deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: FreeCryptor_02_build_002_GlOFF
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 33 D2 90 1E 68 1B ?? ?? ?? 0F A0 1F 8B 02 90 50 54 8F 02 90 90 8E 64 24 08 FF E2 58 50 33 D2 52 83 F8 01 9B 40 8A 10 89 14 24 90 D9 04 24 90 D9 FA D9 5C 24 FC 8B 5C 24 FC 81 F3 C2 FC 1D 1C 75 E3 74 01 62 FF D0 90 5A 33 C0 8B 54 24 08 90 64 8F 00 90 83 C2 08 52 5C 5A }
        $b = { 33 D2 90 1E 68 1B ?? ?? ?? 0F A0 1F 8B 02 90 50 54 8F 02 90 90 8E 64 24 08 FF E2 58 50 33 D2 52 83 F8 01 9B 40 8A 10 89 14 24 90 D9 04 24 90 D9 FA D9 5C 24 FC 8B 5C 24 FC 81 F3 C2 FC 1D 1C 75 E3 74 01 62 FF D0 90 5A 33 C0 8B 54 24 08 90 64 8F 00 90 83 C2 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule FreeCryptor_02_build_002_GlOFF: PEiD
{
    strings:
        $a = { 33 D2 90 1E 68 1B ?? ?? ?? 0F A0 1F 8B 02 90 50 54 8F 02 90 90 8E 64 24 08 FF E2 58 50 33 D2 52 83 F8 01 9B 40 8A 10 89 14 24 90 D9 04 24 90 D9 FA D9 5C 24 FC 8B 5C 24 FC 81 F3 C2 FC 1D 1C 75 E3 74 01 62 FF D0 90 5A 33 C0 8B 54 24 08 90 64 8F 00 90 83 C2 08 52 5C 5A }
        $b = { 33 D2 90 1E 68 1B ?? ?? ?? 0F A0 1F 8B 02 90 50 54 8F 02 90 90 8E 64 24 08 FF E2 58 50 33 D2 52 83 F8 01 9B 40 8A 10 89 14 24 90 D9 04 24 90 D9 FA D9 5C 24 FC 8B 5C 24 FC 81 F3 C2 FC 1D 1C 75 E3 74 01 62 FF D0 90 5A 33 C0 8B 54 24 08 90 64 8F 00 90 83 C2 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: CGM_Graphics_format
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 2A 08 48 69 4A 61 61 6B 20 32 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CGM_Graphics_format: PEiD
{
    strings:
        $a = { 00 2A 08 48 69 4A 61 61 6B 20 32 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: OAZ_Fax_Graphics_format
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 0F 0F 0F 0F 01 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule OAZ_Fax_Graphics_format: PEiD
{
    strings:
        $a = { 0F 0F 0F 0F 01 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Anti007_V10_V2X_NsPacK_Private
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 45 78 69 74 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Anti007_V10_V2X_NsPacK_Private: PEiD
{
    strings:
        $a = { 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 56 69 72 74 75 61 6C 50 72 6F 74 65 63 74 00 00 00 56 69 72 74 75 61 6C 41 6C 6C 6F 63 00 00 00 56 69 72 74 75 61 6C 46 72 65 65 00 00 00 45 78 69 74 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: tElock_051_tE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 00 00 59 EB 01 EB AC 54 E8 03 00 00 00 5C EB 08 8D 64 24 04 FF 64 24 FC 6A 05 D0 2C 24 72 01 E8 01 24 24 5C F7 DC EB 02 CD 20 8D 64 24 FE F7 DC EB 02 CD 20 FE C8 E8 00 00 00 00 32 C1 EB 02 82 0D AA EB 03 82 0D 58 EB 02 1D 7A 49 EB 05 E8 01 00 00 00 7F AE 14 7E A0 77 76 75 74 }
        $b = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 00 00 59 EB 01 EB AC 54 E8 03 00 00 00 5C EB 08 8D 64 24 04 FF 64 24 FC 6A 05 D0 2C 24 72 01 E8 01 24 24 5C F7 DC EB 02 CD 20 8D 64 24 FE F7 DC EB 02 CD 20 FE C8 E8 00 00 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule tElock_051_tE: PEiD
{
    strings:
        $a = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 00 00 59 EB 01 EB AC 54 E8 03 00 00 00 5C EB 08 8D 64 24 04 FF 64 24 FC 6A 05 D0 2C 24 72 01 E8 01 24 24 5C F7 DC EB 02 CD 20 8D 64 24 FE F7 DC EB 02 CD 20 FE C8 E8 00 00 00 00 32 C1 EB 02 82 0D AA EB 03 82 0D 58 EB 02 1D 7A 49 EB 05 E8 01 00 00 00 7F AE 14 7E A0 77 76 75 74 }
        $b = { C1 EE 00 66 8B C9 EB 01 EB 60 EB 01 EB 9C E8 00 00 00 00 5E 83 C6 5E 8B FE 68 79 01 00 00 59 EB 01 EB AC 54 E8 03 00 00 00 5C EB 08 8D 64 24 04 FF 64 24 FC 6A 05 D0 2C 24 72 01 E8 01 24 24 5C F7 DC EB 02 CD 20 8D 64 24 FE F7 DC EB 02 CD 20 FE C8 E8 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Obsiduim_1304_Obsiduim_Software
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsiduim_1304_Obsiduim_Software: PEiD
{
    strings:
        $a = { EB 02 ?? ?? E8 25 00 00 00 EB 04 ?? ?? ?? ?? EB 01 ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 23 EB 01 ?? 33 C0 EB 02 ?? ?? C3 EB 02 ?? ?? EB 04 ?? ?? ?? ?? 64 67 FF 36 00 00 EB 03 ?? ?? ?? 64 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Thunderbolt_V002_deXep_forgot_SignByfly
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 E8 AA 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 5D 68 00 FE 9F 07 53 E8 5D 00 00 00 EB FF 71 E8 C2 50 00 EB D6 5E F3 68 89 74 24 48 74 24 58 FF 8D 74 24 58 5E 83 C6 4C 75 F4 59 8D 71 E8 75 09 81 F6 EB FF 51 B9 01 00 83 EE FC 49 FF 71 C7 75 19 8B 74 24 00 00 81 36 50 56 8B 36 EB FF 77 C4 36 81 F6 EB 87 34 24 8B 8B 1C 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 5B EB FF F3 EB FF C3 }
        $b = { E9 00 00 00 00 6

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Thunderbolt_V002_deXep_forgot_SignByfly: PEiD
{
    strings:
        $a = { E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 E8 AA 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 5D 68 00 FE 9F 07 53 E8 5D 00 00 00 EB FF 71 E8 C2 50 00 EB D6 5E F3 68 89 74 24 48 74 24 58 FF 8D 74 24 58 5E 83 C6 4C 75 F4 59 8D 71 E8 75 09 81 F6 EB FF 51 B9 01 00 83 EE FC 49 FF 71 C7 75 19 8B 74 24 00 00 81 36 50 56 8B 36 EB FF 77 C4 36 81 F6 EB 87 34 24 8B 8B 1C 24 83 EC FC EB 01 E8 83 EC FC E9 E7 00 00 00 5B EB FF F3 EB FF C3 }
        $b = { E9 00 00 00 00 60 E8 14 00 00 00 5D 81 ED 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 58 61 E8 AA 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: ARM_Protector_02_SMoKE_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 09 20 40 00 EB 02 83 09 8D B5 9A 20 40 00 EB 02 83 09 BA 0B 12 00 00 EB 01 00 8D 8D A5 32 40 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ARM_Protector_02_SMoKE_additional: PEiD
{
    strings:
        $a = { E8 04 00 00 00 83 60 EB 0C 5D EB 05 45 55 EB 04 B8 EB F9 00 C3 E8 00 00 00 00 5D EB 01 00 81 ED 09 20 40 00 EB 02 83 09 8D B5 9A 20 40 00 EB 02 83 09 BA 0B 12 00 00 EB 01 00 8D 8D A5 32 40 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: HackStop_098_COM
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 B4 30 CD 21 86 E0 3D 00 03 73 02 CD 20 EB 02 4C 8F 50 55 52 8C D2 FA 50 B8 EB 04 58 EB FB 9A 8C C8 8E D0 EB 02 62 8F 8B EC BC 03 00 2E 85 06 D1 F6 B8 EB 03 EB FC EA 83 FC 03 74 02 FA F4 2E 85 06 E3 F6 B8 EB 03 EB FC EA 33 C0 FA 8E D0 BC }

Detection condition:
$a at pe.entry_point

Full rule:
rule HackStop_098_COM: PEiD
{
    strings:
        $a = { 50 B4 30 CD 21 86 E0 3D 00 03 73 02 CD 20 EB 02 4C 8F 50 55 52 8C D2 FA 50 B8 EB 04 58 EB FB 9A 8C C8 8E D0 EB 02 62 8F 8B EC BC 03 00 2E 85 06 D1 F6 B8 EB 03 EB FC EA 83 FC 03 74 02 FA F4 2E 85 06 E3 F6 B8 EB 03 EB FC EA 33 C0 FA 8E D0 BC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_02_BJFNT_12
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_02_BJFNT_12: PEiD
{
    strings:
        $a = { EB 02 69 B1 83 EC 04 EB 03 CD 20 EB EB 01 EB 9C EB 01 EB EB 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_01_UPX_06_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_01_UPX_06_Anorganix: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 58 83 E8 3D 50 8D B8 00 00 00 FF 57 8D B0 E8 00 00 00 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: yP_v10b_by_Ashkbiz_Danehkar_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 C2 E8 03 00 00 00 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? EB 01 E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule yP_v10b_by_Ashkbiz_Danehkar_additional: PEiD
{
    strings:
        $a = { 55 8B EC 53 56 57 60 E8 00 00 00 00 5D 81 ED 4C 32 40 00 E8 03 00 00 00 EB 01 ?? B9 EA 47 40 00 81 E9 E9 32 40 00 8B D5 81 C2 E9 32 40 00 8D 3A 8B F7 33 C0 E8 04 00 00 00 90 EB 01 C2 E8 03 00 00 00 EB 01 ?? AC ?? ?? ?? ?? ?? ?? ?? EB 01 E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_Visual_Basic_v50_v60_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FF 25 ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? FF FF FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_Visual_Basic_v50_v60_additional: PEiD
{
    strings:
        $a = { FF 25 ?? ?? ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 ?? FF FF FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Kuku886_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 06 1E 50 8C C8 8E D8 BA 70 03 B8 24 25 CD 21 ?? ?? ?? ?? ?? 90 B4 2F CD 21 53 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Kuku886_additional: PEiD
{
    strings:
        $a = { 06 1E 50 8C C8 8E D8 BA 70 03 B8 24 25 CD 21 ?? ?? ?? ?? ?? 90 B4 2F CD 21 53 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Xtreme_Protector_v105_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Xtreme_Protector_v105_additional: PEiD
{
    strings:
        $a = { B8 ?? ?? ?? 00 B9 75 ?? ?? 00 50 51 E8 05 00 00 00 E9 4A 01 00 00 60 8B 74 24 24 8B 7C 24 28 FC B2 80 8A 06 46 88 07 47 BB 02 00 00 00 02 D2 75 05 8A 16 46 12 D2 73 EA 02 D2 75 05 8A 16 46 12 D2 73 4F 33 C0 02 D2 75 05 8A 16 46 12 D2 0F 83 DF 00 00 00 02 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CrypWrap_vxx
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 B8 ?? ?? ?? E8 90 02 ?? ?? 83 F8 ?? 75 07 6A ?? E8 ?? ?? ?? ?? FF 15 49 8F 40 ?? A9 ?? ?? ?? 80 74 0E }

Detection condition:
$a at pe.entry_point

Full rule:
rule CrypWrap_vxx: PEiD
{
    strings:
        $a = { E8 B8 ?? ?? ?? E8 90 02 ?? ?? 83 F8 ?? 75 07 6A ?? E8 ?? ?? ?? ?? FF 15 49 8F 40 ?? A9 ?? ?? ?? 80 74 0E }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UPX_Shit_01_500mhz_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 01 ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79 }

Detection condition:
$a at pe.entry_point

Full rule:
rule UPX_Shit_01_500mhz_additional: PEiD
{
    strings:
        $a = { E8 00 00 00 00 5E 83 C6 14 AD 89 C7 AD 89 C1 AD 30 07 47 E2 FB AD FF E0 C3 00 ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 01 ?? ?? ?? 00 55 50 58 2D 53 68 69 74 20 76 30 2E 31 20 2D 20 77 77 77 2E 62 6C 61 63 6B 6C 6F 67 69 63 2E 6E 65 74 20 2D 20 63 6F 64 65 20 62 79 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_v110_Eng_dulekxt_Borland_Delphi_Microsoft_Visual_Cppx
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_v110_Eng_dulekxt_Borland_Delphi_Microsoft_Visual_Cppx: PEiD
{
    strings:
        $a = { 1B DB E8 02 00 00 00 1A 0D 5B 68 80 ?? ?? 00 E8 01 00 00 00 EA 5A 58 EB 02 CD 20 68 F4 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EP_v02_CoDe_Inside
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 6A 00 60 E9 01 01 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EP_v02_CoDe_Inside: PEiD
{
    strings:
        $a = { 6A 00 60 E9 01 01 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Reg2Exe_224_by_Jan_Vorel
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 6A 00 E8 CF 20 00 00 A3 F4 45 40 00 E8 CB 20 00 00 6A 0A 50 6A 00 FF 35 F4 45 40 00 E8 07 00 00 00 50 E8 BB 20 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 F8 45 40 00 E8 06 19 00 00 83 C4 0C 8B 44 24 04 A3 FC 45 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 8C 20 00 00 A3 F8 45 40 00 E8 02 20 00 00 E8 32 1D 00 00 E8 20 19 00 00 E8 A3 16 00 00 68 01 00 00 00 68 38 46 40 00 68 00 00 00 00 8B 15 38 46 40 00 E8 71 4F 00 00 B8 00 00 10 00 BB 01 00 00 00 E8 82 4F 00 00 FF 35 48 41 40 00 B8 00 01 00 00 E8 9D 15 00 00 8D 0D 1C 46 40 00 5A E8 82 16 00 00 68 00 01 00 00 FF 35 1C 46 40 00 E8 24 20 00 00 A3 24 46 40 00 FF 35 48 41 40 00 FF 35 24 46 40 00 FF 35 1C 46 40 00 E8 DC 10 00 00 8D 0D 14 46 40 00 5A E8 4A 16 }
        $b = { 6A 00 E8 CF 20 00 00 A3 F4 45 40 00 E8 CB 20 00 00 6A 0A 50 6A 00 FF 35 F4 45 40 00 E8 07 00 00 00 50 E8 BB 20 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 F8 45 40 00 E8 06 19 00 00 83 C4 0C 8B 44 24 04 A3 FC 45 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Reg2Exe_224_by_Jan_Vorel: PEiD
{
    strings:
        $a = { 6A 00 E8 CF 20 00 00 A3 F4 45 40 00 E8 CB 20 00 00 6A 0A 50 6A 00 FF 35 F4 45 40 00 E8 07 00 00 00 50 E8 BB 20 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 F8 45 40 00 E8 06 19 00 00 83 C4 0C 8B 44 24 04 A3 FC 45 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 00 00 E8 8C 20 00 00 A3 F8 45 40 00 E8 02 20 00 00 E8 32 1D 00 00 E8 20 19 00 00 E8 A3 16 00 00 68 01 00 00 00 68 38 46 40 00 68 00 00 00 00 8B 15 38 46 40 00 E8 71 4F 00 00 B8 00 00 10 00 BB 01 00 00 00 E8 82 4F 00 00 FF 35 48 41 40 00 B8 00 01 00 00 E8 9D 15 00 00 8D 0D 1C 46 40 00 5A E8 82 16 00 00 68 00 01 00 00 FF 35 1C 46 40 00 E8 24 20 00 00 A3 24 46 40 00 FF 35 48 41 40 00 FF 35 24 46 40 00 FF 35 1C 46 40 00 E8 DC 10 00 00 8D 0D 14 46 40 00 5A E8 4A 16 }
        $b = { 6A 00 E8 CF 20 00 00 A3 F4 45 40 00 E8 CB 20 00 00 6A 0A 50 6A 00 FF 35 F4 45 40 00 E8 07 00 00 00 50 E8 BB 20 00 00 CC 68 48 00 00 00 68 00 00 00 00 68 F8 45 40 00 E8 06 19 00 00 83 C4 0C 8B 44 24 04 A3 FC 45 40 00 68 00 00 00 00 68 A0 0F 00 00 68 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: HackStop_119_build_217
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 53 BB EB 04 5B EB FB EA 9C 1E 52 B4 30 CD 21 86 C4 3D D6 02 73 02 CD 20 0E 1F 53 BB EB 04 5B EB FB EA E8 02 00 24 24 5A B4 09 CD 21 53 BB EB 04 5B EB FB EA EB 02 D8 88 5A 1F 53 BB EB 04 5B EB FB EA B0 AD E6 64 58 E8 D6 F1 53 BB EB 04 5B EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule HackStop_119_build_217: PEiD
{
    strings:
        $a = { 53 BB EB 04 5B EB FB EA 9C 1E 52 B4 30 CD 21 86 C4 3D D6 02 73 02 CD 20 0E 1F 53 BB EB 04 5B EB FB EA E8 02 00 24 24 5A B4 09 CD 21 53 BB EB 04 5B EB FB EA EB 02 D8 88 5A 1F 53 BB EB 04 5B EB FB EA B0 AD E6 64 58 E8 D6 F1 53 BB EB 04 5B EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: tElock_v099_tHE_EGOiSTE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule tElock_v099_tHE_EGOiSTE: PEiD
{
    strings:
        $a = { E9 ?? ?? FF FF 00 00 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? ?? ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? ?? 00 ?? ?? 02 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Username_300_COM
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 00 00 5D 83 ED 03 FA FC 33 F6 8E DE BF 99 01 03 FD B9 14 00 F3 A4 8B FC 8B 1E 84 00 A1 86 00 89 1E 0C 00 A3 0E 00 8B 16 40 00 8B 1E 42 00 B8 AD FD 8E D0 B8 38 25 8B E0 53 52 8C C8 8B E7 8E D0 FB 0E 1F BE 51 00 B9 24 01 3E 31 0A 46 46 E2 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Username_300_COM: PEiD
{
    strings:
        $a = { E8 00 00 5D 83 ED 03 FA FC 33 F6 8E DE BF 99 01 03 FD B9 14 00 F3 A4 8B FC 8B 1E 84 00 A1 86 00 89 1E 0C 00 A3 0E 00 8B 16 40 00 8B 1E 42 00 B8 AD FD 8E D0 B8 38 25 8B E0 53 52 8C C8 8B E7 8E D0 FB 0E 1F BE 51 00 B9 24 01 3E 31 0A 46 46 E2 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Escargot_V01_ppMeat
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 04 40 30 2E 31 60 68 61 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Escargot_V01_ppMeat: PEiD
{
    strings:
        $a = { EB 04 40 30 2E 31 60 68 61 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Sentinel_Keys_Shell_V1130Dongle_Driver_V740_SafeNet_Inc_20090524
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 81 EC 0C 01 00 00 53 56 57 C7 85 04 FF FF FF 00 00 00 00 C7 45 FC 00 00 00 00 C7 45 EC 00 00 00 00 C7 45 F8 00 00 00 00 C7 85 08 FF FF FF 00 00 00 00 C7 45 E4 04 00 00 00 83 3D ?? ?? ?? ?? 00 74 05 E9 ?? ?? 00 00 A1 ?? ?? ?? ?? 83 C0 01 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Sentinel_Keys_Shell_V1130Dongle_Driver_V740_SafeNet_Inc_20090524: PEiD
{
    strings:
        $a = { 55 8B EC 81 EC 0C 01 00 00 53 56 57 C7 85 04 FF FF FF 00 00 00 00 C7 45 FC 00 00 00 00 C7 45 EC 00 00 00 00 C7 45 F8 00 00 00 00 C7 85 08 FF FF FF 00 00 00 00 C7 45 E4 04 00 00 00 83 3D ?? ?? ?? ?? 00 74 05 E9 ?? ?? 00 00 A1 ?? ?? ?? ?? 83 C0 01 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: UFA_Archive_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 46 41 C6 D2 C1 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule UFA_Archive_Hint_FILE_START: PEiD
{
    strings:
        $a = { 55 46 41 C6 D2 C1 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AVPACK_v120_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 1E 0E 1F 16 07 33 F6 8B FE B9 ?? ?? FC F3 A5 06 BB ?? ?? 53 CB }

Detection condition:
$a at pe.entry_point

Full rule:
rule AVPACK_v120_Hint_DOS_EP: PEiD
{
    strings:
        $a = { 50 1E 0E 1F 16 07 33 F6 8B FE B9 ?? ?? FC F3 A5 06 BB ?? ?? 53 CB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_Visual_Cpp_v42_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 89 25 00 00 00 00 83 EC ?? 53 56 57 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_Visual_Cpp_v42_additional: PEiD
{
    strings:
        $a = { 64 A1 00 00 00 00 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 50 64 89 25 00 00 00 00 83 EC ?? 53 56 57 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CGM_Graphics_format_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 2A 08 48 69 4A 61 61 6B 20 32 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CGM_Graphics_format_Hint_FILE_START: PEiD
{
    strings:
        $a = { 00 2A 08 48 69 4A 61 61 6B 20 32 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_v0978_Jeremy_Collake
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 24 88 40 ?? 87 DD 8B 85 A9 88 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_v0978_Jeremy_Collake: PEiD
{
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 24 88 40 ?? 87 DD 8B 85 A9 88 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CRYPToCRACks_PE_Protector_v093_Lucas_Fleischer_h_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC 04 0F 85 DD 00 00 00 81 EB 00 01 00 00 75 BE 90 72 ?? ?? ?? ?? 00 00 00 00 00 00 00 7A ?? ?? ?? 72 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 C1 00 46 61 74 61 6C 45 78 69 74 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CRYPToCRACks_PE_Protector_v093_Lucas_Fleischer_h_additional: PEiD
{
    strings:
        $a = { 5B 81 E3 00 FF FF FF 66 81 3B 4D 5A 75 33 8B F3 03 73 3C 81 3E 50 45 00 00 75 26 0F B7 46 18 8B C8 69 C0 AD 0B 00 00 F7 E0 2D AB 5D 41 4B 69 C9 DE C0 00 00 03 C1 75 09 83 EC 04 0F 85 DD 00 00 00 81 EB 00 01 00 00 75 BE 90 72 ?? ?? ?? ?? 00 00 00 00 00 00 00 7A ?? ?? ?? 72 ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 C1 00 46 61 74 61 6C 45 78 69 74 }
    condition:
        $a at pe.entry_point

}