deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Private_exe_Protector_V25X_V26X_SetiSoft_Team_SignByfly_20080116
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Private_exe_Protector_V25X_V26X_SetiSoft_Team_SignByfly_20080116: PEiD
{
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 10 00 00 ?? ?? ?? ?? 00 04 00 00 00 00 00 00 00 00 00 00 00 00 00 00 20 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 04 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 40 00 00 C0 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_Microsoft_Visual_Cpp_620_Anorganix_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 55 8B EC 83 EC 50 53 56 57 BE 90 90 90 90 8D 7D F4 A5 A5 66 A5 8B }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_Microsoft_Visual_Cpp_620_Anorganix_additional: PEiD
{
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 55 8B EC 83 EC 50 53 56 57 BE 90 90 90 90 8D 7D F4 A5 A5 66 A5 8B }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_LCC_Win32_DLL_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 ?? ?? ?? ?? E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_LCC_Win32_DLL_Anorganix: PEiD
{
    strings:
        $a = { 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 ?? ?? ?? ?? E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Thinstall_Embedded_V2422_V2428_Jitit_Sign_by_fly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D 9B 1A 00 00 B9 84 1A 00 00 BA 14 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD E0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Thinstall_Embedded_V2422_V2428_Jitit_Sign_by_fly: PEiD
{
    strings:
        $a = { 55 8B EC B8 ?? ?? ?? ?? BB ?? ?? ?? ?? 50 E8 00 00 00 00 58 2D 9B 1A 00 00 B9 84 1A 00 00 BA 14 1B 00 00 BE 00 10 00 00 BF B0 53 00 00 BD E0 1A 00 00 03 E8 81 75 00 ?? ?? ?? ?? 81 75 04 ?? ?? ?? ?? 81 75 08 ?? ?? ?? ?? 81 75 0C ?? ?? ?? ?? 81 75 10 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Private_exe_Protector_V20_SetiSoft_Team
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Private_exe_Protector_V20_SetiSoft_Team: PEiD
{
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C 00 ?? ?? ?? ?? 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CorelPhotoPaint_Image_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 43 50 54 37 46 49 4C 45 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CorelPhotoPaint_Image_Hint_FILE_START: PEiD
{
    strings:
        $a = { 43 50 54 37 46 49 4C 45 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PC_Shrinker_v020_Virogen
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 E8 01 00 00 60 01 AD B3 27 40 00 68 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PC_Shrinker_v020_Virogen: PEiD
{
    strings:
        $a = { E8 E8 01 00 00 60 01 AD B3 27 40 00 68 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MSLRH_v032a_fake_BJFNT_13_emadicius
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 EB 02 C7 05 EB 02 CD 20 E8 03 00 00 00 E9 EB 04 58 40 50 C3 61 9D 1F EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MSLRH_v032a_fake_BJFNT_13_emadicius: PEiD
{
    strings:
        $a = { EB 03 3A 4D 3A 1E EB 02 CD 20 9C EB 02 CD 20 EB 02 CD 20 60 EB 02 C7 05 EB 02 CD 20 E8 03 00 00 00 E9 EB 04 58 40 50 C3 61 9D 1F EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 2B 04 24 74 04 75 02 EB 02 EB 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SmartE_Microsoft_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 15 03 00 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 8F 07 00 00 89 85 83 07 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 2F 06 00 00 E8 8E 04 00 00 49 0F 88 23 06 }

Detection condition:
$a at pe.entry_point

Full rule:
rule SmartE_Microsoft_additional: PEiD
{
    strings:
        $a = { EB 15 03 00 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 68 00 00 00 00 55 E8 00 00 00 00 5D 81 ED 1D 00 00 00 8B C5 55 60 9C 2B 85 8F 07 00 00 89 85 83 07 00 00 FF 74 24 2C E8 BB 01 00 00 0F 82 2F 06 00 00 E8 8E 04 00 00 49 0F 88 23 06 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Adys_Glue_110_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 2E ?? ?? ?? ?? 0E 1F BF ?? ?? 33 DB 33 C0 AC }

Detection condition:
$a at pe.entry_point

Full rule:
rule Adys_Glue_110_additional: PEiD
{
    strings:
        $a = { 2E ?? ?? ?? ?? 0E 1F BF ?? ?? 33 DB 33 C0 AC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: HACKSTOP_v117_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FA BE ?? ?? 05 0C 00 07 1D 4A 46 1E 16 FD AC 44 ?? ?? ?? ?? F1 6D 84 D3 3D ?? ?? CF AF FB 34 DB 33 ?? ?? ?? ?? ?? D0 D6 ?? ?? 92 B4 24 9E }

Detection condition:
$a at pe.entry_point

Full rule:
rule HACKSTOP_v117_Hint_DOS_EP: PEiD
{
    strings:
        $a = { FA BE ?? ?? 05 0C 00 07 1D 4A 46 1E 16 FD AC 44 ?? ?? ?? ?? F1 6D 84 D3 3D ?? ?? CF AF FB 34 DB 33 ?? ?? ?? ?? ?? D0 D6 ?? ?? 92 B4 24 9E }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_022_023_Dwing
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 6A 07 BE 88 01 40 00 AD }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_022_023_Dwing: PEiD
{
    strings:
        $a = { 6A 07 BE 88 01 40 00 AD }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_UPX_06_Anorganix_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_UPX_06_Anorganix_additional: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: eXPressor_v13_CGSoftLabs_
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 45 78 50 72 2D 76 2E 31 2E 33 2E }

Detection condition:
$a at pe.entry_point

Full rule:
rule eXPressor_v13_CGSoftLabs_: PEiD
{
    strings:
        $a = { 45 78 50 72 2D 76 2E 31 2E 33 2E }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RLPack_Ap0x_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 0C 00 00 EB 03 0C 00 00 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 47 02 00 00 EB 03 15 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 9B 0A }

Detection condition:
$a at pe.entry_point

Full rule:
rule RLPack_Ap0x_additional: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 EB 03 0C 00 00 EB 03 0C 00 00 8D B5 CB 22 00 00 8D 9D F0 02 00 00 33 FF E8 47 02 00 00 EB 03 15 00 00 6A 40 68 00 10 00 00 68 00 20 0C 00 6A 00 FF 95 9B 0A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_500_Silicon_Realms_Toolworks
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 48 11 00 00 59 89 7D FC FF 75 08 E8 01 49 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 66 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 AF F9 FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 EE 0F 00 00 59 C3 }
        $b = { E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 0

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Armadillo_500_Silicon_Realms_Toolworks: PEiD
{
    strings:
        $a = { E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 08 3B F7 75 03 33 F6 46 33 DB 89 5D E4 83 FE E0 77 69 83 3D ?? ?? ?? ?? 03 75 4B 83 C6 0F 83 E6 F0 89 75 0C 8B 45 08 3B 05 ?? ?? ?? ?? 77 37 6A 04 E8 48 11 00 00 59 89 7D FC FF 75 08 E8 01 49 00 00 59 89 45 E4 C7 45 FC FE FF FF FF E8 5F 00 00 00 8B 5D E4 3B DF 74 11 FF 75 08 57 53 E8 66 D3 FF FF 83 C4 0C 3B DF 75 61 56 6A 08 FF 35 ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8B D8 3B DF 75 4C 39 3D ?? ?? ?? ?? 74 33 56 E8 AF F9 FF FF 59 85 C0 0F 85 72 FF FF FF 8B 45 10 3B C7 0F 84 50 FF FF FF C7 00 0C 00 00 00 E9 45 FF FF FF 33 FF 8B 75 0C 6A 04 E8 EE 0F 00 00 59 C3 }
        $b = { E8 E3 40 00 00 E9 16 FE FF FF 6A 0C 68 ?? ?? ?? ?? E8 44 15 00 00 8B 4D 08 33 FF 3B CF 76 2E 6A E0 58 33 D2 F7 F1 3B 45 0C 1B C0 40 75 1F E8 36 13 00 00 C7 00 0C 00 00 00 57 57 57 57 57 E8 C7 12 00 00 83 C4 14 33 C0 E9 D5 00 00 00 0F AF 4D 0C 8B F1 89 75 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: RLPack_Full_Edition_117_DLL_Ap0x_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RLPack_Full_Edition_117_DLL_Ap0x_additional: PEiD
{
    strings:
        $a = { 80 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 E8 00 00 00 00 8B 2C 24 83 C4 04 8D B5 ?? ?? ?? ?? 8D 9D ?? ?? ?? ?? 33 FF E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXERefactor_V01_random_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 81 EC 90 0B 00 00 53 56 57 E9 58 8C 01 00 55 53 43 41 54 49 4F 4E }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXERefactor_V01_random_additional: PEiD
{
    strings:
        $a = { 55 8B EC 81 EC 90 0B 00 00 53 56 57 E9 58 8C 01 00 55 53 43 41 54 49 4F 4E }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Alloy_v1x2000_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95 46 23 40 ?? 0B }

Detection condition:
$a at pe.entry_point

Full rule:
rule Alloy_v1x2000_additional: PEiD
{
    strings:
        $a = { 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 07 20 40 ?? 87 DD 6A 04 68 ?? 10 ?? ?? 68 ?? 02 ?? ?? 6A ?? FF 95 46 23 40 ?? 0B }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ANDpakk2_apk2_V006_Dmitry_AND_Andreev_20080731
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 FC BE ?? ?? ?? ?? BF ?? ?? ?? ?? 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD ?? ?? ?? ?? 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ANDpakk2_apk2_V006_Dmitry_AND_Andreev_20080731: PEiD
{
    strings:
        $a = { 60 FC BE ?? ?? ?? ?? BF ?? ?? ?? ?? 57 83 CD FF 33 C9 F9 EB 05 A4 02 DB 75 05 8A 1E 46 12 DB 72 F4 33 C0 40 02 DB 75 05 8A 1E 46 12 DB 13 C0 02 DB 75 05 8A 1E 46 12 DB 72 0E 48 02 DB 75 05 8A 1E 46 12 DB 13 C0 EB DC 83 E8 03 72 0F C1 E0 08 AC 83 F0 FF 74 4D D1 F8 8B E8 EB 09 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 13 C9 75 1A 41 02 DB 75 05 8A 1E 46 12 DB 13 C9 02 DB 75 05 8A 1E 46 12 DB 73 EA 83 C1 02 81 FD ?? ?? ?? ?? 83 D1 01 56 8D 34 2F F3 A4 5E E9 73 FF FF FF C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: TPACK_v17_Archive_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 54 50 41 43 ?? 31 2E 37 }

Detection condition:
$a at pe.entry_point

Full rule:
rule TPACK_v17_Archive_Hint_FILE_START: PEiD
{
    strings:
        $a = { 54 50 41 43 ?? 31 2E 37 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_v14xp
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_v14xp: PEiD
{
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: NFO_v10_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8D 50 12 2B C9 B1 1E 8A 02 34 77 88 02 42 E2 F7 C8 8C }

Detection condition:
$a at pe.entry_point

Full rule:
rule NFO_v10_additional: PEiD
{
    strings:
        $a = { 8D 50 12 2B C9 B1 1E 8A 02 34 77 88 02 42 E2 F7 C8 8C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Borland_Pascal_v70_Protected_Mode_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? BB ?? ?? 8E D0 8B E3 8C D8 8E C0 0E 1F A1 ?? ?? 25 ?? ?? A3 ?? ?? E8 ?? ?? 83 3E ?? ?? ?? 75 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Borland_Pascal_v70_Protected_Mode_additional: PEiD
{
    strings:
        $a = { B8 ?? ?? BB ?? ?? 8E D0 8B E3 8C D8 8E C0 0E 1F A1 ?? ?? 25 ?? ?? A3 ?? ?? E8 ?? ?? 83 3E ?? ?? ?? 75 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: LX_Exe_Executable_Image_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 4C 58 }

Detection condition:
$a at pe.entry_point

Full rule:
rule LX_Exe_Executable_Image_Hint_FILE_START: PEiD
{
    strings:
        $a = { 4C 58 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Obsidium_v1304_Obsidium_Software_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 }
        $b = { EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 ?? 8B 00 EB 01 ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 01 ?? E8 3B 26 00 00 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Obsidium_v1304_Obsidium_Software_h: PEiD
{
    strings:
        $a = { EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 }
        $b = { EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 01 ?? 33 C0 EB 01 ?? 8B 00 EB 01 ?? C3 EB 02 ?? ?? E9 FA 00 00 00 EB 02 ?? ?? E8 D5 FF FF FF EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 58 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 03 ?? ?? ?? 83 C4 04 EB 01 ?? E8 3B 26 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: COM2TXT_100
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 54 58 50 50 50 2D 68 68 2D 67 67 2D 63 30 50 5F 58 33 45 30 5F 5F 35 4F 31 35 30 30 50 5F 2D 78 73 2C 67 31 45 68 35 33 31 35 78 6D 50 2D 3A 70 35 50 65 50 75 0D 0A 00 00 00 00 00 00 00 00 00 00 00 00 2D 68 38 35 38 4F 50 35 36 31 2D 30 70 }

Detection condition:
$a at pe.entry_point

Full rule:
rule COM2TXT_100: PEiD
{
    strings:
        $a = { 54 58 50 50 50 2D 68 68 2D 67 67 2D 63 30 50 5F 58 33 45 30 5F 5F 35 4F 31 35 30 30 50 5F 2D 78 73 2C 67 31 45 68 35 33 31 35 78 6D 50 2D 3A 70 35 50 65 50 75 0D 0A 00 00 00 00 00 00 00 00 00 00 00 00 2D 68 38 35 38 4F 50 35 36 31 2D 30 70 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_v3xx
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_v3xx: PEiD
{
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FreeJoiner_Small_build_017_GlOFF_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 F0 86 FF 86 DB 86 FF 68 00 01 00 00 68 18 20 40 00 6A 00 E8 FF 01 00 00 8A E4 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 18 20 40 00 E8 D5 01 00 00 A3 00 20 40 00 40 0F 84 97 01 00 00 8A E4 6A 02 6A 00 6A FB FF 35 00 20 40 00 E8 E0 01 00 00 86 FF 86 DB 86 FF 6A 00 8D 45 FC 50 6A 04 8D 45 F8 50 FF 35 00 20 40 00 E8 BD 01 00 00 8A E4 6A 00 8D 45 FC 50 6A 01 8D 45 F3 50 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FreeJoiner_Small_build_017_GlOFF_additional: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 F0 86 FF 86 DB 86 FF 68 00 01 00 00 68 18 20 40 00 6A 00 E8 FF 01 00 00 8A E4 6A 00 68 80 00 00 00 6A 03 6A 00 6A 00 68 00 00 00 80 68 18 20 40 00 E8 D5 01 00 00 A3 00 20 40 00 40 0F 84 97 01 00 00 8A E4 6A 02 6A 00 6A FB FF 35 00 20 40 00 E8 E0 01 00 00 86 FF 86 DB 86 FF 6A 00 8D 45 FC 50 6A 04 8D 45 F8 50 FF 35 00 20 40 00 E8 BD 01 00 00 8A E4 6A 00 8D 45 FC 50 6A 01 8D 45 F3 50 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SCRAMB_120
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 00 00 5B 0E 1F 81 EB 50 02 8B C3 05 69 02 50 8B C8 03 D1 2B FA C3 56 34 00 D4 23 8B C3 05 00 02 89 87 93 04 8C 9F 95 04 33 C0 8E C0 8B D3 81 C2 86 02 B9 06 00 BE 04 00 26 8B 04 50 83 C6 02 83 F9 01 76 08 52 49 C3 43 76 88 99 11 26 A1 6C }

Detection condition:
$a at pe.entry_point

Full rule:
rule SCRAMB_120: PEiD
{
    strings:
        $a = { E8 00 00 5B 0E 1F 81 EB 50 02 8B C3 05 69 02 50 8B C8 03 D1 2B FA C3 56 34 00 D4 23 8B C3 05 00 02 89 87 93 04 8C 9F 95 04 33 C0 8E C0 8B D3 81 C2 86 02 B9 06 00 BE 04 00 26 8B 04 50 83 C6 02 83 F9 01 76 08 52 49 C3 43 76 88 99 11 26 A1 6C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RLPack_Full_Edition_117_iBox_LZMA
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 67 30 00 00 8D 9D 66 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A }

Detection condition:
$a at pe.entry_point

Full rule:
rule RLPack_Full_Edition_117_iBox_LZMA: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 8D B5 67 30 00 00 8D 9D 66 03 00 00 33 FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 6A 40 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 6A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: DBPE_v153_Ding_Boy
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 55 57 56 52 51 53 9C FA E8 ?? ?? ?? ?? 5D 81 ED 5B 53 40 ?? B0 ?? E8 ?? ?? ?? ?? 5E 83 C6 11 B9 27 ?? ?? ?? 30 06 46 49 75 FA }

Detection condition:
$a at pe.entry_point

Full rule:
rule DBPE_v153_Ding_Boy: PEiD
{
    strings:
        $a = { 9C 55 57 56 52 51 53 9C FA E8 ?? ?? ?? ?? 5D 81 ED 5B 53 40 ?? B0 ?? E8 ?? ?? ?? ?? 5E 83 C6 11 B9 27 ?? ?? ?? 30 06 46 49 75 FA }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_Gleam_100
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_Gleam_100: PEiD
{
    strings:
        $a = { 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0B 83 EC 0C 53 56 57 E8 24 02 00 FF E9 }
    condition:
        $a at pe.entry_point

}