deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Private_EXE_Protector_197_SetiSoft_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 02 44 24 0C 88 07 47 EB C6 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 82 6E 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 83 DC 00 00 00 B9 04 00 00 00 33 C0 8D A4 24 00 00 00 00 8D 64 24 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 48 74 B1 0F 89 EF 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 42 BD 00 01 00 00 B9 08 00 00 00 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 88 07 47 4D 75 D6 }
        $b = { 55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 7

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Private_EXE_Protector_197_SetiSoft_h: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 02 44 24 0C 88 07 47 EB C6 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 82 6E 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 0F 83 DC 00 00 00 B9 04 00 00 00 33 C0 8D A4 24 00 00 00 00 8D 64 24 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 48 74 B1 0F 89 EF 01 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 42 BD 00 01 00 00 B9 08 00 00 00 33 C0 8D A4 24 00 00 00 00 05 00 00 00 00 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 13 C0 49 75 EF 88 07 47 4D 75 D6 }
        $b = { 55 8B EC 83 C4 F4 FC 53 57 56 8B 74 24 20 8B 7C 24 24 66 81 3E 4A 43 0F 85 A5 02 00 00 83 C6 0A 33 DB BA 00 00 00 80 C7 44 24 14 08 00 00 00 43 8D A4 24 00 00 00 00 8B FF 03 D2 75 08 8B 16 83 C6 04 F9 13 D2 73 2C 8B 4C 24 10 33 C0 8D A4 24 00 00 00 00 05 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: PC_Guard_v303d_v305d
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 50 E8 ?? ?? ?? ?? 5D EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 }
        $b = { FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule PC_Guard_v303d_v305d: PEiD
{
    strings:
        $a = { 55 50 E8 ?? ?? ?? ?? 5D EB 01 E3 60 E8 03 ?? ?? ?? D2 EB 0B 58 EB 01 48 40 EB 01 }
        $b = { FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: TSCRUNCH_v301_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB ?? 06 1E 55 57 56 52 51 53 50 16 1F 0E 07 8B F4 }

Detection condition:
$a at pe.entry_point

Full rule:
rule TSCRUNCH_v301_Hint_DOS_EP: PEiD
{
    strings:
        $a = { EB ?? 06 1E 55 57 56 52 51 53 50 16 1F 0E 07 8B F4 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MOD_8_Track_Oktatracker_music_file
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 4F 43 54 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MOD_8_Track_Oktatracker_music_file: PEiD
{
    strings:
        $a = { 4F 43 54 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: aPack_v082
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 1E 06 8C CB BA ?? ?? 03 DA 8D ?? ?? ?? FC 33 F6 33 FF 48 4B 8E C0 8E DB }

Detection condition:
$a at pe.entry_point

Full rule:
rule aPack_v082: PEiD
{
    strings:
        $a = { 1E 06 8C CB BA ?? ?? 03 DA 8D ?? ?? ?? FC 33 F6 33 FF 48 4B 8E C0 8E DB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: NsPack_14_by_North_Star_Liu_Xing_Ping_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53 }

Detection condition:
$a at pe.entry_point

Full rule:
rule NsPack_14_by_North_Star_Liu_Xing_Ping_additional: PEiD
{
    strings:
        $a = { 8B DF 83 3F 00 75 0A 83 C7 04 B9 00 00 00 00 EB 16 B9 01 00 00 00 03 3B 83 C3 04 83 3B 00 74 2D 01 13 8B 33 03 7B 04 57 51 52 53 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_ARCV4
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 00 00 5D 81 ED 06 01 81 FC 4F 50 74 0B 8D B6 86 01 BF 00 01 57 A4 EB 11 1E 06 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_ARCV4: PEiD
{
    strings:
        $a = { E8 00 00 5D 81 ED 06 01 81 FC 4F 50 74 0B 8D B6 86 01 BF 00 01 57 A4 EB 11 1E 06 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Visual_Cpp_50_debug
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 00 00 42 00 68 00 00 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 F0 53 56 57 89 65 E8 FF 15 00 C1 42 00 A3 00 A1 42 00 A1 00 A1 42 00 C1 E8 08 25 FF 00 00 00 A3 00 A1 42 00 8B 0D 00 A1 42 00 81 E1 FF 00 00 00 89 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Visual_Cpp_50_debug: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 00 00 42 00 68 00 00 41 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 F0 53 56 57 89 65 E8 FF 15 00 C1 42 00 A3 00 A1 42 00 A1 00 A1 42 00 C1 E8 08 25 FF 00 00 00 A3 00 A1 42 00 8B 0D 00 A1 42 00 81 E1 FF 00 00 00 89 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_02_Macromedia_Flash_Projector_60
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_02_Macromedia_Flash_Projector_60: PEiD
{
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 83 EC 44 56 FF 15 24 81 49 00 8B F0 8A 06 3C 22 75 1C 8A 46 01 46 3C 22 74 0C 84 C0 74 08 8A 46 01 46 3C 22 75 F4 80 3E 22 75 0F 46 EB 0C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _SDProtector_11x_Randy_Li
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _SDProtector_11x_Randy_Li: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Safengine_Licenseor_1720_Nooby
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 1B 00 00 00 53 00 61 00 66 00 65 00 6E 00 67 00 69 00 6E 00 65 00 20 00 4C 00 69 00 63 00 65 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Safengine_Licenseor_1720_Nooby: PEiD
{
    strings:
        $a = { E8 1B 00 00 00 53 00 61 00 66 00 65 00 6E 00 67 00 69 00 6E 00 65 00 20 00 4C 00 69 00 63 00 65 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_134_140b1
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 00 87 DD 8B 85 A6 80 40 00 01 85 03 80 40 00 66 C7 85 00 80 40 00 90 90 01 85 9E 80 40 00 BB F8 10 00 00 03 9D AA 80 40 00 03 9D A6 80 40 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_134_140b1: PEiD
{
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F 80 40 00 87 DD 8B 85 A6 80 40 00 01 85 03 80 40 00 66 C7 85 00 80 40 00 90 90 01 85 9E 80 40 00 BB F8 10 00 00 03 9D AA 80 40 00 03 9D A6 80 40 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_v120_Eng_dulekxt_Borland_Cpp_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 ?? 8B FE 68 79 01 ?? ?? 59 EB 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_v120_Eng_dulekxt_Borland_Cpp_additional: PEiD
{
    strings:
        $a = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 ?? 8B FE 68 79 01 ?? ?? 59 EB 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: COP_v10_c_1988_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BF ?? ?? BE ?? ?? B9 ?? ?? AC 32 ?? ?? ?? AA E2 ?? 8B ?? ?? ?? EB ?? 90 }

Detection condition:
$a at pe.entry_point

Full rule:
rule COP_v10_c_1988_additional: PEiD
{
    strings:
        $a = { BF ?? ?? BE ?? ?? B9 ?? ?? AC 32 ?? ?? ?? AA E2 ?? 8B ?? ?? ?? EB ?? 90 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _022_beta_shoooo
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 11 55 07 8B EC B8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _022_beta_shoooo: PEiD
{
    strings:
        $a = { 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 11 55 07 8B EC B8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: aPack_v098b_COM
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BE ?? ?? BF ?? ?? 8B CF FC 57 F3 A4 C3 BF ?? ?? 57 57 BE ?? ?? B2 ?? BD ?? ?? 50 A4 }

Detection condition:
$a at pe.entry_point

Full rule:
rule aPack_v098b_COM: PEiD
{
    strings:
        $a = { BE ?? ?? BF ?? ?? 8B CF FC 57 F3 A4 C3 BF ?? ?? 57 57 BE ?? ?? B2 ?? BD ?? ?? 50 A4 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: NeoLite_vxx_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9E 37 00 00 ?? ?? 48 ?? ?? ?? 6F 4C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 61 }

Detection condition:
$a at pe.entry_point

Full rule:
rule NeoLite_vxx_additional: PEiD
{
    strings:
        $a = { 9E 37 00 00 ?? ?? 48 ?? ?? ?? 6F 4C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 61 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PEncrypt_v31_JunkCode
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? ?? 00 F0 0F C6 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PEncrypt_v31_JunkCode: PEiD
{
    strings:
        $a = { E9 ?? ?? ?? 00 F0 0F C6 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Enigma_Protector_112_Vladimir_Sukhov_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E EB 04 ?? ?? ?? ?? B8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 01 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 05 F6 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 B9 44 1A }

Detection condition:
$a at pe.entry_point

Full rule:
rule Enigma_Protector_112_Vladimir_Sukhov_additional: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 83 ED 06 81 ED ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 EB 02 FF 35 60 E8 24 00 00 00 00 00 FF EB 02 CD 20 8B 44 24 0C 83 80 B8 00 00 00 03 31 C0 C3 83 C0 08 EB 02 FF 15 89 C4 61 EB 2E EA EB 2B 83 04 24 03 EB 01 00 31 C0 EB 01 85 64 FF 30 EB 01 83 64 89 20 EB 02 CD 20 89 00 9A 64 8F 05 00 00 00 00 EB 02 C1 90 58 61 EB 01 3E EB 04 ?? ?? ?? ?? B8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 01 E8 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 05 F6 01 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 01 00 00 00 9A 83 C4 04 B9 44 1A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MS_Compress_Archive_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 53 5A 44 44 }

Detection condition:
$a at pe.entry_point

Full rule:
rule MS_Compress_Archive_Hint_FILE_START: PEiD
{
    strings:
        $a = { 53 5A 44 44 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Morphine_v33_Silent_Software_Silent_Shield_c2005_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Morphine_v33_Silent_Software_Silent_Shield_c2005_h: PEiD
{
    strings:
        $a = { 28 ?? ?? ?? 00 00 00 00 00 00 00 00 40 ?? ?? ?? 34 ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4C ?? ?? ?? 5C ?? ?? ?? 00 00 00 00 4B 65 52 6E 45 6C 33 32 2E 64 4C 6C 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASPack_106b_Solodovnikov_Alexey
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 75 00 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASPack_106b_Solodovnikov_Alexey: PEiD
{
    strings:
        $a = { 90 75 00 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_v110_Eng_dulekxt_Microsoft_Visual_Cpp_60_ASM_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 03 05 00 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Cpp_60_ASM_additional: PEiD
{
    strings:
        $a = { 03 05 00 1B B8 ?? ?? 8C CA 03 D0 8C C9 81 C1 ?? ?? 51 B9 ?? ?? 51 06 06 B1 ?? 51 8C D3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: BeRoEXEPacker_V100_BeRo_Sign_by_fly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BA ?? ?? ?? ?? 8D B2 ?? ?? ?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB 75 02 8B DF 03 DA 03 FA 52 57 50 FF 15 ?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22 0F BA F0 1F 72 04 8D 44 ?? ?? 51 52 57 50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74 0B AB 83 C3 04 EB D8 83 C6 14 EB AA 61 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule BeRoEXEPacker_V100_BeRo_Sign_by_fly: PEiD
{
    strings:
        $a = { BA ?? ?? ?? ?? 8D B2 ?? ?? ?? ?? 8B 46 ?? 85 C0 74 51 03 C2 8B 7E ?? 8B 1E 85 DB 75 02 8B DF 03 DA 03 FA 52 57 50 FF 15 ?? ?? ?? ?? 5F 5A 85 C0 74 2F 8B C8 8B 03 85 C0 74 22 0F BA F0 1F 72 04 8D 44 ?? ?? 51 52 57 50 51 FF 15 ?? ?? ?? ?? 5F 5A 59 85 C0 74 0B AB 83 C3 04 EB D8 83 C6 14 EB AA 61 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SVK_Protector_13x_Eng_Pavol_Cerven
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E }
        $b = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule SVK_Protector_13x_Eng_Pavol_Cerven: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 ?? ?? 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E }
        $b = { 60 E8 00 00 00 00 5D 81 ED 06 00 00 00 EB 05 B8 06 36 42 00 64 A0 23 00 00 00 EB 03 C7 84 E8 84 C0 EB 03 C7 84 E9 75 67 B9 49 00 00 00 8D B5 C5 02 00 00 56 80 06 44 46 E2 FA 8B 8D C1 02 00 00 5E 55 51 6A 00 56 FF 95 0C 61 00 00 59 5D 40 85 C0 75 3C 80 3E }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: PEQuake_V006_forgat_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? FF FF E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? ?? 00 ?? ?? 00 ?? 00 ?? 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PEQuake_V006_forgat_additional: PEiD
{
    strings:
        $a = { E8 ?? ?? FF FF E8 ?? ?? FF FF ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? ?? 00 ?? ?? 00 ?? 00 ?? 00 00 ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? 00 ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? 00 ?? ?? ?? ?? ?? ?? 00 ?? ?? 00 ?? ?? ?? 00 00 00 ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: XcomOR_099a
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 80 06 01 01 0A B4 01 50 50 C3 BF 00 01 57 B8 00 00 8B 4D 01 8B 5D 03 33 D8 89 1D 83 C7 02 05 87 00 83 F9 01 74 01 49 E2 EB 58 FF E0 }

Detection condition:
$a at pe.entry_point

Full rule:
rule XcomOR_099a: PEiD
{
    strings:
        $a = { 80 06 01 01 0A B4 01 50 50 C3 BF 00 01 57 B8 00 00 8B 4D 01 8B 5D 03 33 D8 89 1D 83 C7 02 05 87 00 83 F9 01 74 01 49 E2 EB 58 FF E0 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Turbo_or_Borland_Pascal_v70
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9A ?? ?? ?? ?? C8 ?? ?? ?? 9A ?? ?? ?? ?? 09 C0 75 ?? EB ?? 8D ?? ?? ?? 16 57 6A ?? 9A ?? ?? ?? ?? BF ?? ?? 1E 57 68 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Turbo_or_Borland_Pascal_v70: PEiD
{
    strings:
        $a = { 9A ?? ?? ?? ?? C8 ?? ?? ?? 9A ?? ?? ?? ?? 09 C0 75 ?? EB ?? 8D ?? ?? ?? 16 57 6A ?? 9A ?? ?? ?? ?? BF ?? ?? 1E 57 68 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Einstein_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 42 CD 21 72 31 B9 6E 03 33 D2 B4 40 CD 21 72 19 3B C1 75 15 B8 00 42 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Einstein_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 00 42 CD 21 72 31 B9 6E 03 33 D2 B4 40 CD 21 72 19 3B C1 75 15 B8 00 42 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: LZEXE_v091_v100a_3_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 06 0E 1F 8B 0E }

Detection condition:
$a at pe.entry_point

Full rule:
rule LZEXE_v091_v100a_3_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 50 06 0E 1F 8B 0E }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: yodas_Protector_102_exescrcom_Ashkbiz_Danehkar_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 }

Detection condition:
$a at pe.entry_point

Full rule:
rule yodas_Protector_102_exescrcom_Ashkbiz_Danehkar_h: PEiD
{
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PureBasic_4x_DLL_Neil_Hodgson_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 7C 24 08 01 75 0E 8B 44 24 04 A3 ?? ?? ?? 10 E8 22 00 00 00 83 7C 24 08 02 75 00 83 7C 24 08 00 75 05 E8 ?? 00 00 00 83 7C 24 08 03 75 00 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? 0F 00 00 A3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PureBasic_4x_DLL_Neil_Hodgson_additional: PEiD
{
    strings:
        $a = { 83 7C 24 08 01 75 0E 8B 44 24 04 A3 ?? ?? ?? 10 E8 22 00 00 00 83 7C 24 08 02 75 00 83 7C 24 08 00 75 05 E8 ?? 00 00 00 83 7C 24 08 03 75 00 B8 01 00 00 00 C2 0C 00 68 00 00 00 00 68 00 10 00 00 68 00 00 00 00 E8 ?? 0F 00 00 A3 }
    condition:
        $a at pe.entry_point

}