6 06 EB 02 CD 20 8A 16 0F B6 C3 E8 01 00 00 00 DC 59 80 EA 37 EB 02 CD 20 2A D3 EB 02 CD 20 80 EA 73 1B CF 32 D3 C1 C8 0E 80 EA 23 0F B6 C9 02 D3 EB 01 B5 02 D3 EB 02 DB 5B 81 C2 F6 56 7B F6 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Exe_Locker_V10_IonIce
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Exe_Locker_V10_IonIce: PEiD
{
    strings:
        $a = { E8 00 00 00 00 60 8B 6C 24 20 81 ED 05 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_v140b5_v140b6
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 8A 11 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_v140b5_v140b6: PEiD
{
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 ?? 87 DD 8B 85 A6 A0 40 ?? 01 85 03 A0 40 ?? 66 C7 85 ?? A0 40 ?? 90 90 01 85 9E A0 40 ?? BB 8A 11 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Werus_Crypter_10_by_Kas
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BB E8 12 40 00 80 33 05 E9 7D FF FF FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule Werus_Crypter_10_by_Kas: PEiD
{
    strings:
        $a = { BB E8 12 40 00 80 33 05 E9 7D FF FF FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXECryptor_2021_wwwstrongbitcom
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 F4 56 57 53 BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 D0 03 45 F4 8B 18 8B 7E 10 01 D7 03 7D F4 09 DB 0F 84 ?? 00 00 00 F7 C3 00 00 00 80 0F 85 04 00 00 00 8D 5C 13 02 81 E3 FF FF FF ?? 53 FF 75 F8 FF 15 9C ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 07 83 45 F4 04 E9 A6 FF FF FF }
        $b = { 55 8B EC 83 C4 F4 56 57 53 BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule EXECryptor_2021_wwwstrongbitcom: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 F4 56 57 53 BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F 85 03 00 00 00 8B 46 10 01 D0 03 45 F4 8B 18 8B 7E 10 01 D7 03 7D F4 09 DB 0F 84 ?? 00 00 00 F7 C3 00 00 00 80 0F 85 04 00 00 00 8D 5C 13 02 81 E3 FF FF FF ?? 53 FF 75 F8 FF 15 9C ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 07 83 45 F4 04 E9 A6 FF FF FF }
        $b = { 55 8B EC 83 C4 F4 56 57 53 BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: fds0ft_c0m_pr0tect_v04b_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8C CA 2E ?? ?? ?? ?? B4 30 8B ?? ?? ?? 8B ?? ?? ?? 8E DA A3 ?? ?? 8C ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule fds0ft_c0m_pr0tect_v04b_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 8C CA 2E ?? ?? ?? ?? B4 30 8B ?? ?? ?? 8B ?? ?? ?? 8E DA A3 ?? ?? 8C ?? ?? ?? 89 ?? ?? ?? 89 ?? ?? ?? EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Comt_010d_original
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 45 4E 43 2E 43 4F 4D 2E 42 26 46 3D 0D 0A 25 30 30 25 40 40 50 5A 2D 72 6D 2D 72 6D 2D 4C 23 50 5F 52 5E 4E 31 35 52 58 2D 71 6E 2D 71 6E 50 2D 40 21 50 59 2D 21 70 2D 21 60 2D 21 30 50 5D 3D 0D 0A 58 2D 62 21 50 5F 57 52 5E 21 35 47 47 21 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Comt_010d_original: PEiD
{
    strings:
        $a = { 45 4E 43 2E 43 4F 4D 2E 42 26 46 3D 0D 0A 25 30 30 25 40 40 50 5A 2D 72 6D 2D 72 6D 2D 4C 23 50 5F 52 5E 4E 31 35 52 58 2D 71 6E 2D 71 6E 50 2D 40 21 50 59 2D 21 70 2D 21 60 2D 21 30 50 5D 3D 0D 0A 58 2D 62 21 50 5F 57 52 5E 21 35 47 47 21 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASProtect_SKE_2122_dll_Alexey_Solodovnikov
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASProtect_SKE_2122_dll_Alexey_Solodovnikov: PEiD
{
    strings:
        $a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_v133a_dulekxt
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE A8 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_v133a_dulekxt: PEiD
{
    strings:
        $a = { BE A8 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SLR_OPTLINK_1
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 87 C0 EB ?? 71 ?? 02 D8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule SLR_OPTLINK_1: PEiD
{
    strings:
        $a = { 87 C0 EB ?? 71 ?? 02 D8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: StarForce_Protection_Driver_Protection_Technology_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 57 68 ?? 0D 01 00 68 00 ?? ?? 00 E8 50 ?? FF FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule StarForce_Protection_Driver_Protection_Technology_h: PEiD
{
    strings:
        $a = { 57 68 ?? 0D 01 00 68 00 ?? ?? 00 E8 50 ?? FF FF 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 68 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: vfpexeNc_v600_Wang_JianGuo
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 01 00 00 00 63 58 E8 01 00 00 00 7A 58 2D 0D 10 40 00 8D 90 C1 10 40 00 52 50 8D 80 49 10 40 00 5D 50 8D 85 65 10 40 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC }

Detection condition:
$a at pe.entry_point

Full rule:
rule vfpexeNc_v600_Wang_JianGuo: PEiD
{
    strings:
        $a = { 60 E8 01 00 00 00 63 58 E8 01 00 00 00 7A 58 2D 0D 10 40 00 8D 90 C1 10 40 00 52 50 8D 80 49 10 40 00 5D 50 8D 85 65 10 40 00 50 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 CC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPX_v072_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 ?? ?? ?? ?? 83 ?? ?? 31 DB 5E 8D ?? ?? ?? ?? ?? 57 66 ?? ?? ?? ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPX_v072_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 83 ?? ?? 31 DB 5E 8D ?? ?? ?? ?? ?? 57 66 ?? ?? ?? ?? ?? ?? ?? ?? 81 ?? ?? ?? ?? ?? EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_01_PENinja_131_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_01_PENinja_131_Anorganix: PEiD
{
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ExeSafeguard_v10_simonzh_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE }

Detection condition:
$a at pe.entry_point

Full rule:
rule ExeSafeguard_v10_simonzh_additional: PEiD
{
    strings:
        $a = { C0 5D EB 4E EB 47 DF 69 4E 58 DF 59 74 F3 EB 01 DF 75 EE 9A 59 9C 81 C1 E2 FF FF FF EB 01 DF 9D FF E1 E8 51 E8 EB FF FF FF DF 22 3F 9A C0 81 ED 19 18 40 00 EB 48 EB 47 DF 69 4E 58 DF 59 79 EE EB 01 DF 78 E9 DF 59 9C 81 C1 E5 FF FF FF 9D FF E1 EB 51 E8 EE }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EPW_v130
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 06 57 1E 56 55 52 51 53 50 2E 8C 06 08 00 8C C0 83 C0 10 2E }

Detection condition:
$a at pe.entry_point

Full rule:
rule EPW_v130: PEiD
{
    strings:
        $a = { 06 57 1E 56 55 52 51 53 50 2E 8C 06 08 00 8C C0 83 C0 10 2E }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: IMP_Packer_10_Mahdi_Hezavehi_IMPOSTER_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 }
        $b = { 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule IMP_Packer_10_Mahdi_Hezavehi_IMPOSTER_h: PEiD
{
    strings:
        $a = { 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 }
        $b = { 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Obsidium_V1258_V133X_Obsidium_Software
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 01 ?? E8 ?? 00 00 00 EB 02 ?? ?? EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsidium_V1258_V133X_Obsidium_Software: PEiD
{
    strings:
        $a = { EB 01 ?? E8 ?? 00 00 00 EB 02 ?? ?? EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Hafen1641_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? 01 ?? ?? ?? CE CC 25 ?? ?? 25 ?? ?? 25 ?? ?? 40 51 D4 ?? ?? ?? CC 47 CA ?? ?? 46 8A CC 44 88 CC }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Hafen1641_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E8 ?? ?? 01 ?? ?? ?? CE CC 25 ?? ?? 25 ?? ?? 25 ?? ?? 40 51 D4 ?? ?? ?? CC 47 CA ?? ?? 46 8A CC 44 88 CC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ENIGMA_Protector_V11_Sukhov_Vladimir
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 83 ?? ?? 81 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ENIGMA_Protector_V11_Sukhov_Vladimir: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 83 ?? ?? 81 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_v110b2_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_v110b2_additional: PEiD
{
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Installer_VISE_Custom_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 ?? ?? 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D }

Detection condition:
$a at pe.entry_point

Full rule:
rule Installer_VISE_Custom_additional: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? 40 00 68 ?? ?? 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 ?? ?? 40 00 33 D2 8A D4 89 15 ?? ?? 40 00 8B C8 81 E1 FF 00 00 00 89 0D }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Petite_v_after_v14_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? ?? ?? 66 9C 60 50 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 83 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Petite_v_after_v14_additional: PEiD
{
    strings:
        $a = { B8 ?? ?? ?? ?? 66 9C 60 50 8D ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? 83 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPXLock_v11_CyberDoom_Bob_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? 00 60 }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPXLock_v11_CyberDoom_Bob_additional: PEiD
{
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? 00 60 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: DOS32_33
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 0E 1F FC 9C 5B 8B C3 80 F4 40 50 9D 9C 58 3A E7 75 0B BA 87 20 B4 09 CD 21 B4 4C CD 21 8C 06 CA 00 26 A1 2C 00 A3 C8 00 8C 0E 98 00 8C 06 9C 00 8C 06 A0 00 0E 07 33 C0 BF A0 22 B9 A0 51 2B CF D1 E9 F3 AB BA EE 0D 81 EA C4 47 B9 6A 10 BB BF }

Detection condition:
$a at pe.entry_point

Full rule:
rule DOS32_33: PEiD
{
    strings:
        $a = { 0E 1F FC 9C 5B 8B C3 80 F4 40 50 9D 9C 58 3A E7 75 0B BA 87 20 B4 09 CD 21 B4 4C CD 21 8C 06 CA 00 26 A1 2C 00 A3 C8 00 8C 0E 98 00 8C 06 9C 00 8C 06 A0 00 0E 07 33 C0 BF A0 22 B9 A0 51 2B CF D1 E9 F3 AB BA EE 0D 81 EA C4 47 B9 6A 10 BB BF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: aPack_069_COM
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8C C8 05 00 00 8E C0 59 8E D0 51 BE A0 01 BF 00 01 50 57 FC B6 01 BD 81 01 FF D5 73 61 FF D5 73 1C FF D5 73 3F BB 98 01 33 C9 FF D3 FF D3 FF D3 FF D3 8B D9 B1 01 85 DB 75 3A 93 EB 3C E8 4C 00 49 49 75 0A 2E 8B 1E 00 01 E8 40 00 EB 26 49 AC }

Detection condition:
$a at pe.entry_point

Full rule:
rule aPack_069_COM: PEiD
{
    strings:
        $a = { 8C C8 05 00 00 8E C0 59 8E D0 51 BE A0 01 BF 00 01 50 57 FC B6 01 BD 81 01 FF D5 73 61 FF D5 73 1C FF D5 73 3F BB 98 01 33 C9 FF D3 FF D3 FF D3 FF D3 8B D9 B1 01 85 DB 75 3A 93 EB 3C E8 4C 00 49 49 75 0A 2E 8B 1E 00 01 E8 40 00 EB 26 49 AC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: IMPostor_Pack_10_Mahdi_Hezavehi_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE ?? ?? ?? 00 83 C6 01 FF E6 00 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? 02 ?? ?? 00 10 00 00 00 02 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule IMPostor_Pack_10_Mahdi_Hezavehi_additional: PEiD
{
    strings:
        $a = { BE ?? ?? ?? 00 83 C6 01 FF E6 00 00 00 00 ?? ?? 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 ?? 02 ?? ?? 00 10 00 00 00 02 00 }
    condition:
        $a at pe.entry_point

}