deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: StarForce_V3X_DLL_StarForce_Copy_Protection_System
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? ?? ?? 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule StarForce_V3X_DLL_StarForce_Copy_Protection_System: PEiD
{
    strings:
        $a = { E8 ?? ?? ?? ?? 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Thinstall_Embedded_V2620_V2623_Jitit_Sign_by_fly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 00 00 00 00 58 BB AC 1E 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 21 00 00 68 C4 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Thinstall_Embedded_V2620_V2623_Jitit_Sign_by_fly: PEiD
{
    strings:
        $a = { E8 00 00 00 00 58 BB AC 1E 00 00 2B C3 50 68 ?? ?? ?? ?? 68 B0 21 00 00 68 C4 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AntiDote_v14_osCE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 95 01 00 00 E8 D0 FD FF FF 68 95 01 00 00 E8 C3 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 }

Detection condition:
$a at pe.entry_point

Full rule:
rule AntiDote_v14_osCE: PEiD
{
    strings:
        $a = { 68 95 01 00 00 E8 D0 FD FF FF 68 95 01 00 00 E8 C3 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_430_440_Silicon_Realms_Toolworks_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 40 ?? ?? 00 68 80 ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 ?? ?? 00 33 D2 8A D4 89 15 30 ?? ?? 00 8B C8 81 E1 FF 00 00 00 89 0D 2C ?? ?? 00 C1 E1 08 03 CA 89 0D 28 ?? ?? 00 C1 E8 10 A3 24 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_430_440_Silicon_Realms_Toolworks_additional: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 40 ?? ?? 00 68 80 ?? ?? 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 88 ?? ?? 00 33 D2 8A D4 89 15 30 ?? ?? 00 8B C8 81 E1 FF 00 00 00 89 0D 2C ?? ?? 00 C1 E1 08 03 CA 89 0D 28 ?? ?? 00 C1 E8 10 A3 24 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MASMTASM_sig4_h_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { C3 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MASMTASM_sig4_h_additional: PEiD
{
    strings:
        $a = { C3 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: TurboChainer_103
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BA 24 00 8E DA 8C D3 2B DA D1 E3 D1 E3 D1 E3 D1 E3 FA 8E D2 03 E3 FB B8 24 00 8E D8 1E FC 8D 06 B0 00 83 C0 0C 50 1E BE 80 00 8C C0 8E D8 07 5F 8B 0C 32 ED 51 46 F3 A4 59 1F 00 0E AF 00 1E B4 51 32 C0 CD 21 8E DB BB 2C 00 8B 07 8E D8 33 DB }

Detection condition:
$a at pe.entry_point

Full rule:
rule TurboChainer_103: PEiD
{
    strings:
        $a = { BA 24 00 8E DA 8C D3 2B DA D1 E3 D1 E3 D1 E3 D1 E3 FA 8E D2 03 E3 FB B8 24 00 8E D8 1E FC 8D 06 B0 00 83 C0 0C 50 1E BE 80 00 8C C0 8E D8 07 5F 8B 0C 32 ED 51 46 F3 A4 59 1F 00 0E AF 00 1E B4 51 32 C0 CD 21 8E DB BB 2C 00 8B 07 8E D8 33 DB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_v133
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 00 80 40 ?? 90 90 01 85 9E 80 40 ?? BB E8 0E }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_v133: PEiD
{
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 ?? 87 DD 8B 85 A6 80 40 ?? 01 85 03 80 40 ?? 66 C7 85 00 80 40 ?? 90 90 01 85 9E 80 40 ?? BB E8 0E }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASPack_v2001_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 72 05 00 00 EB 33 87 DB 90 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASPack_v2001_additional: PEiD
{
    strings:
        $a = { 60 E8 72 05 00 00 EB 33 87 DB 90 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Morphine_v12_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? 00 00 00 66 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 51 66 ?? ?? ?? 59 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Morphine_v12_additional: PEiD
{
    strings:
        $a = { 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 ?? 00 00 00 66 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 51 66 ?? ?? ?? 59 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PocketPC_ARM
Repository: Yara-Rules/rules

Pattern signatures:
$a = { F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 ?? 00 00 EB 07 30 A0 E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 ?? ?? ?? EB F0 40 BD E8 ?? 00 00 EA ?? 40 2D E9 ?? ?? 9F E5 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 9F E5 00 ?? ?? ?? ?? 00 }
        $b = { F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 ?? 00 00 EB 07 30 A0 E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 ?? ?? ?? EB F0 40 BD E8 ?? 00 00 EA ?? 40 2D E9 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule PocketPC_ARM: PEiD
{
    strings:
        $a = { F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 ?? 00 00 EB 07 30 A0 E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 ?? ?? ?? EB F0 40 BD E8 ?? 00 00 EA ?? 40 2D E9 ?? ?? 9F E5 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 9F E5 00 ?? ?? ?? ?? 00 }
        $b = { F0 40 2D E9 00 40 A0 E1 01 50 A0 E1 02 60 A0 E1 03 70 A0 E1 ?? 00 00 EB 07 30 A0 E1 06 20 A0 E1 05 10 A0 E1 04 00 A0 E1 ?? ?? ?? EB F0 40 BD E8 ?? 00 00 EA ?? 40 2D E9 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Packman_0001_Bubbasoft_h_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 0F 85 ?? FF FF FF 8D B3 ?? ?? ?? ?? EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00 00 ?? ?? B8 00 ?? ?? 00 0B C0 74 34 03 C3 EB 2A 8D 70 08 03 40 04 33 ED 33 D2 66 8B 2E 66 0F A4 EA 04 80 FA 03 75 0D 81 E5 FF 0F 00 00 03 EF 03 EB 01 4D 00 46 46 3B F0 75 DC 8B 38 85 FF 75 D0 61 E9 ?? FE FF FF 02 D2 75 05 8A 16 46 12 D2 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Packman_0001_Bubbasoft_h_additional: PEiD
{
    strings:
        $a = { 0F 85 ?? FF FF FF 8D B3 ?? ?? ?? ?? EB 3D 8B 46 0C 03 C3 50 FF 55 00 56 8B 36 0B F6 75 02 8B F7 03 F3 03 FB EB 1B D1 C1 D1 E9 73 05 0F B7 C9 EB 05 03 CB 8D 49 02 50 51 50 FF 55 04 AB 58 83 C6 04 8B 0E 85 C9 75 DF 5E 83 C6 14 8B 7E 10 85 FF 75 BC 8D 8B 00 00 ?? ?? B8 00 ?? ?? 00 0B C0 74 34 03 C3 EB 2A 8D 70 08 03 40 04 33 ED 33 D2 66 8B 2E 66 0F A4 EA 04 80 FA 03 75 0D 81 E5 FF 0F 00 00 03 EF 03 EB 01 4D 00 46 46 3B F0 75 DC 8B 38 85 FF 75 D0 61 E9 ?? FE FF FF 02 D2 75 05 8A 16 46 12 D2 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Software_Compress_v14_LITE_BG_Software_Protect_Technologies_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A 41 00 8B 4A 64 89 8D 51 1A 41 00 8B 4A 74 89 8D 59 1A 41 00 68 00 20 00 00 E8 D2 00 00 00 50 8D 8D 00 1C 41 00 50 51 E8 1B 00 00 00 83 C4 08 58 8D 78 74 8D B5 49 1A 41 00 B9 18 00 00 00 F3 A4 05 A4 00 00 00 50 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Software_Compress_v14_LITE_BG_Software_Protect_Technologies_h: PEiD
{
    strings:
        $a = { E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A 41 00 8B 4A 64 89 8D 51 1A 41 00 8B 4A 74 89 8D 59 1A 41 00 68 00 20 00 00 E8 D2 00 00 00 50 8D 8D 00 1C 41 00 50 51 E8 1B 00 00 00 83 C4 08 58 8D 78 74 8D B5 49 1A 41 00 B9 18 00 00 00 F3 A4 05 A4 00 00 00 50 C3 60 8B 74 24 24 8B 7C 24 28 FC B2 80 33 DB A4 B3 02 E8 6D 00 00 00 73 F6 33 C9 E8 64 00 00 00 73 1C 33 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 12 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 2B CB 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 13 C9 EB 1C 91 48 C1 E0 08 AC E8 2C 00 00 00 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B3 01 56 8B F7 2B F0 F3 A4 5E EB 8E 02 D2 75 05 8A 16 46 12 D2 C3 33 C9 41 E8 EE FF FF FF 13 C9 E8 E7 FF FF FF 72 F2 C3 2B 7C 24 28 89 7C 24 1C 61 C3 60 FF 74 24 24 6A 40 FF 95 4D 1A 41 00 89 44 24 1C 61 C2 04 }
        $b = { E8 00 00 00 00 81 2C 24 AA 1A 41 00 5D E8 00 00 00 00 83 2C 24 6E 8B 85 5D 1A 41 00 29 04 24 8B 04 24 89 85 5D 1A 41 00 58 8B 85 5D 1A 41 00 8B 50 3C 03 D0 8B 92 80 00 00 00 03 D0 8B 4A 58 89 8D 49 1A 41 00 8B 4A 5C 89 8D 4D 1A 41 00 8B 4A 60 89 8D 55 1A }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Vx_Horse1776_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? 5D 83 ?? ?? 06 1E 26 ?? ?? ?? ?? BF ?? ?? 1E 0E 1F 8B F7 01 EE B9 ?? ?? FC F3 A6 1F 1E 07 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Horse1776_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E8 ?? ?? 5D 83 ?? ?? 06 1E 26 ?? ?? ?? ?? BF ?? ?? 1E 0E 1F 8B F7 01 EE B9 ?? ?? FC F3 A6 1F 1E 07 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: BeRoEXEPacker_v100_DLL_BeRo_Farbrausch
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10 }
        $b = { 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule BeRoEXEPacker_v100_DLL_BeRo_Farbrausch: PEiD
{
    strings:
        $a = { 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 BE ?? ?? ?? ?? BF ?? ?? ?? ?? FC B2 80 33 DB A4 B3 02 E8 ?? ?? ?? ?? 73 F6 33 C9 E8 ?? ?? ?? ?? 73 1C 33 C0 E8 ?? ?? ?? ?? 73 23 B3 02 41 B0 10 }
        $b = { 83 7C 24 08 01 0F 85 ?? ?? ?? ?? 60 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? B9 ?? ?? ?? ?? 8B F9 81 FE ?? ?? ?? ?? 7F 10 AC 47 04 18 2C 02 73 F0 29 3E 03 F1 03 F9 EB E8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Microsoft_R_Incremental_Linker_Version_5128078_MASMTASM
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 6A 00 68 00 30 40 00 68 1E 30 40 00 6A 00 E8 0D 00 00 00 6A 00 E8 00 00 00 00 FF 25 00 20 40 00 FF 25 08 20 40 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_R_Incremental_Linker_Version_5128078_MASMTASM: PEiD
{
    strings:
        $a = { 6A 00 68 00 30 40 00 68 1E 30 40 00 6A 00 E8 0D 00 00 00 6A 00 E8 00 00 00 00 FF 25 00 20 40 00 FF 25 08 20 40 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_v02_Beta_Dwing
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE 88 01 ?? ?? AD 8B F8 95 A5 33 C0 33 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_v02_Beta_Dwing: PEiD
{
    strings:
        $a = { BE 88 01 ?? ?? AD 8B F8 95 A5 33 C0 33 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: TopSpeed_v301_1989_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 1E BA ?? ?? 8E DA 8B ?? ?? ?? 8B ?? ?? ?? FF ?? ?? ?? 50 53 }

Detection condition:
$a at pe.entry_point

Full rule:
rule TopSpeed_v301_1989_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 1E BA ?? ?? 8E DA 8B ?? ?? ?? 8B ?? ?? ?? FF ?? ?? ?? 50 53 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: File_Analyzer_Extended_Datafile_Version_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 23 03 45 58 54 44 ?? ?? 3A 03 }

Detection condition:
$a at pe.entry_point

Full rule:
rule File_Analyzer_Extended_Datafile_Version_additional: PEiD
{
    strings:
        $a = { 23 03 45 58 54 44 ?? ?? 3A 03 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MIDI_Music_file_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 4D 54 68 64 00 00 00 06 ?? ?? ?? ?? ?? ?? 4D 54 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MIDI_Music_file_additional: PEiD
{
    strings:
        $a = { 4D 54 68 64 00 00 00 06 ?? ?? ?? ?? ?? ?? 4D 54 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_v030_beta_Dwing
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 30 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_v030_beta_Dwing: PEiD
{
    strings:
        $a = { E9 ?? ?? ?? ?? 42 79 44 77 69 6E 67 40 00 00 00 50 45 00 00 4C 01 02 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 30 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CodeCrypt_v015b_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F EB 03 FF 1D 34 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CodeCrypt_v015b_additional: PEiD
{
    strings:
        $a = { E9 2E 03 00 00 EB 02 83 3D 58 EB 02 FF 1D 5B EB 02 0F C7 5F EB 03 FF 1D 34 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXECryptor_2x_SoftComplete_Developement
Repository: Yara-Rules/rules

Pattern signatures:
$a = { A4 ?? ?? 00 00 00 00 00 FF FF FF FF 3C ?? ?? 00 94 ?? ?? 00 D8 ?? ?? 00 00 00 00 00 FF FF FF FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXECryptor_2x_SoftComplete_Developement: PEiD
{
    strings:
        $a = { A4 ?? ?? 00 00 00 00 00 FF FF FF FF 3C ?? ?? 00 94 ?? ?? 00 D8 ?? ?? 00 00 00 00 00 FF FF FF FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: QuickLink_II_Fax_Graphics_format_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 51 4C 49 49 46 41 58 20 }

Detection condition:
$a at pe.entry_point

Full rule:
rule QuickLink_II_Fax_Graphics_format_Hint_FILE_START: PEiD
{
    strings:
        $a = { 51 4C 49 49 46 41 58 20 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASProtect_123_RC4_build_0807_dll_Alexey_Solodovnikov_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASProtect_123_RC4_build_0807_dll_Alexey_Solodovnikov_h: PEiD
{
    strings:
        $a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPX_v30_DLL_LZMA_Markus_Oberhumer_Laszlo_Molnar_John_Reiser
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 80 7C 24 08 01 0F 85 C7 0B 00 00 60 BE 00 ?? ?? ?? 8D BE 00 ?? ?? FF 57 89 E5 8D 9C 24 80 C1 FF FF 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPX_v30_DLL_LZMA_Markus_Oberhumer_Laszlo_Molnar_John_Reiser: PEiD
{
    strings:
        $a = { 80 7C 24 08 01 0F 85 C7 0B 00 00 60 BE 00 ?? ?? ?? 8D BE 00 ?? ?? FF 57 89 E5 8D 9C 24 80 C1 FF FF 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Turbo_C_1987_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FB BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Turbo_C_1987_additional: PEiD
{
    strings:
        $a = { FB BA ?? ?? 2E 89 ?? ?? ?? B4 30 CD 21 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_02_LCC_Win32_1x_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_02_LCC_Win32_1x_Anorganix: PEiD
{
    strings:
        $a = { 64 A1 01 00 00 00 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 9A 10 40 90 50 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXE2COM_With_CRC_check_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B3 ?? B9 ?? ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 43 49 32 E4 03 D0 E3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXE2COM_With_CRC_check_Hint_DOS_EP: PEiD
{
    strings:
        $a = { B3 ?? B9 ?? ?? 33 D2 BE ?? ?? 8B FE AC 32 C3 AA 43 49 32 E4 03 D0 E3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: XComp_V097_LZRW_JoKo
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 ?? ?? ?? 00 9C 60 E8 9B 02 00 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 34 ?? ?? 00 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule XComp_V097_LZRW_JoKo: PEiD
{
    strings:
        $a = { 68 ?? ?? ?? 00 9C 60 E8 9B 02 00 00 34 ?? ?? 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 34 ?? ?? 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ENIGMA_Protector_V11_Sukhov_Vladimir_
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 83 ?? ?? 81 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ENIGMA_Protector_V11_Sukhov_Vladimir_: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 83 ?? ?? 81 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Sun_Icon_Graphics_format
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 2F 2A 20 46 6F 72 6D 61 74 5F 76 65 72 73 69 6F 6E 3D 31 2C }

Detection condition:
$a at pe.entry_point

Full rule:
rule Sun_Icon_Graphics_format: PEiD
{
    strings:
        $a = { 2F 2A 20 46 6F 72 6D 61 74 5F 76 65 72 73 69 6F 6E 3D 31 2C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EncryptPE_V22006710_WFS_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EncryptPE_V22006710_WFS_additional: PEiD
{
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 00 E8 73 01 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPX_SCRAMBLER_306_OnToL_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 00 00 00 00 59 83 C1 07 51 C3 C3 BE ?? ?? ?? ?? 83 EC 04 89 34 24 B9 80 00 00 00 81 36 ?? ?? ?? ?? 50 B8 04 00 00 00 50 03 34 24 58 58 83 E9 03 E2 E9 EB D6 }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPX_SCRAMBLER_306_OnToL_additional: PEiD
{
    strings:
        $a = { E8 00 00 00 00 59 83 C1 07 51 C3 C3 BE ?? ?? ?? ?? 83 EC 04 89 34 24 B9 80 00 00 00 81 36 ?? ?? ?? ?? 50 B8 04 00 00 00 50 03 34 24 58 58 83 E9 03 E2 E9 EB D6 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Exact_Audio_Copy_UnknownCompiler_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? ?? 00 31 ED 55 89 E5 81 EC ?? 00 00 00 8D BD ?? FF FF FF B9 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Exact_Audio_Copy_UnknownCompiler_additional: PEiD
{
    strings:
        $a = { E8 ?? ?? ?? 00 31 ED 55 89 E5 81 EC ?? 00 00 00 8D BD ?? FF FF FF B9 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PESpin_11_Cyberbob_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule PESpin_11_Cyberbob_h: PEiD
{
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 7D DE 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Alias_PIXVivid_IMG_Graphics_format_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 ?? ?? 00 18 ?? ?? ?? ?? 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Alias_PIXVivid_IMG_Graphics_format_additional: PEiD
{
    strings:
        $a = { 00 00 ?? ?? 00 18 ?? ?? ?? ?? 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MASM32_TASM32
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 2B C0 50 E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MASM32_TASM32: PEiD
{
    strings:
        $a = { 2B C0 50 E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPXHiT_001_DJ_Siba
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E2 FA 94 FF E0 61 00 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPXHiT_001_DJ_Siba: PEiD
{
    strings:
        $a = { E2 FA 94 FF E0 61 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_037_beta_Dwing_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE E0 11 ?? ?? FF 36 E9 C3 00 00 00 48 01 ?? ?? 0B 01 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_037_beta_Dwing_additional: PEiD
{
    strings:
        $a = { BE E0 11 ?? ?? FF 36 E9 C3 00 00 00 48 01 ?? ?? 0B 01 4B 45 52 4E 45 4C 33 32 2E 44 4C 4C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_GRUNT2Family_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 48 E2 F7 C3 51 53 52 E8 DD FF 5A 5B 59 C3 B9 00 00 E2 FE C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_GRUNT2Family_additional: PEiD
{
    strings:
        $a = { 48 E2 F7 C3 51 53 52 E8 DD FF 5A 5B 59 C3 B9 00 00 E2 FE C3 }
    condition:
        $a at pe.entry_point

}