deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: FSG_v133_Eng_dulekxt_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B6 00 56 8B F7 2B F0 F3 A4 5E EB 9D 8B D6 5E AD 48 74 0A 79 02 AD 50 56 8B F2 97 EB 87 AD 93 5E 46 AD 97 56 FF 13 95 AC 84 C0 75 FB FE 0E 74 F0 79 05 46 AD 50 EB 09 FE 0E 0F 84 ?? ?? ?? FF 56 55 FF 53 04 AB EB E0 33 C9 41 FF 13 13 C9 FF 13 72 F8 C3 02 D2 75 05 8A 16 46 12 D2 C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00 54 01 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 01 00 00 6F 01 00 00 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_v133_Eng_dulekxt_additional: PEiD
{
    strings:
        $a = { BE A4 01 40 00 AD 93 AD 97 AD 56 96 B2 80 A4 B6 80 FF 13 73 F9 33 C9 FF 13 73 16 33 C0 FF 13 73 1F B6 80 41 B0 10 FF 13 12 C0 73 FA 75 3C AA EB E0 FF 53 08 02 F6 83 D9 01 75 0E FF 53 04 EB 26 AC D1 E8 74 2F 13 C9 EB 1A 91 48 C1 E0 08 AC FF 53 04 3D 00 7D 00 00 73 0A 80 FC 05 73 06 83 F8 7F 77 02 41 41 95 8B C5 B6 00 56 8B F7 2B F0 F3 A4 5E EB 9D 8B D6 5E AD 48 74 0A 79 02 AD 50 56 8B F2 97 EB 87 AD 93 5E 46 AD 97 56 FF 13 95 AC 84 C0 75 FB FE 0E 74 F0 79 05 46 AD 50 EB 09 FE 0E 0F 84 ?? ?? ?? FF 56 55 FF 53 04 AB EB E0 33 C9 41 FF 13 13 C9 FF 13 72 F8 C3 02 D2 75 05 8A 16 46 12 D2 C3 ?? ?? ?? 00 00 00 00 00 00 00 00 00 54 01 00 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 61 01 00 00 6F 01 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PE_Intro_v10_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8A 16 02 00 8A 07 32 C2 88 07 43 FE C2 81 FB }

Detection condition:
$a at pe.entry_point

Full rule:
rule PE_Intro_v10_additional: PEiD
{
    strings:
        $a = { 8A 16 02 00 8A 07 32 C2 88 07 43 FE C2 81 FB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Enigma_Protector_11X_13X_Sukhov_Vladimir_Serge_N_Markin
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 F0 B8 00 10 40 00 E8 01 00 00 00 9A 83 C4 10 8B E5 5D E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Enigma_Protector_11X_13X_Sukhov_Vladimir_Serge_N_Markin: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 F0 B8 00 10 40 00 E8 01 00 00 00 9A 83 C4 10 8B E5 5D E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MinGW_GCC_DLL_v2xx
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 96 01 ?? ?? 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D ?? 30 ?? 10 85 }
        $b = { 55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule MinGW_GCC_DLL_v2xx: PEiD
{
    strings:
        $a = { 55 89 E5 83 EC 18 89 75 FC 8B 75 0C 89 5D F8 83 FE 01 74 5C 89 74 24 04 8B 55 10 89 54 24 08 8B 55 08 89 14 24 E8 96 01 ?? ?? 83 EC 0C 83 FE 01 89 C3 74 2C 85 F6 75 0C 8B 0D ?? 30 ?? 10 85 }
        $b = { 55 89 E5 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Guardant_Stealth_aka_Novex_Dongle_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 CC 3A 40 ?? E8 E0 FC FF FF 33 C0 55 68 EA 3C 40 ?? 64 FF 30 64 89 20 6A ?? 68 80 ?? ?? ?? 6A 03 6A ?? 6A 01 ?? ?? ?? 80 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Guardant_Stealth_aka_Novex_Dongle_additional: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 F0 53 56 57 33 C0 89 45 F0 B8 CC 3A 40 ?? E8 E0 FC FF FF 33 C0 55 68 EA 3C 40 ?? 64 FF 30 64 89 20 6A ?? 68 80 ?? ?? ?? 6A 03 6A ?? 6A 01 ?? ?? ?? 80 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PPC_PROTECT_10_Alexey_Gorchakov
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FF 5F 2D E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PPC_PROTECT_10_Alexey_Gorchakov: PEiD
{
    strings:
        $a = { FF 5F 2D E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: yodas_Protector_1031_Ashkibiz_Danehlar_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 74 72 42 00 8B D5 81 C2 C3 72 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3F A9 42 00 81 E9 6E 73 42 00 8B D5 81 C2 6E 73 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 98 2E 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC }

Detection condition:
$a at pe.entry_point

Full rule:
rule yodas_Protector_1031_Ashkibiz_Danehlar_additional: PEiD
{
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 74 72 42 00 8B D5 81 C2 C3 72 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3F A9 42 00 81 E9 6E 73 42 00 8B D5 81 C2 6E 73 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 98 2E 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Shield_170
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 2E 8C 06 D5 05 2E 87 06 D3 05 8B EC B9 C3 03 90 33 DB 02 46 00 12 E7 45 E2 F8 8C CE 8E DB FA BC 22 02 59 5A 87 0F 43 43 03 D6 87 17 52 51 43 43 83 EC 04 80 FB 10 72 EA CC 90 25 73 67 2B 98 02 FB 5D 07 5A 5F 8B 3D 8B 4E 05 33 C7 33 C1 D1 C0 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Shield_170: PEiD
{
    strings:
        $a = { 2E 8C 06 D5 05 2E 87 06 D3 05 8B EC B9 C3 03 90 33 DB 02 46 00 12 E7 45 E2 F8 8C CE 8E DB FA BC 22 02 59 5A 87 0F 43 43 03 D6 87 17 52 51 43 43 83 EC 04 80 FB 10 72 EA CC 90 25 73 67 2B 98 02 FB 5D 07 5A 5F 8B 3D 8B 4E 05 33 C7 33 C1 D1 C0 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PKLITE_v200b_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 02 00 72 ?? B4 09 BA ?? ?? CD 21 B8 01 4C CD 21 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 59 2D ?? ?? 8E D0 51 2D ?? ?? 8E C0 50 B9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PKLITE_v200b_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 50 B8 ?? ?? BA ?? ?? 05 ?? ?? 3B 06 02 00 72 ?? B4 09 BA ?? ?? CD 21 B8 01 4C CD 21 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 59 2D ?? ?? 8E D0 51 2D ?? ?? 8E C0 50 B9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MrHDKiLLeR_ProtectioN_10
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 48 51 44 2E A1 01 01 2D 11 00 8B D8 05 00 01 8B F0 BF 00 01 B9 14 00 90 F3 A4 8B CB D1 E9 B8 00 01 8B F0 8B F8 06 6A 00 07 26 8B 2E 04 00 26 FF 36 06 00 07 26 8A 76 00 6A 00 07 26 8B 2E 0C 00 26 FF 36 0E 00 07 26 8A 56 00 6A 00 07 26 8B 1E }

Detection condition:
$a at pe.entry_point

Full rule:
rule MrHDKiLLeR_ProtectioN_10: PEiD
{
    strings:
        $a = { 48 51 44 2E A1 01 01 2D 11 00 8B D8 05 00 01 8B F0 BF 00 01 B9 14 00 90 F3 A4 8B CB D1 E9 B8 00 01 8B F0 8B F8 06 6A 00 07 26 8B 2E 04 00 26 FF 36 06 00 07 26 8A 76 00 6A 00 07 26 8B 2E 0C 00 26 FF 36 0E 00 07 26 8A 56 00 6A 00 07 26 8B 1E }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_01_Borland_Delphi_50_KOLMCK_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0E 00 90 90 90 90 90 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0A 00 00 00 90 90 90 90 90 00 00 00 01 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_01_Borland_Delphi_50_KOLMCK_Anorganix: PEiD
{
    strings:
        $a = { 55 8B EC 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 FF 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 EB 04 00 00 00 01 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 08 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0E 00 90 90 90 90 90 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 0A 00 00 00 90 90 90 90 90 00 00 00 01 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Norton_Speed_Disk_Configuration_file_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 4E 6F 72 74 6F 6E 20 53 70 65 65 64 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Norton_Speed_Disk_Configuration_file_additional: PEiD
{
    strings:
        $a = { 4E 6F 72 74 6F 6E 20 53 70 65 65 64 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Thinstall_Embedded_2547_V2600_Jitit
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 00 00 00 00 58 BB BC 18 00 00 2B C3 50 68 ?? ?? ?? ?? 68 60 1B 00 00 68 60 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Thinstall_Embedded_2547_V2600_Jitit: PEiD
{
    strings:
        $a = { E8 00 00 00 00 58 BB BC 18 00 00 2B C3 50 68 ?? ?? ?? ?? 68 60 1B 00 00 68 60 00 00 00 E8 35 FF FF FF E9 99 FF FF FF 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_02_Microsoft_Visual_Basic_50_60_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_02_Microsoft_Visual_Basic_50_60_Anorganix: PEiD
{
    strings:
        $a = { 68 ?? ?? ?? ?? E8 0A 00 00 00 00 00 00 00 00 00 30 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: XPack_152_164
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B EC FA 33 C0 8E D0 BC ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule XPack_152_164: PEiD
{
    strings:
        $a = { 8B EC FA 33 C0 8E D0 BC ?? ?? 2E ?? ?? ?? ?? 2E ?? ?? ?? ?? EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: XE_Executable_Image_using_DOSExtender_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 58 45 }

Detection condition:
$a at pe.entry_point

Full rule:
rule XE_Executable_Image_using_DOSExtender_Hint_FILE_START: PEiD
{
    strings:
        $a = { 58 45 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AVP_Antiviral_Database
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 41 56 50 20 41 6E 74 69 76 69 72 61 6C 20 44 61 74 61 62 61 73 65 }

Detection condition:
$a at pe.entry_point

Full rule:
rule AVP_Antiviral_Database: PEiD
{
    strings:
        $a = { 41 56 50 20 41 6E 74 69 76 69 72 61 6C 20 44 61 74 61 62 61 73 65 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CA_Visual_Objects_V20_25
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 89 25 ?? ?? ?? ?? 33 ED 55 8B EC E8 ?? ?? ?? ?? 8B D0 81 E2 FF 00 00 00 89 15 ?? ?? ?? ?? 8B D0 C1 EA 08 81 E2 FF 00 00 00 A3 ?? ?? ?? ?? D1 E0 0F 93 C3 33 C0 8A C3 A3 ?? ?? ?? ?? 68 FF 00 00 00 E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? BB ?? ?? ?? ?? C7 03 44 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CA_Visual_Objects_V20_25: PEiD
{
    strings:
        $a = { 89 25 ?? ?? ?? ?? 33 ED 55 8B EC E8 ?? ?? ?? ?? 8B D0 81 E2 FF 00 00 00 89 15 ?? ?? ?? ?? 8B D0 C1 EA 08 81 E2 FF 00 00 00 A3 ?? ?? ?? ?? D1 E0 0F 93 C3 33 C0 8A C3 A3 ?? ?? ?? ?? 68 FF 00 00 00 E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? BB ?? ?? ?? ?? C7 03 44 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RCryptor_V16c_Vaska
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RCryptor_V16c_Vaska: PEiD
{
    strings:
        $a = { 8B C7 03 04 24 2B C7 80 38 50 0F 85 1B 8B 1F FF 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AverCryptor_10_os1r1s
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED 75 17 40 00 8B BD 9C 18 40 00 8B 8D A4 18 40 00 B8 BC 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 A0 18 40 00 33 C0 51 33 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 A0 18 40 00 8B 85 A8 18 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 8B F1 E8 27 00 00 00 8B C8 5F B8 BC 18 40 00 03 C5 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 98 18 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 23 F7 8B C6 5F 5E C3 }
        $b = { 60 E8 00 00 00 00 5D 81 ED 75 17 40 00 8B BD 9C 18 40 00 8B 8D A4 18 40 00 B8 BC 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 A0 18 40 00 33 C0 51 33 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 A0 18 40 00 8B 85 A8 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule AverCryptor_10_os1r1s: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 75 17 40 00 8B BD 9C 18 40 00 8B 8D A4 18 40 00 B8 BC 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 A0 18 40 00 33 C0 51 33 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 A0 18 40 00 8B 85 A8 18 40 00 83 F8 02 75 06 81 C2 00 02 00 00 51 8B 4F 10 83 F8 02 75 06 81 E9 00 02 00 00 57 BF C8 00 00 00 8B F1 E8 27 00 00 00 8B C8 5F B8 BC 18 40 00 03 C5 E8 24 00 00 00 59 49 EB B1 59 83 C7 28 49 EB 8A 8B 85 98 18 40 00 89 44 24 1C 61 FF E0 56 57 4F F7 D7 23 F7 8B C6 5F 5E C3 }
        $b = { 60 E8 00 00 00 00 5D 81 ED 75 17 40 00 8B BD 9C 18 40 00 8B 8D A4 18 40 00 B8 BC 18 40 00 03 C5 80 30 05 83 F9 00 74 71 81 7F 1C AB 00 00 00 75 62 8B 57 0C 03 95 A0 18 40 00 33 C0 51 33 C9 66 B9 FA 00 66 83 F9 00 74 49 8B 57 0C 03 95 A0 18 40 00 8B 85 A8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: UPX_v0761_dos_exe
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B9 ?? ?? BE ?? ?? 89 F7 1E A9 ?? ?? 8C C8 05 ?? ?? 8E D8 05 ?? ?? 8E C0 FD F3 A5 FC }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPX_v0761_dos_exe: PEiD
{
    strings:
        $a = { B9 ?? ?? BE ?? ?? 89 F7 1E A9 ?? ?? 8C C8 05 ?? ?? 8E D8 05 ?? ?? 8E C0 FD F3 A5 FC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PE_Armor_0460_0759_hying_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PE_Armor_0460_0759_hying_additional: PEiD
{
    strings:
        $a = { 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 45 52 4E 45 4C 33 32 2E 64 6C 6C 00 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 47 65 74 4D 6F 64 75 6C 65 48 61 6E 64 6C 65 41 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Minke_101_by_Codius
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 F0 53 ?? ?? ?? ?? ?? 10 E8 7A F6 FF FF BE 68 66 00 10 33 C0 55 68 DB 40 00 10 64 FF 30 64 89 20 E8 FA F8 FF FF BA EC 40 00 10 8B C6 E8 F2 FA FF FF 8B D8 B8 6C 66 00 10 8B 16 E8 88 F2 FF FF B8 6C 66 00 10 E8 76 F2 FF FF 8B D0 8B C3 8B 0E E8 E3 E4 FF FF E8 2A F9 FF FF E8 C1 F8 FF FF B8 6C 66 00 10 8B 16 E8 6D FA FF FF E8 14 F9 FF FF E8 AB F8 FF FF 8B 06 E8 B8 E3 FF FF 8B D8 B8 6C 66 00 10 E8 38 F2 FF FF 8B D3 8B 0E E8 A7 E4 FF ?? ?? ?? ?? C4 FB FF FF E8 E7 F8 FF FF 8B C3 E8 B0 E3 FF FF E8 DB F8 FF FF 33 C0 5A 59 59 64 89 10 68 E2 40 00 10 C3 E9 50 EB FF FF EB F8 5E 5B E8 BB EF FF FF 00 00 00 43 41 31 38 }
        $b = { 55 8B EC 83 C4 F0 53 ?? ?? ?? ?? ?? 10 E8 7A F6 FF FF BE 68 66 00 10 33 C0 55 68 DB 40 00 10 64 FF 30 64 89 20 E8 FA F8 FF FF BA EC 40 00 10 8B C6 E8 F2 FA FF FF 8B D8 B8 6C 66 00 10 8B 16 E8 88 F2 FF FF B8 6C 66 00 10 E8 76 F2 FF FF 8B D0 8B C3 8B 0E E8 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Minke_101_by_Codius: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 F0 53 ?? ?? ?? ?? ?? 10 E8 7A F6 FF FF BE 68 66 00 10 33 C0 55 68 DB 40 00 10 64 FF 30 64 89 20 E8 FA F8 FF FF BA EC 40 00 10 8B C6 E8 F2 FA FF FF 8B D8 B8 6C 66 00 10 8B 16 E8 88 F2 FF FF B8 6C 66 00 10 E8 76 F2 FF FF 8B D0 8B C3 8B 0E E8 E3 E4 FF FF E8 2A F9 FF FF E8 C1 F8 FF FF B8 6C 66 00 10 8B 16 E8 6D FA FF FF E8 14 F9 FF FF E8 AB F8 FF FF 8B 06 E8 B8 E3 FF FF 8B D8 B8 6C 66 00 10 E8 38 F2 FF FF 8B D3 8B 0E E8 A7 E4 FF ?? ?? ?? ?? C4 FB FF FF E8 E7 F8 FF FF 8B C3 E8 B0 E3 FF FF E8 DB F8 FF FF 33 C0 5A 59 59 64 89 10 68 E2 40 00 10 C3 E9 50 EB FF FF EB F8 5E 5B E8 BB EF FF FF 00 00 00 43 41 31 38 }
        $b = { 55 8B EC 83 C4 F0 53 ?? ?? ?? ?? ?? 10 E8 7A F6 FF FF BE 68 66 00 10 33 C0 55 68 DB 40 00 10 64 FF 30 64 89 20 E8 FA F8 FF FF BA EC 40 00 10 8B C6 E8 F2 FA FF FF 8B D8 B8 6C 66 00 10 8B 16 E8 88 F2 FF FF B8 6C 66 00 10 E8 76 F2 FF FF 8B D0 8B C3 8B 0E E8 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Vx_Phoenix927_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 00 00 5E 81 C6 ?? ?? BF 00 01 B9 04 00 F3 A4 E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Phoenix927_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E8 00 00 5E 81 C6 ?? ?? BF 00 01 B9 04 00 F3 A4 E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Interchange_Format_File_IFF_type_WVQA
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 46 4F 52 4D ?? ?? ?? ?? 57 56 51 41 56 51 48 44 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Interchange_Format_File_IFF_type_WVQA: PEiD
{
    strings:
        $a = { 46 4F 52 4D ?? ?? ?? ?? 57 56 51 41 56 51 48 44 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Free_Pascal_106
Repository: Yara-Rules/rules

Pattern signatures:
$a = { C6 05 ?? ?? 40 00 ?? E8 ?? ?? 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Free_Pascal_106: PEiD
{
    strings:
        $a = { C6 05 ?? ?? 40 00 ?? E8 ?? ?? 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Prepared_by_SLR_OPTLINK_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 87 C0 55 56 57 52 51 53 50 9C FC 8C DA 83 ?? ?? 16 07 0E 1F }

Detection condition:
$a at pe.entry_point

Full rule:
rule Prepared_by_SLR_OPTLINK_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 87 C0 55 56 57 52 51 53 50 9C FC 8C DA 83 ?? ?? 16 07 0E 1F }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: iLUCRYPT_v4018_EXE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B EC FA C7 ?? ?? ?? ?? 4C 4C C3 FB BF ?? ?? B8 ?? ?? 2E ?? ?? D1 C8 4F 81 }

Detection condition:
$a at pe.entry_point

Full rule:
rule iLUCRYPT_v4018_EXE: PEiD
{
    strings:
        $a = { 8B EC FA C7 ?? ?? ?? ?? 4C 4C C3 FB BF ?? ?? B8 ?? ?? 2E ?? ?? D1 C8 4F 81 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Obsidium_V130X_Obsidium_Software_Sign_by_fly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B ?? ?? ?? EB 04 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsidium_V130X_Obsidium_Software_Sign_by_fly: PEiD
{
    strings:
        $a = { EB 03 ?? ?? ?? E8 2E 00 00 00 EB 04 ?? ?? ?? ?? EB 04 ?? ?? ?? ?? 8B ?? ?? ?? EB 04 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? EB 01 ?? 33 C0 EB 04 ?? ?? ?? ?? C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASPack_V22_Alexey_Solodovnikov_StarForce_2009408
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD ?? ?? ?? ?? ?? ?? 83 BD 7D 04 00 00 00 89 9D 7D 04 00 00 0F 85 C0 03 00 00 8D 85 89 04 00 00 50 FF 95 09 0F 00 00 89 85 81 04 00 00 8B F0 8D 7D 51 57 56 FF 95 05 0F 00 00 AB B0 00 AE 75 FD 38 07 75 EE 8D 45 7A FF E0 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 56 69 72 74 75 61 6C 46 72 65 65 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 8B 9D 8D 05 00 00 0B DB 74 0A 8B 03 87 85 91 05 00 00 89 03 8D B5 BD 05 00 00 83 3E 00 0F 84 15 01 00 00 6A 04 68 00 10 00 00 68 00 18 00 00 6A 00 FF 55 51 89 85 53 01 00 00 8B 46 04 05 0E 01 00 00 6A 04 68 00 10 00 00 50 6A 00 FF 55 51 89 85 4F 01 00 00 56 8B 1E 03 9D 7D 04 00 00 FF B5 53 01 00 00 FF 76 04 50 53 E8 2D 05 00 00 B3 00 80 FB 00 75 5E FE 85 E9 00 00 00 8B 3E 03 BD 7D 04 00 00 FF 37 C6 07 C3 FF D7 8F 07 50 51 56 53 8B C8 83 E9 06 8B B5 4F 01 00 00 33 DB 0B C9 74 2E 78 2C AC 3C E8 74 0A EB 00 3C E9 74 04 43 49 EB EB 8B 06 EB 00 ?? ?? ?? 75 F3 24 00 C1 C0 

Detection condition:
$a at pe.entry_point

Full rule:
rule ASPack_V22_Alexey_Solodovnikov_StarForce_2009408: PEiD
{
    strings:
        $a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD ?? ?? ?? ?? ?? ?? 83 BD 7D 04 00 00 00 89 9D 7D 04 00 00 0F 85 C0 03 00 00 8D 85 89 04 00 00 50 FF 95 09 0F 00 00 89 85 81 04 00 00 8B F0 8D 7D 51 57 56 FF 95 05 0F 00 00 AB B0 00 AE 75 FD 38 07 75 EE 8D 45 7A FF E0 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 56 69 72 74 75 61 6C 46 72 65 65 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 8B 9D 8D 05 00 00 0B DB 74 0A 8B 03 87 85 91 05 00 00 89 03 8D B5 BD 05 00 00 83 3E 00 0F 84 15 01 00 00 6A 04 68 00 10 00 00 68 00 18 00 00 6A 00 FF 55 51 89 85 53 01 00 00 8B 46 04 05 0E 01 00 00 6A 04 68 00 10 00 00 50 6A 00 FF 55 51 89 85 4F 01 00 00 56 8B 1E 03 9D 7D 04 00 00 FF B5 53 01 00 00 FF 76 04 50 53 E8 2D 05 00 00 B3 00 80 FB 00 75 5E FE 85 E9 00 00 00 8B 3E 03 BD 7D 04 00 00 FF 37 C6 07 C3 FF D7 8F 07 50 51 56 53 8B C8 83 E9 06 8B B5 4F 01 00 00 33 DB 0B C9 74 2E 78 2C AC 3C E8 74 0A EB 00 3C E9 74 04 43 49 EB EB 8B 06 EB 00 ?? ?? ?? 75 F3 24 00 C1 C0 18 2B C3 89 06 83 C3 05 83 C6 04 83 E9 05 EB CE 5B 5E 59 58 EB 08 }
    condition:
        $a at pe.entry_point

}