deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: CALS_Raster_graphics_format
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 73 72 63 64 6F 63 69 64 3A 20 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CALS_Raster_graphics_format: PEiD
{
    strings:
        $a = { 73 72 63 64 6F 63 69 64 3A 20 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXE2COM_regular_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 8C CA 81 C3 ?? ?? 3B 16 ?? ?? 76 ?? BA ?? ?? B4 09 CD 21 CD 20 0D }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXE2COM_regular_additional: PEiD
{
    strings:
        $a = { E9 8C CA 81 C3 ?? ?? 3B 16 ?? ?? 76 ?? BA ?? ?? B4 09 CD 21 CD 20 0D }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: WWPACK_v300_v301_Relocations_pack_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE ?? ?? BA ?? ?? BF ?? ?? B9 ?? ?? 8C CD 8E DD 81 ED ?? ?? 06 06 8B DD 2B DA 8B D3 FC }

Detection condition:
$a at pe.entry_point

Full rule:
rule WWPACK_v300_v301_Relocations_pack_Hint_DOS_EP: PEiD
{
    strings:
        $a = { BE ?? ?? BA ?? ?? BF ?? ?? B9 ?? ?? 8C CD 8E DD 81 ED ?? ?? 06 06 8B DD 2B DA 8B D3 FC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: dePACK_deNULL_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? ?? 00 E8 ?? 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule dePACK_deNULL_additional: PEiD
{
    strings:
        $a = { EB 01 DD 60 68 00 ?? ?? ?? 68 ?? ?? ?? 00 E8 ?? 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Obsidium_1250_Obsidium_Software_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsidium_1250_Obsidium_Software_additional: PEiD
{
    strings:
        $a = { E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MicroJoiner_15_coban2k_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BF 00 ?? 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8 ?? ?? ?? 00 8B 30 8B 78 04 BB ?? ?? ?? 00 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 5E EB DB B9 ?? ?? 00 00 BE 00 ?? ?? 00 EB 01 00 BF ?? ?? ?? 00 EB 21 00 ?? ?? 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 00 C0 00 F3 A4 E9 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 00 C0 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C }

Detection condition:
$a at pe.entry_point

Full rule:
rule MicroJoiner_15_coban2k_additional: PEiD
{
    strings:
        $a = { BF 00 ?? 40 00 BE ?? ?? ?? 00 E8 9D 00 00 00 B8 ?? ?? ?? 00 8B 30 8B 78 04 BB ?? ?? ?? 00 8B 43 04 91 E3 1F 51 FF D6 56 96 8B 13 8B 02 91 E3 0D 52 51 56 FF D7 5A 89 02 83 C2 04 EB EE 83 C3 08 5E EB DB B9 ?? ?? 00 00 BE 00 ?? ?? 00 EB 01 00 BF ?? ?? ?? 00 EB 21 00 ?? ?? 00 00 ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 00 C0 00 F3 A4 E9 ?? ?? ?? 00 00 ?? ?? 00 00 ?? ?? 00 ?? ?? ?? 00 00 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 00 C0 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 FC B2 80 31 DB A4 B3 02 E8 6D 00 00 00 73 F6 31 C9 E8 64 00 00 00 73 1C 31 C0 E8 5B 00 00 00 73 23 B3 02 41 B0 10 E8 4F 00 00 00 10 C0 73 F7 75 3F AA EB D4 E8 4D 00 00 00 29 D9 75 10 E8 42 00 00 00 EB 28 AC D1 E8 74 4D 11 C9 EB 1C 91 48 C1 E0 08 AC E8 2C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Stones_PE_Encryptor_v20_Stone
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 53 51 52 56 57 55 E8 00 00 00 00 5D 81 ED 42 30 40 ?? FF 95 32 35 40 ?? B8 37 30 40 ?? 03 C5 2B 85 1B 34 40 ?? 89 85 27 34 40 ?? 83 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Stones_PE_Encryptor_v20_Stone: PEiD
{
    strings:
        $a = { 53 51 52 56 57 55 E8 00 00 00 00 5D 81 ED 42 30 40 ?? FF 95 32 35 40 ?? B8 37 30 40 ?? 03 C5 2B 85 1B 34 40 ?? 89 85 27 34 40 ?? 83 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Exact_Audio_Copy_UnknownCompiler
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? ?? 00 31 ED 55 89 E5 81 EC ?? 00 00 00 8D BD ?? FF FF FF B9 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Exact_Audio_Copy_UnknownCompiler: PEiD
{
    strings:
        $a = { E8 ?? ?? ?? 00 31 ED 55 89 E5 81 EC ?? 00 00 00 8D BD ?? FF FF FF B9 ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXEPACK_LINK_v360_v364_v365_or_50121_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 ?? ?? ?? 8E C0 8B ?? ?? ?? 8B ?? 4F 8B F7 FD F3 A4 50 B8 ?? ?? 50 CB }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXEPACK_LINK_v360_v364_v365_or_50121_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 8C C0 05 ?? ?? 0E 1F A3 ?? ?? 03 ?? ?? ?? 8E C0 8B ?? ?? ?? 8B ?? 4F 8B F7 FD F3 A4 50 B8 ?? ?? 50 CB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ass_crypter_by_santasdad_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 98 40 00 10 E8 AC EA FF FF 33 C0 55 68 78 51 00 10 64 ?? ?? ?? ?? 20 6A 0A 68 88 51 00 10 A1 E0 97 00 10 50 E8 D8 EA FF FF 8B D8 53 A1 E0 97 00 10 50 E8 12 EB FF FF 8B F8 53 A1 E0 97 00 10 50 E8 DC EA FF FF 8B }

Detection condition:
$a at pe.entry_point

Full rule:
rule ass_crypter_by_santasdad_additional: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 EC 53 ?? ?? ?? ?? 89 45 EC B8 98 40 00 10 E8 AC EA FF FF 33 C0 55 68 78 51 00 10 64 ?? ?? ?? ?? 20 6A 0A 68 88 51 00 10 A1 E0 97 00 10 50 E8 D8 EA FF FF 8B D8 53 A1 E0 97 00 10 50 E8 12 EB FF FF 8B F8 53 A1 E0 97 00 10 50 E8 DC EA FF FF 8B }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Prepared_by_SLR_OPTLINK
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 87 C0 55 56 57 52 51 53 50 9C FC 8C DA 83 ?? ?? 16 07 0E 1F }

Detection condition:
$a at pe.entry_point

Full rule:
rule Prepared_by_SLR_OPTLINK: PEiD
{
    strings:
        $a = { 87 C0 55 56 57 52 51 53 50 9C FC 8C DA 83 ?? ?? 16 07 0E 1F }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Encrypted_by_RSCC286_v101
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FE 52 53 43 43 2F 31 2E 30 31 FE }

Detection condition:
$a at pe.entry_point

Full rule:
rule Encrypted_by_RSCC286_v101: PEiD
{
    strings:
        $a = { FE 52 53 43 43 2F 31 2E 30 31 FE }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FCRYPT_v100_1990_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? 50 53 51 BE ?? ?? BF ?? ?? 8B EF B9 ?? ?? FC AC 32 C1 AA E2 ?? 59 5B 58 FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule FCRYPT_v100_1990_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? 50 53 51 BE ?? ?? BF ?? ?? 8B EF B9 ?? ?? FC AC 32 C1 AA E2 ?? 59 5B 58 FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MultiEdits_compiled_macros
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 1E AA }

Detection condition:
$a at pe.entry_point

Full rule:
rule MultiEdits_compiled_macros: PEiD
{
    strings:
        $a = { 1E AA }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PKTiny_162
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 1E 0E 1F B8 F0 FF 8E C0 26 8A 1E 0E 00 80 FB FD 72 0E B4 09 BA 58 01 CD 21 1F B8 00 4C CD 21 E9 FA 55 89 E5 8D 06 46 00 05 00 01 50 83 C4 02 31 DB C7 07 E9 DD C7 47 02 01 F4 C7 87 57 02 B9 08 8B 5E FE FF E3 EA FB 31 DB B8 0D 0E CD 10 B4 03 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PKTiny_162: PEiD
{
    strings:
        $a = { 1E 0E 1F B8 F0 FF 8E C0 26 8A 1E 0E 00 80 FB FD 72 0E B4 09 BA 58 01 CD 21 1F B8 00 4C CD 21 E9 FA 55 89 E5 8D 06 46 00 05 00 01 50 83 C4 02 31 DB C7 07 E9 DD C7 47 02 01 F4 C7 87 57 02 B9 08 8B 5E FE FF E3 EA FB 31 DB B8 0D 0E CD 10 B4 03 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: XorCom_v10_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? FC BE ?? ?? BF ?? ?? 57 B9 ?? ?? AC 34 ?? AA E2 ?? C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule XorCom_v10_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? FC BE ?? ?? BF ?? ?? 57 B9 ?? ?? AC 34 ?? AA E2 ?? C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Noon1163
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? 5B 50 56 B4 CB CD 21 3C 07 ?? ?? 81 ?? ?? ?? 2E ?? ?? 4D 5A ?? ?? BF 00 01 89 DE FC }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Noon1163: PEiD
{
    strings:
        $a = { E8 ?? ?? 5B 50 56 B4 CB CD 21 3C 07 ?? ?? 81 ?? ?? ?? 2E ?? ?? 4D 5A ?? ?? BF 00 01 89 DE FC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_022_023_beta_Dwing
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 }
        $b = { 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 59 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Upack_022_023_beta_Dwing: PEiD
{
    strings:
        $a = { 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 }
        $b = { 6A 07 BE 88 01 40 00 AD 8B F8 59 95 F3 A5 AD B5 ?? F3 AB AD 50 97 51 58 8D 54 85 5C FF 16 72 59 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 ?? B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Pelock_10x
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 4B 45 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Pelock_10x: PEiD
{
    strings:
        $a = { 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 4B 45 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: beria_v007_public_WIP_symbiont
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0 }

Detection condition:
$a at pe.entry_point

Full rule:
rule beria_v007_public_WIP_symbiont: PEiD
{
    strings:
        $a = { 83 EC 18 53 8B 1D 00 30 ?? ?? 55 56 57 68 30 07 00 00 33 ED 55 FF D3 8B F0 3B F5 74 0D 89 AE 20 07 00 00 E8 88 0F 00 00 EB 02 33 F6 6A 10 55 89 35 30 40 ?? ?? FF D3 8B F0 3B F5 74 09 89 2E E8 3C FE FF FF EB 02 33 F6 6A 18 55 89 35 D8 43 ?? ?? FF D3 8B F0 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MSLRH_v032a_fake_ASPack_211d_emadicius_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule MSLRH_v032a_fake_ASPack_211d_emadicius_h: PEiD
{
    strings:
        $a = { 60 E8 02 00 00 00 EB 09 5D 55 81 ED 39 39 44 00 C3 61 EB 05 E8 EB 04 40 00 EB FA E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF 83 C4 08 74 04 75 02 EB 02 EB 01 81 50 E8 02 00 00 00 29 5A 58 6B C0 03 E8 02 00 00 00 29 5A 83 C4 04 58 74 04 75 02 EB 02 EB 01 81 0F 31 50 0F 31 E8 0A 00 00 00 E8 EB 0C 00 00 E8 F6 FF FF FF E8 F2 FF FF FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MASMTASM_sig2
Repository: Yara-Rules/rules

Pattern signatures:
$a = { C2 ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MASMTASM_sig2: PEiD
{
    strings:
        $a = { C2 ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MASMTASM_sig1
Repository: Yara-Rules/rules

Pattern signatures:
$a = { CC FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MASMTASM_sig1: PEiD
{
    strings:
        $a = { CC FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 FF 25 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Rpoly_crypt_by_Vaska_200307_1841
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 58 ?? ?? ?? ?? ?? ?? ?? E8 00 00 00 58 E8 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? 04 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Rpoly_crypt_by_Vaska_200307_1841: PEiD
{
    strings:
        $a = { 58 ?? ?? ?? ?? ?? ?? ?? E8 00 00 00 58 E8 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? 04 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Hafen809
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? 1C ?? 81 EE ?? ?? 50 1E 06 8C C8 8E D8 06 33 C0 8E C0 26 ?? ?? ?? 07 3D }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Hafen809: PEiD
{
    strings:
        $a = { E8 ?? ?? 1C ?? 81 EE ?? ?? 50 1E 06 8C C8 8E D8 06 33 C0 8E C0 26 ?? ?? ?? 07 3D }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PROTECT_EXECOM_v60_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 1E B4 30 CD 21 3C 02 73 ?? CD 20 BE ?? ?? E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PROTECT_EXECOM_v60_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 1E B4 30 CD 21 3C 02 73 ?? CD 20 BE ?? ?? E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASPack_105b_by_Hint_WIN_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 75 00 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASPack_105b_by_Hint_WIN_EP: PEiD
{
    strings:
        $a = { 75 00 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PureBasic_4x_Neil_Hodgson_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 ?? ?? 00 00 68 00 00 00 00 68 ?? ?? ?? 00 E8 ?? ?? ?? 00 83 C4 0C 68 00 00 00 00 E8 ?? ?? ?? 00 A3 ?? ?? ?? 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? ?? ?? 00 A3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PureBasic_4x_Neil_Hodgson_additional: PEiD
{
    strings:
        $a = { 68 ?? ?? 00 00 68 00 00 00 00 68 ?? ?? ?? 00 E8 ?? ?? ?? 00 83 C4 0C 68 00 00 00 00 E8 ?? ?? ?? 00 A3 ?? ?? ?? 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? ?? ?? 00 A3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: tElock_v041x_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? 02 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule tElock_v041x_additional: PEiD
{
    strings:
        $a = { E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 00 00 00 00 ?? ?? 02 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASProtect_v12x_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 68 01 ?? ?? ?? C3 AA }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASProtect_v12x_additional: PEiD
{
    strings:
        $a = { 00 00 68 01 ?? ?? ?? C3 AA }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RLPack_120_Basic_Edition_aPLib_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RLPack_120_Basic_Edition_aPLib_additional: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 8B 2C 24 83 C4 04 83 7C 24 28 01 75 0C 8B 44 24 24 89 85 92 05 00 00 EB 0C 8B 85 8E 05 00 00 89 85 92 05 00 00 8D B5 BA 05 00 00 8D 9D 41 04 00 00 33 FF E8 38 01 00 00 EB 1B 8B 85 92 05 00 00 FF 74 37 04 01 04 24 FF 34 37 01 04 24 FF D3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Werus_Crypter_10_by_Kas_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BB E8 12 40 00 80 33 05 E9 7D FF FF FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule Werus_Crypter_10_by_Kas_additional: PEiD
{
    strings:
        $a = { BB E8 12 40 00 80 33 05 E9 7D FF FF FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Macromedia_Windows_Flash_ProjectorPlayer_v50_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C }

Detection condition:
$a at pe.entry_point

Full rule:
rule Macromedia_Windows_Flash_ProjectorPlayer_v50_additional: PEiD
{
    strings:
        $a = { 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPX_v30_DLL_LZMA_Markus_Oberhumer_Laszlo_Molnar_John_Reiser_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 80 7C 24 08 01 0F 85 C7 0B 00 00 60 BE 00 ?? ?? ?? 8D BE 00 ?? ?? FF 57 89 E5 8D 9C 24 80 C1 FF FF 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPX_v30_DLL_LZMA_Markus_Oberhumer_Laszlo_Molnar_John_Reiser_additional: PEiD
{
    strings:
        $a = { 80 7C 24 08 01 0F 85 C7 0B 00 00 60 BE 00 ?? ?? ?? 8D BE 00 ?? ?? FF 57 89 E5 8D 9C 24 80 C1 FF FF 31 C0 50 39 DC 75 FB 46 46 53 68 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Thinstall_2628_Jtit
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Thinstall_2628_Jtit: PEiD
{
    strings:
        $a = { E8 00 00 00 00 58 BB 34 1D 00 00 2B C3 50 68 00 00 40 00 68 00 40 00 00 68 BC 00 00 00 E8 C3 FE FF FF E9 99 FF FF FF CC CC CC CC CC CC CC CC CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Themida_10xx_18xx_no_compression_Oreans_Technologies_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00 }
        $b = { 55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8D 45 80 8B 5D 08 C7 85 7C FF FF FF 00 00 00 00 8B 8D 7C FF FF FF D1 C3 88 18 41 89 8D 7C FF FF FF 81 BD 7C FF FF FF 80 00 00 00 75 E3 C7 85 7C FF FF FF 00 00 00 00 8D BA ?? ?? ?? ?? 8D 75 80 8A 0E BB F4 01 00 00 B8 AB 37 54 78 D3 D0 8A 0F D3 D0 4B 75 F7 0F AF C3 47 46 8B 8D 7C FF FF FF 41 89 8D 7C FF FF FF 81 F9 80 00 00 00 75 D1 61 C9 C2 04 00 55 8B EC 83 C4 F0 8B 75 08 C7 45 FC 00 00 00 00 EB 04 FF 45 FC 46 80 3E 00 75 F7 BA 00 00 00 00 8

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Themida_10xx_18xx_no_compression_Oreans_Technologies_h: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00 }
        $b = { 55 8B EC 83 C4 D8 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8B DA C7 45 D8 00 00 00 00 8B 45 D8 40 89 45 D8 81 7D D8 80 00 00 00 74 0F 8B 45 08 89 83 ?? ?? ?? ?? FF 45 08 43 EB E1 89 45 DC 61 8B 45 DC C9 C2 04 00 55 8B EC 81 C4 7C FF FF FF 60 E8 00 00 00 00 5A 81 EA ?? ?? ?? ?? 8D 45 80 8B 5D 08 C7 85 7C FF FF FF 00 00 00 00 8B 8D 7C FF FF FF D1 C3 88 18 41 89 8D 7C FF FF FF 81 BD 7C FF FF FF 80 00 00 00 75 E3 C7 85 7C FF FF FF 00 00 00 00 8D BA ?? ?? ?? ?? 8D 75 80 8A 0E BB F4 01 00 00 B8 AB 37 54 78 D3 D0 8A 0F D3 D0 4B 75 F7 0F AF C3 47 46 8B 8D 7C FF FF FF 41 89 8D 7C FF FF FF 81 F9 80 00 00 00 75 D1 61 C9 C2 04 00 55 8B EC 83 C4 F0 8B 75 08 C7 45 FC 00 00 00 00 EB 04 FF 45 FC 46 80 3E 00 75 F7 BA 00 00 00 00 8B 75 08 8B 7D 0C EB 7F C7 45 F8 00 00 00 00 EB }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: aPack_061_COM
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8C C8 05 00 00 8E C0 59 8E D0 51 BE 8B 01 BF 00 01 50 57 FC B6 01 BD 6C 01 FF D5 73 4C FF D5 73 18 FF D5 73 2A BB 83 01 33 C9 FF D3 FF D3 FF D3 FF D3 8B D9 43 B1 01 EB 26 E8 3B 00 49 49 AC 8A E1 93 E8 32 00 83 FB 40 73 15 83 C1 04 EB 10 AC }

Detection condition:
$a at pe.entry_point

Full rule:
rule aPack_061_COM: PEiD
{
    strings:
        $a = { 8C C8 05 00 00 8E C0 59 8E D0 51 BE 8B 01 BF 00 01 50 57 FC B6 01 BD 6C 01 FF D5 73 4C FF D5 73 18 FF D5 73 2A BB 83 01 33 C9 FF D3 FF D3 FF D3 FF D3 8B D9 43 B1 01 EB 26 E8 3B 00 49 49 AC 8A E1 93 E8 32 00 83 FB 40 73 15 83 C1 04 EB 10 AC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_02_PENightMare_2_Beta
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_02_PENightMare_2_Beta: PEiD
{
    strings:
        $a = { 60 E9 10 00 00 00 EF 40 03 A7 07 8F 07 1C 37 5D 43 A7 04 B9 2C 3A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MinGW_GCC_3x_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? ?? E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? 55 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MinGW_GCC_3x_additional: PEiD
{
    strings:
        $a = { 55 89 E5 83 EC 08 C7 04 24 ?? 00 00 00 FF 15 ?? ?? ?? ?? E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? 55 }
    condition:
        $a at pe.entry_point

}