deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Vprotect_204110505_CoooLie
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8D BF FF FF FF FF 66 87 F9 60 61 66 87 F9 8D BF 01 00 00 00 F7 D2 9C 9D F7 D2 8B FF 8D AD F6 FF FF FF 66 52 8D 9B F9 FF FF FF F6 D1 66 8B FF F6 D1 8D 9B 07 00 00 00 66 5A 8D AD 0A 00 00 00 8D AD E1 FF FF FF 66 F7 D0 55 F7 D6 8D AD EB FF FF FF 8B FF 8D AD 15 00 00 00 F7 D6 5D 66 F7 D0 8D AD 1F 00 00 00 66 52 66 5A 8B 67 28 8B ED 61 66 57 66 5F 52 5A 9D 66 50 F6 D4 F6 D4 66 58 F6 D1 8D 9B E4 FF FF FF 8D AD E7 FF FF FF 8D 89 EF FF FF FF 55 5D 8D 89 11 00 00 00 8D AD 19 00 00 00 8D 9B 1C 00 00 00 F6 D1 60 8A C9 61 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vprotect_204110505_CoooLie: PEiD
{
    strings:
        $a = { 8D BF FF FF FF FF 66 87 F9 60 61 66 87 F9 8D BF 01 00 00 00 F7 D2 9C 9D F7 D2 8B FF 8D AD F6 FF FF FF 66 52 8D 9B F9 FF FF FF F6 D1 66 8B FF F6 D1 8D 9B 07 00 00 00 66 5A 8D AD 0A 00 00 00 8D AD E1 FF FF FF 66 F7 D0 55 F7 D6 8D AD EB FF FF FF 8B FF 8D AD 15 00 00 00 F7 D6 5D 66 F7 D0 8D AD 1F 00 00 00 66 52 66 5A 8B 67 28 8B ED 61 66 57 66 5F 52 5A 9D 66 50 F6 D4 F6 D4 66 58 F6 D1 8D 9B E4 FF FF FF 8D AD E7 FF FF FF 8D 89 EF FF FF FF 55 5D 8D 89 11 00 00 00 8D AD 19 00 00 00 8D 9B 1C 00 00 00 F6 D1 60 8A C9 61 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RCryptor_v16d_Vaska_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RCryptor_v16d_Vaska_additional: PEiD
{
    strings:
        $a = { 60 90 61 61 80 7F F0 45 90 60 0F 85 1B 8B 1F FF 68 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PGMPACK_v014_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PGMPACK_v014_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 1E 17 50 B4 30 CD 21 3C 02 73 ?? B4 4C CD 21 FC BE ?? ?? BF ?? ?? E8 ?? ?? E8 ?? ?? BB ?? ?? BA ?? ?? 8A C3 8B F3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Borland_Delphi_5_Portions_Copyright_c_198399_Borland_h_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 39 20 42 6F 72 6C 61 6E 64 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Borland_Delphi_5_Portions_Copyright_c_198399_Borland_h_additional: PEiD
{
    strings:
        $a = { 50 6F 72 74 69 6F 6E 73 20 43 6F 70 79 72 69 67 68 74 20 28 63 29 20 31 39 38 33 2C 39 39 20 42 6F 72 6C 61 6E 64 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_v029_Beta_v031_Beta_Sign_by_hot_UNP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE 88 01 ?? ?? AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_v029_Beta_v031_Beta_Sign_by_hot_UNP: PEiD
{
    strings:
        $a = { BE 88 01 ?? ?? AD 8B F8 95 AD 91 F3 A5 AD B5 ?? F3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: DBPE_v233
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 20 40 9C 55 57 56 52 51 53 9C E8 5D 81 }
        $b = { EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule DBPE_v233: PEiD
{
    strings:
        $a = { EB 20 40 9C 55 57 56 52 51 53 9C E8 5D 81 }
        $b = { EB 20 ?? ?? 40 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 9C 55 57 56 52 51 53 9C E8 ?? ?? ?? ?? 5D 81 ED ?? ?? ?? ?? 9C 6A 10 73 0B EB 02 C1 51 E8 06 ?? ?? ?? C4 11 73 F7 5B CD 83 C4 04 EB 02 99 EB FF 0C 24 71 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: VcAsm_Protector_VcAsm_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule VcAsm_Protector_VcAsm_additional: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 E8 03 00 00 00 C7 84 00 58 EB 01 E9 83 C0 07 50 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Exe_Shield_v29_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED 0B 20 40 00 B9 EB 08 00 00 8D BD 53 20 40 00 8B F7 AC ?? ?? ?? F8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Exe_Shield_v29_additional: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 0B 20 40 00 B9 EB 08 00 00 8D BD 53 20 40 00 8B F7 AC ?? ?? ?? F8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MSLRH_032a_fake_ASPack_212_emadicius_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MSLRH_032a_fake_ASPack_212_emadicius_additional: PEiD
{
    strings:
        $a = { 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Sentinel_Keys_ShellClient_Library_V1211_SafeNet_Inc_20090524
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC A1 ?? ?? ?? ?? 53 56 57 85 C0 0F 85 A3 18 00 00 A1 ?? ?? ?? ?? 33 FF BB 01 00 00 00 3B C7 89 1D ?? ?? ?? ?? 0F 85 6C 07 00 00 75 03 74 01 ?? 83 EC 08 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 81 7C 24 3C 7C 03 7D 01 E8 9B 83 FF FF 7E 03 7F 01 ?? 89 1D ?? ?? ?? ?? 72 03 73 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 7C 24 28 75 03 74 01 A1 ?? ?? ?? ?? 25 07 00 00 80 79 05 48 83 C8 F8 40 A3 ?? ?? ?? ?? 7C 03 7D 01 ?? 39 3D ?? ?? ?? ?? 74 17 75 03 74 01 ?? 8B 0D ?? ?? ?? ?? A1 ?? ?? ?? ?? 2B C1 A3 ?? ?? ?? ?? 75 03 74 01 ?? FF 15 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Sentinel_Keys_ShellClient_Library_V1211_SafeNet_Inc_20090524: PEiD
{
    strings:
        $a = { 55 8B EC A1 ?? ?? ?? ?? 53 56 57 85 C0 0F 85 A3 18 00 00 A1 ?? ?? ?? ?? 33 FF BB 01 00 00 00 3B C7 89 1D ?? ?? ?? ?? 0F 85 6C 07 00 00 75 03 74 01 ?? 83 EC 08 68 ?? ?? ?? ?? 64 FF 35 00 00 00 00 64 89 25 00 00 00 00 81 7C 24 3C 7C 03 7D 01 E8 9B 83 FF FF 7E 03 7F 01 ?? 89 1D ?? ?? ?? ?? 72 03 73 01 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 81 7C 24 28 75 03 74 01 A1 ?? ?? ?? ?? 25 07 00 00 80 79 05 48 83 C8 F8 40 A3 ?? ?? ?? ?? 7C 03 7D 01 ?? 39 3D ?? ?? ?? ?? 74 17 75 03 74 01 ?? 8B 0D ?? ?? ?? ?? A1 ?? ?? ?? ?? 2B C1 A3 ?? ?? ?? ?? 75 03 74 01 ?? FF 15 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: WWPACK_v305c4_Extractable_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 03 05 00 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule WWPACK_v305c4_Extractable_additional: PEiD
{
    strings:
        $a = { 03 05 00 1A B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PC_Guard_303_305_Blagoje_Ceklic
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PC_Guard_303_305_Blagoje_Ceklic: PEiD
{
    strings:
        $a = { 55 50 E8 00 00 00 00 5D EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_Visual_C_20_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 64 A1 00 00 00 00 55 8B EC 6A FF 68 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_Visual_C_20_additional: PEiD
{
    strings:
        $a = { 64 A1 00 00 00 00 55 8B EC 6A FF 68 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: D1S1G_v11_Beta_pp_Scrambled_EXE_D1N_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 07 00 00 00 E8 1E 00 00 00 C3 90 58 89 C2 89 C2 25 00 F0 FF FF 50 83 C0 55 8D 00 FF 30 8D 40 04 FF 30 52 C3 8D 40 00 55 8B EC 83 C4 E8 53 56 57 8B 4D 10 8B 45 08 89 45 F8 8B 45 0C 89 45 F4 8D 41 61 8B 38 8D 41 65 8B 00 03 C7 89 45 FC 8D 41 69 8B 00 03 }

Detection condition:
$a at pe.entry_point

Full rule:
rule D1S1G_v11_Beta_pp_Scrambled_EXE_D1N_additional: PEiD
{
    strings:
        $a = { E8 07 00 00 00 E8 1E 00 00 00 C3 90 58 89 C2 89 C2 25 00 F0 FF FF 50 83 C0 55 8D 00 FF 30 8D 40 04 FF 30 52 C3 8D 40 00 55 8B EC 83 C4 E8 53 56 57 8B 4D 10 8B 45 08 89 45 F8 8B 45 0C 89 45 F4 8D 41 61 8B 38 8D 41 65 8B 00 03 C7 89 45 FC 8D 41 69 8B 00 03 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EncryptPE_V22004616_V22006630_WFS_SignByfly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 9C 64 FF 35 00 00 00 00 E8 7A 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EncryptPE_V22004616_V22006630_WFS_SignByfly: PEiD
{
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 00 E8 7A 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 53 79 73 74 65 6D 44 69 72 65 63 74 6F 72 79 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_440_Silicon_Realms_Toolworks_h_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 30 31 2E 30 31 00 00 04 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_440_Silicon_Realms_Toolworks_h_additional: PEiD
{
    strings:
        $a = { 30 31 2E 30 31 00 00 04 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXECryptor_V22X_softcompletecom_
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXECryptor_V22X_softcompletecom_: PEiD
{
    strings:
        $a = { FF E0 E8 04 00 00 00 FF FF FF FF 5E C3 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: unknown_jac
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 B9 00 80 00 00 BA ?? ?? ?? ?? B8 ?? ?? ?? ?? 05 ?? ?? ?? ?? 31 C2 66 01 C2 C1 C2 07 E2 F1 50 E8 91 FF FF FF C9 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule unknown_jac: PEiD
{
    strings:
        $a = { 55 89 E5 B9 00 80 00 00 BA ?? ?? ?? ?? B8 ?? ?? ?? ?? 05 ?? ?? ?? ?? 31 C2 66 01 C2 C1 C2 07 E2 F1 50 E8 91 FF FF FF C9 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PS_AdobeFont_v10_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 80 01 ?? ?? 00 00 25 21 50 53 2D 41 64 6F 62 65 46 6F 6E 74 2D 31 2E 30 3A }

Detection condition:
$a at pe.entry_point

Full rule:
rule PS_AdobeFont_v10_additional: PEiD
{
    strings:
        $a = { 80 01 ?? ?? 00 00 25 21 50 53 2D 41 64 6F 62 65 46 6F 6E 74 2D 31 2E 30 3A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Sonik_Youth
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8A 16 02 00 8A 07 32 C2 88 07 43 FE C2 81 FB }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Sonik_Youth: PEiD
{
    strings:
        $a = { 8A 16 02 00 8A 07 32 C2 88 07 43 FE C2 81 FB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXE_Shield_V06_SMoKE_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXE_Shield_V06_SMoKE_additional: PEiD
{
    strings:
        $a = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D 81 ED D4 1A 40 00 EB 01 00 8D B5 5E 1B 40 00 BA A1 0B 00 00 EB 01 00 8D 8D FF 26 40 00 8B 09 E8 14 00 00 00 83 EB 01 00 8B FE E8 00 00 00 00 58 83 C0 07 50 C3 00 EB 04 58 40 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AHpack_01_FEUERRADER
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 }

Detection condition:
$a at pe.entry_point

Full rule:
rule AHpack_01_FEUERRADER: PEiD
{
    strings:
        $a = { 60 68 54 ?? ?? ?? B8 48 ?? ?? ?? FF 10 68 B3 ?? ?? ?? 50 B8 44 ?? ?? ?? FF 10 68 00 ?? ?? ?? 6A 40 FF D0 89 05 CA ?? ?? ?? 89 C7 BE 00 10 ?? ?? 60 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PESpin_V11_cyberbobnbsp_nbsp_SignByfly_20080311
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 ?? 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 00 EB FB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02 ?? ?? F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 ?? ?? ?? ?? ?? ?? F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 ?? EB FB }

Detection condition:
$a at pe.entry_point

Full rule:
rule PESpin_V11_cyberbobnbsp_nbsp_SignByfly_20080311: PEiD
{
    strings:
        $a = { EB 01 ?? 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 ?? 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 ?? ?? ?? ?? ?? 5D 33 C9 41 E2 17 EB 07 ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 ?? 5A 83 EA 0B FF E2 EB 04 ?? EB 04 00 EB FB ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? EB 02 ?? ?? F9 72 08 73 0E F9 83 04 24 17 C3 E8 04 00 00 00 0F F5 73 11 EB 06 ?? ?? ?? ?? ?? ?? F5 72 0E F5 72 F8 68 EB EC 83 04 24 07 F5 FF 34 24 C3 41 C1 E1 07 8B 0C 01 03 CA E8 03 00 00 00 EB 04 ?? EB FB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: DZA_Patcher_v13_DZA
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 08 35 48 34 30 4C 31 4E 00 60 E8 00 00 00 00 5D 8B D5 81 ED 44 73 40 00 2B 95 74 74 40 00 83 EA 10 89 95 70 74 40 00 8B 44 24 20 25 00 00 FF FF 80 38 4D 74 07 2D 00 00 01 00 EB F4 93 89 85 7C 74 40 00 8D BD 8C 74 40 00 E8 83 00 00 00 89 85 80 74 40 00 }
        $b = { BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35 }
        $c = { EB 08 35 48 34 30 4C 31 4E 00 60 E8 00 00 00 00 5D 8B D5 81 ED 44 73 40 00 2B 95 74 74 40 00 83 EA 10 89 95 70 74 40 00 8B 44 24 20 25 00 00 FF FF 80 38 4D 74 07 2D 00 00 01 00 EB F4 93 89 85 7C 74 40 00 8D BD 8C 74 40 00 E8 83 00 00 00 89 85 80 74 40 00 8D BD A4 74 40 00 E8 72 00 00 00 89 85 84 74 40 00 8D BD F0 73 40 00 57 FF D0 8D BD 99 74 40 00 E8 58 00 00 00 89 85 88 74 40 00 8B 85 78 74 40 00 03 85 70 74 40 00 99 8D 8D 6C 74 40 00 51 52 52

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule DZA_Patcher_v13_DZA: PEiD
{
    strings:
        $a = { EB 08 35 48 34 30 4C 31 4E 00 60 E8 00 00 00 00 5D 8B D5 81 ED 44 73 40 00 2B 95 74 74 40 00 83 EA 10 89 95 70 74 40 00 8B 44 24 20 25 00 00 FF FF 80 38 4D 74 07 2D 00 00 01 00 EB F4 93 89 85 7C 74 40 00 8D BD 8C 74 40 00 E8 83 00 00 00 89 85 80 74 40 00 }
        $b = { BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35 }
        $c = { EB 08 35 48 34 30 4C 31 4E 00 60 E8 00 00 00 00 5D 8B D5 81 ED 44 73 40 00 2B 95 74 74 40 00 83 EA 10 89 95 70 74 40 00 8B 44 24 20 25 00 00 FF FF 80 38 4D 74 07 2D 00 00 01 00 EB F4 93 89 85 7C 74 40 00 8D BD 8C 74 40 00 E8 83 00 00 00 89 85 80 74 40 00 8D BD A4 74 40 00 E8 72 00 00 00 89 85 84 74 40 00 8D BD F0 73 40 00 57 FF D0 8D BD 99 74 40 00 E8 58 00 00 00 89 85 88 74 40 00 8B 85 78 74 40 00 03 85 70 74 40 00 99 8D 8D 6C 74 40 00 51 52 52 50 52 52 FF 95 80 74 40 00 8D BD C0 74 40 00 8B 0F E3 13 8A 5F 05 8A 01 3A C3 75 FA 8A 57 04 88 11 83 C7 06 EB E9 E8 00 00 00 00 5D 81 ED F5 73 40 00 6A 00 FF 95 88 74 40 00 61 C3 8B D3 0F B7 43 3C 03 D8 8B 5B 78 03 DA 0B FF 74 40 8B 73 20 03 F2 8B 4B 18 53 33 DB AD 03 C2 56 57 87 FE 97 AC 0A C0 75 07 80 3F 00 74 0B }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Private_EXE_v20a_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 53 E8 ?? ?? ?? ?? 5B 8B C3 2D }

Detection condition:
$a at pe.entry_point

Full rule:
rule Private_EXE_v20a_additional: PEiD
{
    strings:
        $a = { 53 E8 ?? ?? ?? ?? 5B 8B C3 2D }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Wise_Installer_Stub
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 81 EC 78 05 00 00 53 56 BE 04 01 00 00 57 8D 85 94 FD FF FF 56 33 DB 50 53 FF 15 34 20 40 00 8D 85 94 FD FF FF 56 50 8D 85 94 FD FF FF 50 FF 15 30 20 40 00 8B 3D 2C 20 40 00 53 53 6A 03 53 6A 01 8D 85 94 FD FF FF 68 00 00 00 80 50 FF D7 83 F8 FF }
        $b = { 55 8B EC 81 EC ?? ?? 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 ?? 40 40 00 FF 15 ?? 40 40 00 8B F8 89 7D ?? 8A 07 3C 22 0F 85 ?? 00 00 00 8A 47 01 47 89 7D ?? 33 DB 3A C3 74 0D 3C 22 74 09 8A 47 01 47 89 7D ?? EB EF 80 3F 22 75 04 47 89 7D ?? 80 3F 20 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Wise_Installer_Stub: PEiD
{
    strings:
        $a = { 55 8B EC 81 EC 78 05 00 00 53 56 BE 04 01 00 00 57 8D 85 94 FD FF FF 56 33 DB 50 53 FF 15 34 20 40 00 8D 85 94 FD FF FF 56 50 8D 85 94 FD FF FF 50 FF 15 30 20 40 00 8B 3D 2C 20 40 00 53 53 6A 03 53 6A 01 8D 85 94 FD FF FF 68 00 00 00 80 50 FF D7 83 F8 FF }
        $b = { 55 8B EC 81 EC ?? ?? 00 00 53 56 57 6A 01 5E 6A 04 89 75 E8 FF 15 ?? 40 40 00 FF 15 ?? 40 40 00 8B F8 89 7D ?? 8A 07 3C 22 0F 85 ?? 00 00 00 8A 47 01 47 89 7D ?? 33 DB 3A C3 74 0D 3C 22 74 09 8A 47 01 47 89 7D ?? EB EF 80 3F 22 75 04 47 89 7D ?? 80 3F 20 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: RLPack_V118_aPlib_043_ap0x
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RLPack_V118_aPlib_043_ap0x: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 ?? 8D B5 1A 04 00 00 8D 9D C1 02 00 00 33 FF E8 61 01 00 00 EB 0F FF 74 37 04 FF 34 37 FF D3 83 C4 ?? 83 C7 ?? 83 3C 37 00 75 EB 83 BD 06 04 00 00 00 74 0E 83 BD 0A 04 00 00 00 74 05 E8 D7 01 00 00 8D 74 37 04 53 6A ?? 68 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPX_com_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B9 ?? ?? BE ?? ?? BF C0 FF FD }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPX_com_Hint_DOS_EP: PEiD
{
    strings:
        $a = { B9 ?? ?? BE ?? ?? BF C0 FF FD }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_KBDflags1024
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B EC 2E 89 2E 24 03 BC 00 04 8C D5 2E 89 2E 22 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_KBDflags1024: PEiD
{
    strings:
        $a = { 8B EC 2E 89 2E 24 03 BC 00 04 8C D5 2E 89 2E 22 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ENIGMA_Protector_Sukhov_Vladimir
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 45 6E 69 67 6D 61 20 70 72 6F 74 65 63 74 6F 72 20 76 31 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ENIGMA_Protector_Sukhov_Vladimir: PEiD
{
    strings:
        $a = { 45 6E 69 67 6D 61 20 70 72 6F 74 65 63 74 6F 72 20 76 31 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PE_Crypt_10
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB 03 FF CD 20 56 57 55 89 A3 10 20 00 00 8B EB 80 BB BF 1F 00 00 01 0F 84 AB 17 00 00 C6 83 BF 1F 00 00 01 80 BB E6 1F 00 00 00 75 26 8B 83 CC 1F 00 00 53 2B D8 EB 02 CD 20 EB 03 FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule PE_Crypt_10: PEiD
{
    strings:
        $a = { E8 00 00 00 00 5B 83 EB 05 EB 04 52 4E 44 21 EB 02 CD 20 EB 03 FF CD 20 56 57 55 89 A3 10 20 00 00 8B EB 80 BB BF 1F 00 00 01 0F 84 AB 17 00 00 C6 83 BF 1F 00 00 01 80 BB E6 1F 00 00 00 75 26 8B 83 CC 1F 00 00 53 2B D8 EB 02 CD 20 EB 03 FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PKLITE_v112_v115_v120_1_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 73 ?? 2D ?? ?? FA 8E D0 FB 2D ?? ?? 8E C0 50 B9 ?? ?? 33 FF 57 BE ?? ?? FC F3 A5 CB B4 09 BA ?? ?? CD 21 CD 20 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PKLITE_v112_v115_v120_1_additional: PEiD
{
    strings:
        $a = { B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 ?? ?? 73 ?? 2D ?? ?? FA 8E D0 FB 2D ?? ?? 8E C0 50 B9 ?? ?? 33 FF 57 BE ?? ?? FC F3 A5 CB B4 09 BA ?? ?? CD 21 CD 20 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: DIET_v144_v145f
Repository: Yara-Rules/rules

Pattern signatures:
$a = { F8 9C 06 1E 57 56 52 51 53 50 0E FC 8C C8 BA ?? ?? 03 D0 52 }

Detection condition:
$a at pe.entry_point

Full rule:
rule DIET_v144_v145f: PEiD
{
    strings:
        $a = { F8 9C 06 1E 57 56 52 51 53 50 0E FC 8C C8 BA ?? ?? 03 D0 52 }
    condition:
        $a at pe.entry_point

}