deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: NoobyProtect_SE_Public_V1170_Nooby_20090201
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? 00 00 00 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E 31 2E 37 2E 30 }

Detection condition:
$a at pe.entry_point

Full rule:
rule NoobyProtect_SE_Public_V1170_Nooby_20090201: PEiD
{
    strings:
        $a = { E9 ?? 00 00 00 4E 6F 6F 62 79 50 72 6F 74 65 63 74 20 53 45 20 31 2E 31 2E 37 2E 30 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ThemidaWinLicense_V1802_p_Oreans_Technologies
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 00 00 00 00 60 0B C0 74 68 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ThemidaWinLicense_V1802_p_Oreans_Technologies: PEiD
{
    strings:
        $a = { B8 00 00 00 00 60 0B C0 74 68 E8 00 00 00 00 58 05 ?? 00 00 00 80 38 E9 75 ?? 61 EB ?? DB 2D ?? ?? ?? ?? FF FF FF FF FF FF FF FF 3D 40 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Thinstall_Embedded_V19X_Jitit
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 ?? ?? ?? ?? 50 E8 87 FC FF FF 59 59 A1 ?? ?? ?? ?? 8B 40 10 03 05 ?? ?? ?? ?? 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Thinstall_Embedded_V19X_Jitit: PEiD
{
    strings:
        $a = { 55 8B EC 51 53 56 57 6A 00 6A 00 FF 15 ?? ?? ?? ?? 50 E8 87 FC FF FF 59 59 A1 ?? ?? ?? ?? 8B 40 10 03 05 ?? ?? ?? ?? 89 45 FC 8B 45 FC FF E0 5F 5E 5B C9 C3 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PEcrypt_by_archphase_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 E0 53 56 33 C0 89 45 E4 89 45 E0 89 45 EC ?? ?? ?? ?? 64 82 40 00 E8 7C C7 FF FF 33 C0 55 68 BE 84 40 00 64 FF 30 64 89 20 68 CC 84 40 00 ?? ?? ?? ?? 00 A1 10 A7 40 00 50 E8 1D C8 FF FF 8B D8 85 DB 75 39 E8 3A C8 FF FF 6A 00 6A 00 68 A0 A9 40 00 68 00 04 00 00 50 6A 00 68 00 13 00 00 E8 FF C7 FF FF 6A 00 68 E0 84 40 00 A1 A0 A9 40 00 50 6A 00 E8 ?? ?? ?? ?? E9 7D 01 00 00 53 A1 10 A7 40 00 50 E8 42 C8 FF FF 8B F0 85 F6 75 18 6A 00 68 E0 84 40 00 68 E4 84 40 00 6A 00 E8 71 C8 FF FF E9 53 01 00 00 53 6A 00 E8 2C C8 FF FF A3 ?? ?? ?? ?? 83 3D 48 A8 40 00 00 75 18 6A 00 68 E0 84 40 00 68 F8 84 40 00 6A 00 E8 43 C8 FF FF E9 25 01 00 00 56 E8 F8 C7 FF FF A3 4C A8 40 00 A1 48 A8 40 00 E8 91 A1 FF FF 8B D8 8B 15 48 A8 40 00 85 D2 7C 16 42 33 C0 8B 0D 4C A8 40 00 03 C8 8A 09 8D 34 18 88 0E 40 4A 75 ED 8B 15 48 A8 40 00 85 D2 7C 32 42 33 C0 8D 34 18 8A 0E 80 F9 01 75 05 C6 06 FF EB 1C 8D 0C 18 8A 09 84 ?? ?? ?? ?? ?? 00 EB 0E 8B 0D 4C A8 40 00 03 C8 0F B6 09 49 88 0E 40 4A 

Detection condition:
$a at pe.entry_point

Full rule:
rule PEcrypt_by_archphase_additional: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 E0 53 56 33 C0 89 45 E4 89 45 E0 89 45 EC ?? ?? ?? ?? 64 82 40 00 E8 7C C7 FF FF 33 C0 55 68 BE 84 40 00 64 FF 30 64 89 20 68 CC 84 40 00 ?? ?? ?? ?? 00 A1 10 A7 40 00 50 E8 1D C8 FF FF 8B D8 85 DB 75 39 E8 3A C8 FF FF 6A 00 6A 00 68 A0 A9 40 00 68 00 04 00 00 50 6A 00 68 00 13 00 00 E8 FF C7 FF FF 6A 00 68 E0 84 40 00 A1 A0 A9 40 00 50 6A 00 E8 ?? ?? ?? ?? E9 7D 01 00 00 53 A1 10 A7 40 00 50 E8 42 C8 FF FF 8B F0 85 F6 75 18 6A 00 68 E0 84 40 00 68 E4 84 40 00 6A 00 E8 71 C8 FF FF E9 53 01 00 00 53 6A 00 E8 2C C8 FF FF A3 ?? ?? ?? ?? 83 3D 48 A8 40 00 00 75 18 6A 00 68 E0 84 40 00 68 F8 84 40 00 6A 00 E8 43 C8 FF FF E9 25 01 00 00 56 E8 F8 C7 FF FF A3 4C A8 40 00 A1 48 A8 40 00 E8 91 A1 FF FF 8B D8 8B 15 48 A8 40 00 85 D2 7C 16 42 33 C0 8B 0D 4C A8 40 00 03 C8 8A 09 8D 34 18 88 0E 40 4A 75 ED 8B 15 48 A8 40 00 85 D2 7C 32 42 33 C0 8D 34 18 8A 0E 80 F9 01 75 05 C6 06 FF EB 1C 8D 0C 18 8A 09 84 ?? ?? ?? ?? ?? 00 EB 0E 8B 0D 4C A8 40 00 03 C8 0F B6 09 49 88 0E 40 4A 75 D1 8D ?? ?? ?? ?? E8 A5 A3 FF FF 8B 45 E8 8D 55 EC E8 56 D5 FF FF 8D 45 EC BA 18 85 40 00 E8 79 BA FF FF 8B 45 EC E8 39 BB FF FF 8B D0 B8 54 A8 40 00 E8 31 A6 FF FF BA 01 00 00 00 B8 54 A8 40 00 E8 12 A9 FF FF E8 DD A1 FF FF 68 50 A8 40 00 8B D3 8B 0D 48 A8 40 00 B8 54 A8 40 00 E8 56 A7 FF FF E8 C1 A1 FF FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXECryptor_2117_Strongbit_SoftComplete_Development_h_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 F4 56 57 53 BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXECryptor_2117_Strongbit_SoftComplete_Development_h_additional: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 F4 56 57 53 BE ?? ?? ?? ?? B8 00 00 ?? ?? 89 45 FC 89 C2 8B 46 0C 09 C0 0F 84 ?? 00 00 00 01 D0 89 C3 50 FF 15 94 ?? ?? ?? 09 C0 0F 85 0F 00 00 00 53 FF 15 98 ?? ?? ?? 09 C0 0F 84 ?? 00 00 00 89 45 F8 6A 00 8F 45 F4 8B 06 09 C0 8B 55 FC 0F }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: aPack_071_074_COM
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8C C8 05 00 00 8E C0 59 8E D0 51 BE 9B 01 BF 00 01 50 57 FC B6 01 BD 7C 01 FF D5 73 5C FF D5 73 1C FF D5 73 3E BB 93 01 33 C9 FF D3 FF D3 FF D3 FF D3 8B D9 B1 01 85 DB 75 35 93 EB 37 E8 47 00 49 49 75 0A 2E 8B 1E 00 01 E8 3B 00 EB 21 49 AC }

Detection condition:
$a at pe.entry_point

Full rule:
rule aPack_071_074_COM: PEiD
{
    strings:
        $a = { 8C C8 05 00 00 8E C0 59 8E D0 51 BE 9B 01 BF 00 01 50 57 FC B6 01 BD 7C 01 FF D5 73 5C FF D5 73 1C FF D5 73 3E BB 93 01 33 C9 FF D3 FF D3 FF D3 FF D3 8B D9 B1 01 85 DB 75 35 93 EB 37 E8 47 00 49 49 75 0A 2E 8B 1E 00 01 E8 3B 00 EB 21 49 AC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PKLite_113_COM
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 00 00 BA 00 00 3B C4 73 67 8B C4 2D 44 03 25 F0 FF 8B F8 B9 A2 00 BE 7C 01 FC F3 A5 8B D8 B1 04 D3 EB 8C D9 03 D9 53 33 DB 53 CB 0D 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PKLite_113_COM: PEiD
{
    strings:
        $a = { B8 00 00 BA 00 00 3B C4 73 67 8B C4 2D 44 03 25 F0 FF 8B F8 B9 A2 00 BE 7C 01 FC F3 A5 8B D8 B1 04 D3 EB 8C D9 03 D9 53 33 DB 53 CB 0D 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SDProtector_Pro_Edition_116_Randy_Li
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41 }

Detection condition:
$a at pe.entry_point

Full rule:
rule SDProtector_Pro_Edition_116_Randy_Li: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 E8 3B 00 00 00 E8 01 00 00 00 FF 58 05 53 00 00 00 51 8B 4C 24 10 89 81 B8 00 00 00 B8 55 01 00 00 89 41 18 33 C0 89 41 04 89 41 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: yodas_Crypter_13_Ashkbiz_Danehkar_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule yodas_Crypter_13_Ashkbiz_Danehkar_additional: PEiD
{
    strings:
        $a = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 6C 28 40 00 B9 5D 34 40 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Visual_Cpp_2003_EXE_Microsoft
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 FF 57 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Visual_Cpp_2003_EXE_Microsoft: PEiD
{
    strings:
        $a = { 6A ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? 33 FF 57 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Ncu_Li1688
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 0E 1E B8 55 AA CD 21 3D 49 4C 74 ?? 0E 0E 1F 07 E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Ncu_Li1688: PEiD
{
    strings:
        $a = { 0E 1E B8 55 AA CD 21 3D 49 4C 74 ?? 0E 0E 1F 07 E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Hyings_PE_Armor_076_Hying_CCG_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Hyings_PE_Armor_076_Hying_CCG_additional: PEiD
{
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8E 00 00 00 E8 03 00 00 00 EB 01 ?? E8 81 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B7 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AA 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPXHiT_001_dj_siba
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 94 BC ?? ?? 43 00 B9 ?? 00 00 00 80 34 0C ?? E2 FA 94 FF E0 61 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPXHiT_001_dj_siba: PEiD
{
    strings:
        $a = { 94 BC ?? ?? 43 00 B9 ?? 00 00 00 80 34 0C ?? E2 FA 94 FF E0 61 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPX_Alternative_stub
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 01 DB 07 8B 1E 83 EE FC 11 DB ED B8 01 00 00 00 01 DB 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPX_Alternative_stub: PEiD
{
    strings:
        $a = { 01 DB 07 8B 1E 83 EE FC 11 DB ED B8 01 00 00 00 01 DB 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 0B }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PK_Smart_10b
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BA 00 00 8C C8 8B C8 03 C2 81 C1 00 00 51 B9 00 00 51 1E 8C D3 8D 6F 00 55 B1 00 51 FC 4B BE 3C 00 33 FF 8E D8 8E C3 B1 08 F3 A5 48 4A 79 EE 0E 07 8E DB 33 F6 33 FF CB }

Detection condition:
$a at pe.entry_point

Full rule:
rule PK_Smart_10b: PEiD
{
    strings:
        $a = { BA 00 00 8C C8 8B C8 03 C2 81 C1 00 00 51 B9 00 00 51 1E 8C D3 8D 6F 00 55 B1 00 51 FC 4B BE 3C 00 33 FF 8E D8 8E C3 B1 08 F3 A5 48 4A 79 EE 0E 07 8E DB 33 F6 33 FF CB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Crunch_4_Bit_Arts_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Crunch_4_Bit_Arts_additional: PEiD
{
    strings:
        $a = { EB 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 55 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FreeHand_8_document
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 41 47 44 33 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FreeHand_8_document: PEiD
{
    strings:
        $a = { 41 47 44 33 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_021_beta_Dwing_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE 88 01 40 00 AD 8B F8 6A 04 95 A5 33 C0 AB 48 AB F7 D8 59 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_021_beta_Dwing_additional: PEiD
{
    strings:
        $a = { BE 88 01 40 00 AD 8B F8 6A 04 95 A5 33 C0 AB 48 AB F7 D8 59 F3 AB C1 E0 0A B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 5A 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FreeJoiner_Small_build_029_GlOFF_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 32 C4 8A C3 58 E8 DE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FreeJoiner_Small_build_029_GlOFF_additional: PEiD
{
    strings:
        $a = { 50 32 C4 8A C3 58 E8 DE FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_FSG_10
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_FSG_10: PEiD
{
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Protect_30
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 2E A3 00 00 8C D8 2E A3 02 00 8C C8 2E A3 06 00 2E 89 2E 04 00 33 C0 8E C0 FA FC 26 A1 04 00 2E A3 0A 00 26 A1 06 00 2E A3 08 00 26 A1 0C 00 2E A3 0E 00 26 A1 0E 00 2E A3 0C 00 2E A1 06 00 26 A3 06 00 26 C7 06 04 00 D4 01 26 A3 0E 00 26 C7 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Protect_30: PEiD
{
    strings:
        $a = { 2E A3 00 00 8C D8 2E A3 02 00 8C C8 2E A3 06 00 2E 89 2E 04 00 33 C0 8E C0 FA FC 26 A1 04 00 2E A3 0A 00 26 A1 06 00 2E A3 08 00 26 A1 0C 00 2E A3 0E 00 26 A1 0E 00 2E A3 0C 00 2E A1 06 00 26 A3 06 00 26 C7 06 04 00 D4 01 26 A3 0E 00 26 C7 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Obsidium_V1354_Obsidium_Software
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 03 ?? ?? ?? E8 2D 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 25 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsidium_V1354_Obsidium_Software: PEiD
{
    strings:
        $a = { EB 03 ?? ?? ?? E8 2D 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 04 ?? ?? ?? ?? 83 82 B8 00 00 00 25 EB 03 ?? ?? ?? 33 C0 EB 04 ?? ?? ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 50 EB 01 ?? 33 C0 EB 02 ?? ?? 8B 00 EB 04 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: File_Analyzer_Extended_Datafile
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 23 03 45 58 54 44 }

Detection condition:
$a at pe.entry_point

Full rule:
rule File_Analyzer_Extended_Datafile: PEiD
{
    strings:
        $a = { 23 03 45 58 54 44 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: setupexe_Section24rdata
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 32 04 00 6A 32 04 00 00 00 00 00 EE 32 04 00 0C 33 04 00 2A 33 04 }

Detection condition:
$a at pe.entry_point

Full rule:
rule setupexe_Section24rdata: PEiD
{
    strings:
        $a = { 50 32 04 00 6A 32 04 00 00 00 00 00 EE 32 04 00 0C 33 04 00 2A 33 04 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: DZA_Patcher_v13_DZA_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35 }

Detection condition:
$a at pe.entry_point

Full rule:
rule DZA_Patcher_v13_DZA_additional: PEiD
{
    strings:
        $a = { BF 00 40 40 00 99 68 48 20 40 00 68 00 20 40 00 52 52 52 52 52 52 52 57 E8 15 01 00 00 85 C0 75 1C 99 52 52 57 52 E8 CB 00 00 00 FF 35 4C 20 40 00 E8 D2 00 00 00 6A 00 E8 BF 00 00 00 99 68 58 20 40 00 52 52 68 63 10 40 00 52 52 E8 DB 00 00 00 6A FF FF 35 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PEMangle_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 9C BE 00 10 40 00 8B FE B9 28 03 00 00 BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PEMangle_additional: PEiD
{
    strings:
        $a = { 60 9C BE 00 10 40 00 8B FE B9 28 03 00 00 BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_02_WATCOM_CCpp_EXE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 00 00 00 00 90 90 90 90 57 41 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_02_WATCOM_CCpp_EXE: PEiD
{
    strings:
        $a = { E9 00 00 00 00 90 90 90 90 57 41 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: TIFF_Graphics_file_Macintosh
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 4D 4D 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule TIFF_Graphics_file_Macintosh: PEiD
{
    strings:
        $a = { 4D 4D 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Obsidium_V1342_Obsidium_Softwarenbsp_nbsp_SignByfly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 01 ?? E8 C3 27 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsidium_V1342_Obsidium_Softwarenbsp_nbsp_SignByfly: PEiD
{
    strings:
        $a = { EB 02 ?? ?? E8 26 00 00 00 EB 03 ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 24 EB 03 ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 67 89 26 00 00 EB 03 ?? ?? ?? EB 03 ?? ?? ?? 50 EB 04 ?? ?? ?? ?? 33 C0 EB 03 ?? ?? ?? 8B 00 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 03 ?? ?? ?? E8 D5 FF FF FF EB 01 ?? EB 03 ?? ?? ?? 58 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 64 67 8F 06 00 00 EB 04 ?? ?? ?? ?? 83 C4 04 EB 01 ?? E8 C3 27 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_v260_Beta_1_Silicon_Realms_Toolworks
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 50 ?? ?? ?? ?? 68 74 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 58 33 D2 8A D4 89 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_v260_Beta_1_Silicon_Realms_Toolworks: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 50 ?? ?? ?? ?? 68 74 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF ?? ?? ?? 15 58 33 D2 8A D4 89 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: XPack_V098_LZSS_JoKo
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 ?? ?? ?? 00 9C 60 E8 97 02 00 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 44 ?? ?? 00 34 ?? ?? 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule XPack_V098_LZSS_JoKo: PEiD
{
    strings:
        $a = { 68 ?? ?? ?? 00 9C 60 E8 97 02 00 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 44 ?? ?? 00 34 ?? ?? 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PESPin_v13_Cyberbob
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule PESPin_v13_Cyberbob: PEiD
{
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Nakedbind_10_nakedcrew_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 64 8B 05 ?? ?? ?? ?? 55 8B EC 6A FF 68 ?? ?? 40 ?? 68 ?? ?? 40 ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 08 50 53 56 57 89 65 E8 C7 45 FC }

Detection condition:
$a at pe.entry_point

Full rule:
rule Nakedbind_10_nakedcrew_additional: PEiD
{
    strings:
        $a = { 64 8B 05 ?? ?? ?? ?? 55 8B EC 6A FF 68 ?? ?? 40 ?? 68 ?? ?? 40 ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 08 50 53 56 57 89 65 E8 C7 45 FC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Unknown_encryptor_1_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB ?? 2E 90 ?? ?? 8C DB 8C CA 8E DA FA 8B EC BE ?? ?? BC ?? ?? BF }

Detection condition:
$a at pe.entry_point

Full rule:
rule Unknown_encryptor_1_additional: PEiD
{
    strings:
        $a = { EB ?? 2E 90 ?? ?? 8C DB 8C CA 8E DA FA 8B EC BE ?? ?? BC ?? ?? BF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MingWin32_Dev_Cpp_v4991
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 ?? ?? 00 00 90 90 90 90 90 90 90 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MingWin32_Dev_Cpp_v4991: PEiD
{
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 01 00 00 00 FF 15 ?? ?? ?? 00 E8 C8 FE FF FF 90 8D B4 26 00 00 00 00 55 89 E5 83 EC 08 C7 04 24 02 00 00 00 FF 15 ?? ?? ?? 00 E8 A8 FE FF FF 90 8D B4 26 00 00 00 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 8D 74 26 00 55 8B 0D ?? ?? ?? 00 89 E5 5D FF E1 90 90 90 90 55 89 E5 5D E9 ?? ?? 00 00 90 90 90 90 90 90 90 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPX_293_300_LZMA_Markus_Oberhumer_Laszlo_Molnar_John_Reiser
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 03 00 02 00 90 90 90 90 90 }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPX_293_300_LZMA_Markus_Oberhumer_Laszlo_Molnar_John_Reiser: PEiD
{
    strings:
        $a = { 60 BE ?? ?? ?? ?? 8D BE ?? ?? ?? ?? 57 89 E5 8D 9C 24 ?? ?? ?? ?? 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? ?? 57 83 C3 04 53 68 ?? ?? ?? ?? 56 83 C3 04 53 50 C7 03 03 00 02 00 90 90 90 90 90 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Visual_Cpp_42_EXE_4
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 00 00 40 00 68 00 00 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 08 83 EC 6C 53 56 57 89 65 E8 C7 45 FC 00 00 00 00 6A 02 FF 15 00 00 40 00 83 C4 04 C7 05 00 00 40 00 FF FF FF FF A1 00 00 40 00 A3 00 00 40 00 FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule Visual_Cpp_42_EXE_4: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 00 00 40 00 68 00 00 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 08 83 EC 6C 53 56 57 89 65 E8 C7 45 FC 00 00 00 00 6A 02 FF 15 00 00 40 00 83 C4 04 C7 05 00 00 40 00 FF FF FF FF A1 00 00 40 00 A3 00 00 40 00 FF }
    condition:
        $a at pe.entry_point

}