deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: COP_10
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BF E8 00 BE 1C 01 B9 18 00 AC 32 06 09 01 AA E2 F8 8B 16 18 01 EB D1 90 68 00 00 00 12 98 AD 3C 13 AC AD 3C 27 A2 B6 AD 7D 45 27 BA B4 AD 01 9D 7C 07 4E 56 }

Detection condition:
$a at pe.entry_point

Full rule:
rule COP_10: PEiD
{
    strings:
        $a = { BF E8 00 BE 1C 01 B9 18 00 AC 32 06 09 01 AA E2 F8 8B 16 18 01 EB D1 90 68 00 00 00 12 98 AD 3C 13 AC AD 3C 27 A2 B6 AD 7D 45 27 BA B4 AD 01 9D 7C 07 4E 56 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXE32Pack_v137
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED 4C 8E 40 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXE32Pack_v137: PEiD
{
    strings:
        $a = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED 4C 8E 40 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXE32Pack_v136
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED CC 8D 40 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXE32Pack_v136: PEiD
{
    strings:
        $a = { 3B C0 74 02 81 83 55 3B C0 74 02 81 83 53 3B C9 74 01 BC ?? ?? ?? ?? 02 81 ?? ?? ?? ?? ?? ?? ?? 3B DB 74 01 BE 5D 8B D5 81 ED CC 8D 40 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: y0das_Crypter_v1x_Modified
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? B9 ?? ?? 00 00 8D BD ?? ?? ?? ?? 8B F7 AC }

Detection condition:
$a at pe.entry_point

Full rule:
rule y0das_Crypter_v1x_Modified: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED ?? ?? ?? ?? B9 ?? ?? 00 00 8D BD ?? ?? ?? ?? 8B F7 AC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Obsidium_V1322_Obsidium_Software
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 04 ?? ?? ?? ?? E8 2A 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsidium_V1322_Obsidium_Software: PEiD
{
    strings:
        $a = { EB 04 ?? ?? ?? ?? E8 2A 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Adobe_PhotoShop_Graphics_format_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 38 42 50 53 00 01 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Adobe_PhotoShop_Graphics_format_Hint_FILE_START: PEiD
{
    strings:
        $a = { 38 42 50 53 00 01 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_01_Microsoft_Visual_Cpp_60_Debug_Version_Anorganix_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 10 01 90 90 90 90 90 90 90 90 E8 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_01_Microsoft_Visual_Cpp_60_Debug_Version_Anorganix_additional: PEiD
{
    strings:
        $a = { 55 8B EC 51 90 90 90 01 01 90 90 90 90 68 ?? ?? ?? ?? 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 00 01 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 10 01 90 90 90 90 90 90 90 90 E8 00 00 00 00 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 90 EB 02 00 00 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_02_Microsoft_Visual_Cpp_70_DLL_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_02_Microsoft_Visual_Cpp_70_DLL_Anorganix: PEiD
{
    strings:
        $a = { 55 8D 6C 01 00 81 EC 00 00 00 00 8B 45 90 83 F8 01 56 0F 84 00 00 00 00 85 C0 0F 84 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RECSmall_v102_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8C D8 1E E8 ?? ?? 83 ?? ?? 5D B9 ?? ?? 81 ?? ?? ?? 40 8E D8 2B DB B2 ?? ?? ?? FE C2 43 83 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RECSmall_v102_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 8C D8 1E E8 ?? ?? 83 ?? ?? 5D B9 ?? ?? 81 ?? ?? ?? 40 8E D8 2B DB B2 ?? ?? ?? FE C2 43 83 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_1242_1243
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 00 87 DD 8B 85 A6 70 40 00 01 85 03 70 40 00 66 C7 85 00 70 40 00 90 90 01 85 9E 70 40 00 BB D2 09 00 00 03 9D AA 70 40 00 03 9D A6 70 40 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_1242_1243: PEiD
{
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 70 40 00 87 DD 8B 85 A6 70 40 00 01 85 03 70 40 00 66 C7 85 00 70 40 00 90 90 01 85 9E 70 40 00 BB D2 09 00 00 03 9D AA 70 40 00 03 9D A6 70 40 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_02_Borland_Cue_1999
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 A1 ?? ?? ?? ?? A3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_02_Borland_Cue_1999: PEiD
{
    strings:
        $a = { EB 10 66 62 3A 43 2B 2B 48 4F 4F 4B 90 E9 90 90 90 90 A1 ?? ?? ?? ?? A3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AntiDote_14_SE_SIS_Team
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 90 03 00 00 E8 C6 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 4F 68 04 01 00 00 68 10 22 60 00 6A 00 FF 15 08 10 60 00 68 90 03 00 00 E8 68 FD FF FF 68 69 D6 00 00 E8 5E FD FF FF 50 E8 58 FD FF FF 50 E8 52 FD FF FF E8 DD FE FF FF 50 68 A4 10 60 00 68 94 10 60 00 68 10 22 60 00 E8 58 FD FF FF 83 C4 20 33 C0 C2 10 00 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 }
        $b = { 68 90 03 00 00 E8 C6 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 4F 68 04 01 00 00 68 10 22 60 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule AntiDote_14_SE_SIS_Team: PEiD
{
    strings:
        $a = { 68 90 03 00 00 E8 C6 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 4F 68 04 01 00 00 68 10 22 60 00 6A 00 FF 15 08 10 60 00 68 90 03 00 00 E8 68 FD FF FF 68 69 D6 00 00 E8 5E FD FF FF 50 E8 58 FD FF FF 50 E8 52 FD FF FF E8 DD FE FF FF 50 68 A4 10 60 00 68 94 10 60 00 68 10 22 60 00 E8 58 FD FF FF 83 C4 20 33 C0 C2 10 00 8B 4C 24 08 56 8B 74 24 08 33 D2 8B C6 F7 F1 8B C6 85 D2 74 08 33 D2 F7 F1 40 0F AF C1 5E C3 }
        $b = { 68 90 03 00 00 E8 C6 FD FF FF 68 90 03 00 00 E8 BC FD FF FF 68 90 03 00 00 E8 B2 FD FF FF 50 E8 AC FD FF FF 50 E8 A6 FD FF FF 68 69 D6 00 00 E8 9C FD FF FF 50 E8 96 FD FF FF 50 E8 90 FD FF FF 83 C4 20 E8 78 FF FF FF 84 C0 74 4F 68 04 01 00 00 68 10 22 60 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: kryptor_8_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 6A 87 DB }

Detection condition:
$a at pe.entry_point

Full rule:
rule kryptor_8_additional: PEiD
{
    strings:
        $a = { EB 6A 87 DB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: XPack_131_166_COM
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8C C8 05 00 10 8E C0 BF 00 01 8B F7 FC B9 60 6D F3 A5 06 B8 77 01 50 CB 1E 06 1F 07 BE 00 02 BF 00 01 06 57 E8 11 00 33 C0 8B D8 8B C8 8B D0 8B F0 8B F8 8B E8 06 1F CB EB 1D 80 E2 0F 75 05 50 AD 8B E8 58 FE C2 03 ED C3 33 C9 E8 EC FF D1 D1 }

Detection condition:
$a at pe.entry_point

Full rule:
rule XPack_131_166_COM: PEiD
{
    strings:
        $a = { 8C C8 05 00 10 8E C0 BF 00 01 8B F7 FC B9 60 6D F3 A5 06 B8 77 01 50 CB 1E 06 1F 07 BE 00 02 BF 00 01 06 57 E8 11 00 33 C0 8B D8 8B C8 8B D0 8B F0 8B F8 8B E8 06 1F CB EB 1D 80 E2 0F 75 05 50 AD 8B E8 58 FE C2 03 ED C3 33 C9 E8 EC FF D1 D1 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Symantec_C_v210_v400_or_Zortech_C_v30r1
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FA FC B8 ?? ?? 8E D8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Symantec_C_v210_v400_or_Zortech_C_v30r1: PEiD
{
    strings:
        $a = { FA FC B8 ?? ?? 8E D8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CrypWrap_vxx_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 B8 ?? ?? ?? E8 90 02 ?? ?? 83 F8 ?? 75 07 6A ?? E8 ?? ?? ?? ?? FF 15 49 8F 40 ?? A9 ?? ?? ?? 80 74 0E }

Detection condition:
$a at pe.entry_point

Full rule:
rule CrypWrap_vxx_additional: PEiD
{
    strings:
        $a = { E8 B8 ?? ?? ?? E8 90 02 ?? ?? 83 F8 ?? 75 07 6A ?? E8 ?? ?? ?? ?? FF 15 49 8F 40 ?? A9 ?? ?? ?? 80 74 0E }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: nMacro_recorder_10
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 5C 6E 6D 72 5F 74 65 6D 70 2E 6E 6D 72 00 00 00 72 62 00 00 58 C7 41 00 10 F8 41 00 11 01 00 00 00 00 00 00 46 E1 00 00 46 E1 00 00 35 00 00 00 F6 88 41 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule nMacro_recorder_10: PEiD
{
    strings:
        $a = { 5C 6E 6D 72 5F 74 65 6D 70 2E 6E 6D 72 00 00 00 72 62 00 00 58 C7 41 00 10 F8 41 00 11 01 00 00 00 00 00 00 46 E1 00 00 46 E1 00 00 35 00 00 00 F6 88 41 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: First_Publisher_Graphics_format
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 ?? 01 00 00 ?? 02 }
        $b = { 00 00 ?? 00 00 00 ?? 01 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule First_Publisher_Graphics_format: PEiD
{
    strings:
        $a = { 00 00 ?? 01 00 00 ?? 02 }
        $b = { 00 00 ?? 00 00 00 ?? 01 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Gleam_v100
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 F0 60 E8 51 FF FF }
        $b = { 83 EC 0C 53 56 57 E8 24 02 00 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Gleam_v100: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 F0 60 E8 51 FF FF }
        $b = { 83 EC 0C 53 56 57 E8 24 02 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: FreeHand_Graphics_format
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 41 47 44 32 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FreeHand_Graphics_format: PEiD
{
    strings:
        $a = { 41 47 44 32 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Nakedbind_v10_nakedcrew
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B 4D 5A 74 08 81 EB 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Nakedbind_v10_nakedcrew: PEiD
{
    strings:
        $a = { 64 8B 38 48 8B C8 F2 AF AF 8B 1F 66 33 DB 66 81 3B 4D 5A 74 08 81 EB 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RCryptor_V15_Vaska
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? ?? EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RCryptor_V15_Vaska: PEiD
{
    strings:
        $a = { 83 2C 24 4F 68 ?? ?? ?? ?? FF 54 24 04 83 44 24 04 4F B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? ?? EB F3 B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RCryptor_20_Vaska
Repository: Yara-Rules/rules

Pattern signatures:
$a = { F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? ?? ?? ?? F7 D1 83 F1 FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule RCryptor_20_Vaska: PEiD
{
    strings:
        $a = { F7 D1 83 F1 FF 6A 00 F7 D1 83 F1 FF 81 04 24 ?? ?? ?? ?? F7 D1 83 F1 FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: BJFnt_v12_RC_MARQUiS
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule BJFnt_v12_RC_MARQUiS: PEiD
{
    strings:
        $a = { EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Borland_Delphi_DLL_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 20 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Borland_Delphi_DLL_additional: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 20 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ORiEN_211_DEMO
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 5D 01 00 00 CE D1 CE CE 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F }

Detection condition:
$a at pe.entry_point

Full rule:
rule ORiEN_211_DEMO: PEiD
{
    strings:
        $a = { E9 5D 01 00 00 CE D1 CE CE 0D 0A 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 2D 0D 0A 2D 20 4F 52 69 45 4E 20 65 78 65 63 75 74 61 62 6C 65 20 66 69 6C 65 73 20 70 72 6F }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Inno_Installer_v405_collides_with_Inno_Setup_Module_Heuristic_Mode_Inno_SFX
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 D2 55 68 ?? ?? ?? ?? 64 FF 32 64 89 22 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Inno_Installer_v405_collides_with_Inno_Setup_Module_Heuristic_Mode_Inno_SFX: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 C0 53 56 57 33 C0 89 45 F0 89 45 C4 89 45 C0 E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? E8 ?? ?? ?? ?? BE ?? ?? ?? ?? 33 C0 55 68 ?? ?? ?? ?? 64 FF 30 64 89 20 33 D2 55 68 ?? ?? ?? ?? 64 FF 32 64 89 22 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Unnamed_Scrambler_10_p0ke
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 EC 53 56 33 C0 89 45 ?? ?? ?? ?? 40 00 E8 11 F4 FF FF BE 30 6B 40 00 33 C0 55 68 C9 42 40 00 64 FF 30 64 89 20 E8 C9 FA FF FF BA D8 42 40 00 8B ?? ?? ?? ?? FF FF 8B D8 B8 28 6B 40 00 8B 16 E8 37 F0 FF FF B8 2C 6B 40 00 8B 16 E8 2B F0 FF FF B8 28 6B 40 00 E8 19 F0 FF FF 8B D0 8B C3 8B 0E E8 42 E3 FF FF BA DC 42 40 00 8B C6 E8 2A FA FF FF 8B D8 B8 20 6B 40 00 8B 16 E8 FC EF FF FF B8 24 6B 40 00 8B 16 E8 F0 EF FF FF B8 20 6B 40 00 E8 DE EF FF FF 8B D0 8B C3 8B 0E E8 07 E3 FF FF 6A 00 6A 19 6A 00 6A 32 A1 28 6B 40 00 E8 59 EF FF FF 83 E8 05 03 C0 8D 55 EC E8 94 FE FF FF 8B 55 EC B9 24 6B 40 00 A1 20 6B 40 00 E8 E2 F6 FF FF 6A 00 6A 19 6A 00 6A 32 }
        $b = { 55 8B EC 83 C4 EC 53 56 33 C0 89 45 ?? ?? ?? ?? 40 00 E8 11 F4 FF FF BE 30 6B 40 00 33 C0 55 68 C9 42 40 00 64 FF 30 64 89 20 E8 C9 FA FF FF BA D8 42 40 00 8B ?? ?? ?? ?? FF FF 8B D8 B8 28 6B 40 00 8B 16 E8 37 F0 FF FF B8 2C 6B 40 00 8B 16 E8 2B F0 FF FF }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Unnamed_Scrambler_10_p0ke: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 EC 53 56 33 C0 89 45 ?? ?? ?? ?? 40 00 E8 11 F4 FF FF BE 30 6B 40 00 33 C0 55 68 C9 42 40 00 64 FF 30 64 89 20 E8 C9 FA FF FF BA D8 42 40 00 8B ?? ?? ?? ?? FF FF 8B D8 B8 28 6B 40 00 8B 16 E8 37 F0 FF FF B8 2C 6B 40 00 8B 16 E8 2B F0 FF FF B8 28 6B 40 00 E8 19 F0 FF FF 8B D0 8B C3 8B 0E E8 42 E3 FF FF BA DC 42 40 00 8B C6 E8 2A FA FF FF 8B D8 B8 20 6B 40 00 8B 16 E8 FC EF FF FF B8 24 6B 40 00 8B 16 E8 F0 EF FF FF B8 20 6B 40 00 E8 DE EF FF FF 8B D0 8B C3 8B 0E E8 07 E3 FF FF 6A 00 6A 19 6A 00 6A 32 A1 28 6B 40 00 E8 59 EF FF FF 83 E8 05 03 C0 8D 55 EC E8 94 FE FF FF 8B 55 EC B9 24 6B 40 00 A1 20 6B 40 00 E8 E2 F6 FF FF 6A 00 6A 19 6A 00 6A 32 }
        $b = { 55 8B EC 83 C4 EC 53 56 33 C0 89 45 ?? ?? ?? ?? 40 00 E8 11 F4 FF FF BE 30 6B 40 00 33 C0 55 68 C9 42 40 00 64 FF 30 64 89 20 E8 C9 FA FF FF BA D8 42 40 00 8B ?? ?? ?? ?? FF FF 8B D8 B8 28 6B 40 00 8B 16 E8 37 F0 FF FF B8 2C 6B 40 00 8B 16 E8 2B F0 FF FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: eXPressor_v12_CGSoftLabs_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 }
        $b = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 01 00 00 8D 85 F0 FE FF FF 50 6A 00 FF 15 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule eXPressor_v12_CGSoftLabs_h: PEiD
{
    strings:
        $a = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 }
        $b = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 01 00 00 8D 85 F0 FE FF FF 50 6A 00 FF 15 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Special_EXE_Pasword_Protector_101_Eng_Pavol_Cerven
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 00 00 8D 95 C6 77 00 00 8D 8D FF 77 00 00 55 68 00 20 00 00 51 52 6A 00 FF 95 04 7A 00 00 5D 6A 00 FF 95 FC 79 00 00 8D 8D 60 78 00 00 8D 95 85 01 00 00 55 68 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Special_EXE_Pasword_Protector_101_Eng_Pavol_Cerven: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 89 AD 8C 01 00 00 8B C5 2B 85 FE 75 00 00 89 85 3E 77 00 00 8D 95 C6 77 00 00 8D 8D FF 77 00 00 55 68 00 20 00 00 51 52 6A 00 FF 95 04 7A 00 00 5D 6A 00 FF 95 FC 79 00 00 8D 8D 60 78 00 00 8D 95 85 01 00 00 55 68 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AINEXE_v230_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 0E 07 B9 ?? ?? BE ?? ?? 33 FF FC F3 A4 A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule AINEXE_v230_additional: PEiD
{
    strings:
        $a = { 0E 07 B9 ?? ?? BE ?? ?? 33 FF FC F3 A4 A1 ?? ?? 2D ?? ?? 8E D0 BC ?? ?? 8C D8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPX_V200_V3X_Markus_Oberhumer_Laszlo_Molnar_John_Reiser
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 88 D8 E2 D9 8D ?? ?? ?? ?? ?? 8B 07 09 C0 74 3C 8B 5F 04 8D ?? ?? ?? ?? ?? ?? 01 F3 50 83 C7 08 FF ?? ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 57 48 F2 AE 55 FF ?? ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB E1 FF ?? ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? ?? ?? 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPX_V200_V3X_Markus_Oberhumer_Laszlo_Molnar_John_Reiser: PEiD
{
    strings:
        $a = { 5E 89 F7 B9 ?? ?? ?? ?? 8A 07 47 2C E8 3C 01 77 F7 80 3F ?? 75 F2 8B 07 8A 5F 04 66 C1 E8 08 C1 C0 10 86 C4 29 F8 80 EB E8 01 F0 89 07 83 C7 05 88 D8 E2 D9 8D ?? ?? ?? ?? ?? 8B 07 09 C0 74 3C 8B 5F 04 8D ?? ?? ?? ?? ?? ?? 01 F3 50 83 C7 08 FF ?? ?? ?? ?? ?? 95 8A 07 47 08 C0 74 DC 89 F9 57 48 F2 AE 55 FF ?? ?? ?? ?? ?? 09 C0 74 07 89 03 83 C3 04 EB E1 FF ?? ?? ?? ?? ?? 8B AE ?? ?? ?? ?? 8D BE 00 F0 FF FF BB 00 10 00 00 50 54 6A 04 53 57 FF D5 8D 87 ?? ?? ?? ?? 80 20 7F 80 60 28 7F 58 50 54 50 53 57 FF D5 58 61 8D 44 24 80 6A 00 39 C4 75 FA 83 EC 80 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Docmaker_120
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B4 0F CD 10 06 1E 3C 03 76 06 3C 07 74 09 EB 42 B8 00 B8 8E C0 EB 05 B8 00 B0 8E C0 BF 00 00 8C C8 8E D8 BE 40 01 B4 0B B7 00 8A 1E 3D 01 CD 10 8A 3E 3E 01 B8 00 06 31 C9 BA 50 19 CD 10 FC B9 80 07 AC AA 47 E2 FB 1F 07 B4 02 31 DB BA 00 17 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Docmaker_120: PEiD
{
    strings:
        $a = { B4 0F CD 10 06 1E 3C 03 76 06 3C 07 74 09 EB 42 B8 00 B8 8E C0 EB 05 B8 00 B0 8E C0 BF 00 00 8C C8 8E D8 BE 40 01 B4 0B B7 00 8A 1E 3D 01 CD 10 8A 3E 3E 01 B8 00 06 31 C9 BA 50 19 CD 10 FC B9 80 07 AC AA 47 E2 FB 1F 07 B4 02 31 DB BA 00 17 }
    condition:
        $a at pe.entry_point

}