deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: CodeCrypt_v016b_v0163b
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F }

Detection condition:
$a at pe.entry_point

Full rule:
rule CodeCrypt_v016b_v0163b: PEiD
{
    strings:
        $a = { E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_Patch_or_any_Version_Dwing
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_Patch_or_any_Version_Dwing: PEiD
{
    strings:
        $a = { 60 E8 09 00 00 00 ?? ?? ?? 00 E9 06 02 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Borland_Pascal_v70_Protected_Mode_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? BB ?? ?? 8E D0 8B E3 8C D8 8E C0 0E 1F A1 ?? ?? 25 ?? ?? A3 ?? ?? E8 ?? ?? 83 3E ?? ?? ?? 75 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Borland_Pascal_v70_Protected_Mode_Hint_DOS_EP: PEiD
{
    strings:
        $a = { B8 ?? ?? BB ?? ?? 8E D0 8B E3 8C D8 8E C0 0E 1F A1 ?? ?? 25 ?? ?? A3 ?? ?? E8 ?? ?? 83 3E ?? ?? ?? 75 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_02_Armadillo_300
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_02_Armadillo_300: PEiD
{
    strings:
        $a = { 60 E8 2A 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 85 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Diet_143144_EXE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { F9 9C EB 09 00 00 0A 00 00 00 55 F8 9C 06 1E 57 56 52 51 53 50 0E FC 8C C8 2E 01 06 49 00 BA 00 00 03 C2 8B D8 05 00 00 8E DB 8E C0 33 F6 33 FF B9 08 00 F3 A5 4B 48 4A 79 EE 8E C3 8E D8 BE 66 00 AD 8B E8 B2 10 EA 00 00 00 00 64 6C 7A }

Detection condition:
$a at pe.entry_point

Full rule:
rule Diet_143144_EXE: PEiD
{
    strings:
        $a = { F9 9C EB 09 00 00 0A 00 00 00 55 F8 9C 06 1E 57 56 52 51 53 50 0E FC 8C C8 2E 01 06 49 00 BA 00 00 03 C2 8B D8 05 00 00 8E DB 8E C0 33 F6 33 FF B9 08 00 F3 A5 4B 48 4A 79 EE 8E C3 8E D8 BE 66 00 AD 8B E8 B2 10 EA 00 00 00 00 64 6C 7A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Shrink_Wrap_v14
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 58 60 8B E8 55 33 F6 68 48 01 ?? ?? E8 49 01 ?? ?? EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule Shrink_Wrap_v14: PEiD
{
    strings:
        $a = { 58 60 8B E8 55 33 F6 68 48 01 ?? ?? E8 49 01 ?? ?? EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SoftSentry_v30
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 EC ?? 53 56 57 E9 B0 06 }

Detection condition:
$a at pe.entry_point

Full rule:
rule SoftSentry_v30: PEiD
{
    strings:
        $a = { 55 8B EC 83 EC ?? 53 56 57 E9 B0 06 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: JRC_Archive
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 4A 52 63 68 69 76 65 }

Detection condition:
$a at pe.entry_point

Full rule:
rule JRC_Archive: PEiD
{
    strings:
        $a = { 4A 52 63 68 69 76 65 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: BamBam_v001
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF 85 C0 0F 8E 39 01 00 00 89 45 F0 C6 45 FF 00 8D 7D E8 8B F3 8A 0E 8A 17 8A C1 3A CA 75 1E 84 C0 74 16 8A 56 01 8A 4F 01 8A C2 3A D1 75 0E 83 C6 02 83 C7 02 84 C0 75 DC 33 C0 EB 05 1B C0 83 D8 FF 85 C0 75 04 C6 45 FF 01 8B 43 10 85 C0 0F 84 DD 00 00 00 8B 43 08 50 E8 D7 04 00 00 8A 4D FF 83 C4 04 84 C9 8B 4B 08 89 45 F8 C7 45 F4 00 00 00 00 74 61 8B 15 07 ?? ?? 00 8B 35 6B ?? ?? 00 8B 7B 0C 2B CA 03 F2 8B D1 03 F7 8B F8 C1 E9 02 F3 A5 }
        $b = { 6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule BamBam_v001: PEiD
{
    strings:
        $a = { 6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1 83 C4 10 66 8B 48 06 66 8B 50 14 81 E1 FF FF 00 00 8D 5C 02 18 8D 41 FF 85 C0 0F 8E 39 01 00 00 89 45 F0 C6 45 FF 00 8D 7D E8 8B F3 8A 0E 8A 17 8A C1 3A CA 75 1E 84 C0 74 16 8A 56 01 8A 4F 01 8A C2 3A D1 75 0E 83 C6 02 83 C7 02 84 C0 75 DC 33 C0 EB 05 1B C0 83 D8 FF 85 C0 75 04 C6 45 FF 01 8B 43 10 85 C0 0F 84 DD 00 00 00 8B 43 08 50 E8 D7 04 00 00 8A 4D FF 83 C4 04 84 C9 8B 4B 08 89 45 F8 C7 45 F4 00 00 00 00 74 61 8B 15 07 ?? ?? 00 8B 35 6B ?? ?? 00 8B 7B 0C 2B CA 03 F2 8B D1 03 F7 8B F8 C1 E9 02 F3 A5 }
        $b = { 6A 14 E8 9A 05 00 00 8B D8 53 68 FB ?? ?? 00 E8 6C FD FF FF B9 05 00 00 00 8B F3 BF FB ?? ?? 00 53 F3 A5 E8 8D 05 00 00 8B 3D 03 ?? ?? 00 A1 2B ?? ?? 00 66 8B 15 2F ?? ?? 00 B9 80 ?? ?? 00 2B CF 89 45 E8 89 0D 6B ?? ?? 00 66 89 55 EC 8B 41 3C 33 D2 03 C1 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Microsoft_Visual_Cpp_v42_DLL_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 66 8B C0 8D 24 24 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 50 8B FE 68 78 01 ?? ?? 59 EB 01 EB AC 54 E8 03 ?? ?? ?? 5C EB 08 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_Visual_Cpp_v42_DLL_additional: PEiD
{
    strings:
        $a = { 66 8B C0 8D 24 24 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 50 8B FE 68 78 01 ?? ?? 59 EB 01 EB AC 54 E8 03 ?? ?? ?? 5C EB 08 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SVKP_v142_Pavol_Cerven_h_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 49 DC EC 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 2D 67 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 2D 67 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 39 67 00 00 5D 6A FF FF 95 31 67 }

Detection condition:
$a at pe.entry_point

Full rule:
rule SVKP_v142_Pavol_Cerven_h_additional: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 49 DC EC 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 2D 67 00 00 59 5D 40 85 C0 75 3C 80 3E 00 74 03 46 EB F8 46 E2 E3 8B C5 8B 4C 24 20 2B 85 BD 02 00 00 89 85 B9 02 00 00 80 BD B4 02 00 00 01 75 06 8B 8D 2D 67 00 00 89 8D B5 02 00 00 8D 85 0E 03 00 00 8B DD FF E0 55 68 10 10 00 00 8D 85 B4 00 00 00 50 8D 85 B4 01 00 00 50 6A 00 FF 95 39 67 00 00 5D 6A FF FF 95 31 67 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Obsidium_V125_Obsidium_Software_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsidium_V125_Obsidium_Software_additional: PEiD
{
    strings:
        $a = { E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_v20
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 87 25 ?? ?? ?? ?? 61 94 55 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 }
        $b = { 87 25 ?? ?? ?? 00 61 94 55 A4 B6 80 FF 13 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule FSG_v20: PEiD
{
    strings:
        $a = { 87 25 ?? ?? ?? ?? 61 94 55 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 }
        $b = { 87 25 ?? ?? ?? 00 61 94 55 A4 B6 80 FF 13 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Macromedia_Windows_Flash_ProjectorPlayer_v60_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C }

Detection condition:
$a at pe.entry_point

Full rule:
rule Macromedia_Windows_Flash_ProjectorPlayer_v60_additional: PEiD
{
    strings:
        $a = { 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_32Lite_003_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 ?? ?? ?? ?? E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_32Lite_003_Anorganix: PEiD
{
    strings:
        $a = { 60 06 FC 1E 07 BE 90 90 90 90 6A 04 68 90 10 90 90 68 ?? ?? ?? ?? E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: DIET_v100_v100d_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC }

Detection condition:
$a at pe.entry_point

Full rule:
rule DIET_v100_v100d_additional: PEiD
{
    strings:
        $a = { BF ?? ?? 3B FC 72 ?? B4 4C CD 21 BE ?? ?? B9 ?? ?? FD F3 A5 FC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MSLRHv031_xuecao
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MSLRHv031_xuecao: PEiD
{
    strings:
        $a = { 60 D1 CB 0F CA C1 CA E0 D1 CA 0F C8 EB 01 F1 0F C0 C9 D2 D1 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Delphi_v10_Unit
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 44 43 55 31 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Delphi_v10_Unit: PEiD
{
    strings:
        $a = { 44 43 55 31 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PowerBASICWin_70x
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 53 56 57 BB 00 ?? 40 00 66 2E F7 05 ?? ?? 40 00 04 00 0F 85 DB 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PowerBASICWin_70x: PEiD
{
    strings:
        $a = { 55 8B EC 53 56 57 BB 00 ?? 40 00 66 2E F7 05 ?? ?? 40 00 04 00 0F 85 DB 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Inno_Setup_Module_v109a
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 A7 7F FF FF E8 FA 92 FF FF E8 F1 B3 FF FF 33 C0 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Inno_Setup_Module_v109a: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 A7 7F FF FF E8 FA 92 FF FF E8 F1 B3 FF FF 33 C0 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Obsidium_V1361_Obsidium_Software_20080521
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? E8 ?? 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 ?? EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? 64 FF 30 EB 04 ?? ?? ?? ?? 64 89 20 EB 01 ?? EB 03 ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 01 ?? E8 ?? FF FF FF EB 01 ?? EB 03 ?? ?? ?? EB 01 ?? EB 03 ?? ?? ?? 64 8F 00 EB 03 ?? ?? ?? 83 C4 04 EB 01 ?? 58 EB 02 ?? ?? E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsidium_V1361_Obsidium_Software_20080521: PEiD
{
    strings:
        $a = { EB 04 ?? ?? ?? ?? 50 EB 02 ?? ?? E8 ?? 00 00 00 EB 03 ?? ?? ?? EB 02 ?? ?? 8B 54 24 0C EB 03 ?? ?? ?? 83 82 B8 00 00 00 ?? EB 02 ?? ?? 33 C0 EB 03 ?? ?? ?? C3 EB 03 ?? ?? ?? EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? 64 FF 30 EB 04 ?? ?? ?? ?? 64 89 20 EB 01 ?? EB 03 ?? ?? ?? 8B 00 EB 02 ?? ?? C3 EB 03 ?? ?? ?? E9 FA 00 00 00 EB 01 ?? E8 ?? FF FF FF EB 01 ?? EB 03 ?? ?? ?? EB 01 ?? EB 03 ?? ?? ?? 64 8F 00 EB 03 ?? ?? ?? 83 C4 04 EB 01 ?? 58 EB 02 ?? ?? E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Krypton_v02_yadolockless
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B 0C 24 E9 0A 7C 01 00 AD 42 40 BD BE 9D 7A 04 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Krypton_v02_yadolockless: PEiD
{
    strings:
        $a = { 8B 0C 24 E9 0A 7C 01 00 AD 42 40 BD BE 9D 7A 04 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MESS_v107_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B9 ?? ?? F3 ?? AC E3 ?? EB ?? BA ?? ?? B4 09 CD 21 CD 20 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B4 30 CD 21 3C 02 77 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MESS_v107_Hint_DOS_EP: PEiD
{
    strings:
        $a = { B9 ?? ?? F3 ?? AC E3 ?? EB ?? BA ?? ?? B4 09 CD 21 CD 20 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? B4 30 CD 21 3C 02 77 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Simple_UPX_Cryptor_v3042005_One_layer_encryption
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 B8 ?? ?? ?? 00 B9 ?? 01 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Simple_UPX_Cryptor_v3042005_One_layer_encryption: PEiD
{
    strings:
        $a = { 60 B8 ?? ?? ?? 00 B9 ?? 01 00 00 80 34 08 ?? E2 FA 61 68 ?? ?? ?? 00 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PE_Crypter
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D EB 26 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PE_Crypter: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D EB 26 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: The_aPE_Inline_Patch_ExtraStealth_SuperStealth
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 02 ?? ?? ?? EB 01 C3 3E 8B 44 24 FC 50 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 }

Detection condition:
$a at pe.entry_point

Full rule:
rule The_aPE_Inline_Patch_ExtraStealth_SuperStealth: PEiD
{
    strings:
        $a = { E8 02 ?? ?? ?? EB 01 C3 3E 8B 44 24 FC 50 B9 ?? ?? ?? ?? E8 ?? ?? ?? ?? 89 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Morphine_33_Holy_Father_Ratter29A
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 }
        $b = { 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Morphine_33_Holy_Father_Ratter29A: PEiD
{
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 }
        $b = { 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Alex_Protector_10_Alex_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Alex_Protector_10_Alex_additional: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 10 40 00 E8 24 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PE_Pack_v099
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 ?? ?? ?? ?? 5D 83 ED 06 80 BD E0 04 ?? ?? 01 0F 84 F2 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PE_Pack_v099: PEiD
{
    strings:
        $a = { 60 E8 ?? ?? ?? ?? 5D 83 ED 06 80 BD E0 04 ?? ?? 01 0F 84 F2 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EmbedPE_V1X_cyclotron
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 EC 50 60 68 ?? ?? ?? ?? E8 ?? ?? 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EmbedPE_V1X_cyclotron: PEiD
{
    strings:
        $a = { 83 EC 50 60 68 ?? ?? ?? ?? E8 ?? ?? 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: XCOM_100
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 43 42 47 BA 1E 01 B8 B4 4C 87 E5 BC 15 01 EB 02 F5 EA 50 B4 09 CD 21 87 E5 33 ED E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule XCOM_100: PEiD
{
    strings:
        $a = { 43 42 47 BA 1E 01 B8 B4 4C 87 E5 BC 15 01 EB 02 F5 EA 50 B4 09 CD 21 87 E5 33 ED E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SLVc0deProtector_060_SLV_ICU
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD }

Detection condition:
$a at pe.entry_point

Full rule:
rule SLVc0deProtector_060_SLV_ICU: PEiD
{
    strings:
        $a = { EB 02 FA 04 E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 31 00 00 00 78 E8 DD }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: JAR_Archive_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 1A 4A 61 72 1B }

Detection condition:
$a at pe.entry_point

Full rule:
rule JAR_Archive_Hint_FILE_START: PEiD
{
    strings:
        $a = { 1A 4A 61 72 1B }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Inno_Setup_Module_v304_betav306v307
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 B3 70 FF FF E8 1A 85 FF FF E8 25 A7 FF FF E8 6C }

Detection condition:
$a at pe.entry_point

Full rule:
rule Inno_Setup_Module_v304_betav306v307: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 B8 53 56 57 33 C0 89 45 F0 89 45 BC 89 45 B8 E8 B3 70 FF FF E8 1A 85 FF FF E8 25 A7 FF FF E8 6C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Interchange_Format_File_IFF_type_WVQA_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 46 4F 52 4D ?? ?? ?? ?? 57 56 51 41 56 51 48 44 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Interchange_Format_File_IFF_type_WVQA_additional: PEiD
{
    strings:
        $a = { 46 4F 52 4D ?? ?? ?? ?? 57 56 51 41 56 51 48 44 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Audio_CD_file_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 52 49 46 46 ?? ?? ?? ?? 43 44 44 41 66 6D 74 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Audio_CD_file_additional: PEiD
{
    strings:
        $a = { 52 49 46 46 ?? ?? ?? ?? 43 44 44 41 66 6D 74 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_R_Full_text_index_file_Hint_FILE_START_p_16
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 6C 6C 2D 74 65 78 74 20 69 6E 64 65 78 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_R_Full_text_index_file_Hint_FILE_START_p_16: PEiD
{
    strings:
        $a = { 6C 6C 2D 74 65 78 74 20 69 6E 64 65 78 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: WWPACK_v305c4_Unextractable_Hint_DOS_EP_4_
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 03 05 00 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule WWPACK_v305c4_Unextractable_Hint_DOS_EP_4_: PEiD
{
    strings:
        $a = { 03 05 00 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AsCrypt_v01_SToRM_3_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 51 ?? ?? ?? 01 00 00 00 83 ?? ?? E2 }

Detection condition:
$a at pe.entry_point

Full rule:
rule AsCrypt_v01_SToRM_3_additional: PEiD
{
    strings:
        $a = { 80 ?? ?? ?? 83 ?? ?? ?? ?? 90 90 90 51 ?? ?? ?? 01 00 00 00 83 ?? ?? E2 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CC_261b
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BA 00 00 B4 30 CD 21 3C 02 73 05 33 C0 06 50 CB B9 EB 09 B8 05 FE EB FC 80 C4 3B EB F4 8D 9D 29 01 CD 21 B0 01 CD 21 EB 02 EB FE E8 00 00 5B C6 47 06 82 B0 80 E6 21 BB 20 FF BE 50 01 8B FB B9 B6 00 F3 A4 8B C3 C1 E8 04 8C CD 03 C5 50 51 CB }

Detection condition:
$a at pe.entry_point

Full rule:
rule CC_261b: PEiD
{
    strings:
        $a = { BA 00 00 B4 30 CD 21 3C 02 73 05 33 C0 06 50 CB B9 EB 09 B8 05 FE EB FC 80 C4 3B EB F4 8D 9D 29 01 CD 21 B0 01 CD 21 EB 02 EB FE E8 00 00 5B C6 47 06 82 B0 80 E6 21 BB 20 FF BE 50 01 8B FB B9 B6 00 F3 A4 8B C3 C1 E8 04 8C CD 03 C5 50 51 CB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_VirusConstructorbased_Hint_DOS_EP_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? 5D 81 ?? ?? ?? 06 1E E8 ?? ?? E8 ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B4 4A BB FF FF CD 21 83 ?? ?? B4 4A CD 21 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_VirusConstructorbased_Hint_DOS_EP_additional: PEiD
{
    strings:
        $a = { E8 ?? ?? 5D 81 ?? ?? ?? 06 1E E8 ?? ?? E8 ?? ?? ?? ?? 2E ?? ?? ?? ?? ?? ?? B4 4A BB FF FF CD 21 83 ?? ?? B4 4A CD 21 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: NSPack_Nort_Star_Software_urlwwwnsdsncom_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 F9 00 74 28 43 8D B5 ?? ?? FF FF 8B 16 56 51 53 52 56 FF 33 FF 73 04 8B 43 08 03 C2 50 FF 95 ?? ?? FF FF 5A 5B 59 5E 83 C3 0C E2 E1 61 9D E9 ?? ?? ?? FF 8B B5 ?? ?? FF FF 0B F6 0F 84 97 00 00 00 8B 95 ?? ?? FF FF 03 F2 83 3E 00 75 0E 83 7E 04 00 75 08 }

Detection condition:
$a at pe.entry_point

Full rule:
rule NSPack_Nort_Star_Software_urlwwwnsdsncom_additional: PEiD
{
    strings:
        $a = { 83 F9 00 74 28 43 8D B5 ?? ?? FF FF 8B 16 56 51 53 52 56 FF 33 FF 73 04 8B 43 08 03 C2 50 FF 95 ?? ?? FF FF 5A 5B 59 5E 83 C3 0C E2 E1 61 9D E9 ?? ?? ?? FF 8B B5 ?? ?? FF FF 0B F6 0F 84 97 00 00 00 8B 95 ?? ?? FF FF 03 F2 83 3E 00 75 0E 83 7E 04 00 75 08 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PowerBASICCC_40
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 53 56 57 BB 00 ?? 40 00 66 2E F7 05 ?? ?? 40 00 04 00 75 05 E9 68 05 00 00 E9 6E 03 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PowerBASICCC_40: PEiD
{
    strings:
        $a = { 55 8B EC 53 56 57 BB 00 ?? 40 00 66 2E F7 05 ?? ?? 40 00 04 00 75 05 E9 68 05 00 00 E9 6E 03 }
    condition:
        $a at pe.entry_point

}