deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: PECompact_140b2_140b4
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 00 87 DD 8B 85 A6 A0 40 00 01 85 03 A0 40 00 66 C7 85 00 A0 40 00 90 90 01 85 9E A0 40 00 BB 86 11 00 00 03 9D AA A0 40 00 03 9D A6 A0 40 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_140b2_140b4: PEiD
{
    strings:
        $a = { EB 06 68 00 00 00 00 C3 9C 60 E8 02 00 00 00 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 EB 0F A0 40 00 87 DD 8B 85 A6 A0 40 00 01 85 03 A0 40 00 66 C7 85 00 A0 40 00 90 90 01 85 9E A0 40 00 BB 86 11 00 00 03 9D AA A0 40 00 03 9D A6 A0 40 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EPW_130_COM
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 06 57 1E 56 55 52 51 53 50 BB 03 00 81 C3 00 01 2E 8B 07 8C CB 03 C3 83 C0 10 50 B8 D1 00 50 CB 8C C0 83 C0 10 8E C0 83 C0 05 8E D8 2E 8B 0E 00 00 2B F6 2B FF FC F3 A4 0E 1F BA 1E 00 B4 09 CD 21 BB 0E 00 B9 10 00 B4 00 CD 16 3C 0D 74 09 3C }

Detection condition:
$a at pe.entry_point

Full rule:
rule EPW_130_COM: PEiD
{
    strings:
        $a = { 06 57 1E 56 55 52 51 53 50 BB 03 00 81 C3 00 01 2E 8B 07 8C CB 03 C3 83 C0 10 50 B8 D1 00 50 CB 8C C0 83 C0 10 8E C0 83 C0 05 8E D8 2E 8B 0E 00 00 2B F6 2B FF FC F3 A4 0E 1F BA 1E 00 B4 09 CD 21 BB 0E 00 B9 10 00 B4 00 CD 16 3C 0D 74 09 3C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Agiplan1536_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? 50 B0 ?? BA ?? ?? EE BA ?? ?? EC 3C ?? 76 ?? E9 ?? ?? B8 ?? ?? CD 21 8C D8 8E C0 83 ?? ?? 75 ?? E9 ?? ?? BA ?? ?? B8 ?? ?? CD 21 B8 ?? ?? CD 21 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Agiplan1536_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? 50 B0 ?? BA ?? ?? EE BA ?? ?? EC 3C ?? 76 ?? E9 ?? ?? B8 ?? ?? CD 21 8C D8 8E C0 83 ?? ?? 75 ?? E9 ?? ?? BA ?? ?? B8 ?? ?? CD 21 B8 ?? ?? CD 21 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_CrunchPE_Heuristic_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_CrunchPE_Heuristic_Anorganix: PEiD
{
    strings:
        $a = { 55 E8 0E 00 00 00 5D 83 ED 06 8B C5 55 60 89 AD ?? ?? ?? ?? 2B 85 00 00 00 00 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PC_Guard_v500d
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C }
        $b = { FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 85 E1 EA 41 00 9C EB 01 D5 9D EB 01 0B 58 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 89 85 F9 EA 41 00 9C EB 01 D5 9D EB 01 0B 89 9D E5 EA 41 00 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 8D E9 EA 41 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 89 95 ED EA 41 00 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 8

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule PC_Guard_v500d: PEiD
{
    strings:
        $a = { FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C }
        $b = { FC 55 50 E8 00 00 00 00 5D 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 B8 30 D2 40 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 2B E8 9C EB 01 D5 9D EB 01 0B 58 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 85 E1 EA 41 00 9C EB 01 D5 9D EB 01 0B 58 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 89 85 F9 EA 41 00 9C EB 01 D5 9D EB 01 0B 89 9D E5 EA 41 00 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 8D E9 EA 41 00 EB 01 E3 60 E8 03 00 00 00 D2 EB 0B 58 EB 01 48 40 EB 01 35 FF E0 E7 61 89 95 ED EA 41 00 60 E8 03 00 00 00 83 EB 0E EB 01 0C 58 EB 01 35 40 EB 01 36 FF E0 0B 61 89 B5 F1 EA 41 00 9C EB 01 D5 9D EB 01 0B 89 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: HACKSTOP_v119
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? D6 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule HACKSTOP_v119: PEiD
{
    strings:
        $a = { 52 BA ?? ?? 5A EB ?? 9A ?? ?? ?? ?? 30 CD 21 ?? ?? ?? D6 02 ?? ?? CD 20 0E 1F 52 BA ?? ?? 5A EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_CIH_Version_12_TTIT_WIN95CIH_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8D ?? ?? ?? 33 DB 64 87 03 E8 ?? ?? ?? ?? 5B 8D }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_CIH_Version_12_TTIT_WIN95CIH_additional: PEiD
{
    strings:
        $a = { 55 8D ?? ?? ?? 33 DB 64 87 03 E8 ?? ?? ?? ?? 5B 8D }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: HACKSTOP_v113
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 52 B8 ?? ?? 1E CD 21 86 E0 3D ?? ?? 73 ?? CD 20 0E 1F B4 09 E8 ?? ?? 24 ?? EA }

Detection condition:
$a at pe.entry_point

Full rule:
rule HACKSTOP_v113: PEiD
{
    strings:
        $a = { 52 B8 ?? ?? 1E CD 21 86 E0 3D ?? ?? 73 ?? CD 20 0E 1F B4 09 E8 ?? ?? 24 ?? EA }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXE_Stealth_v272_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXE_Stealth_v272_additional: PEiD
{
    strings:
        $a = { EB 00 EB 2F 53 68 61 72 65 77 61 72 65 20 2D 20 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: JEDMICS_CCITT4_Graphics_format
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 80 00 00 00 ?? ?? ?? 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule JEDMICS_CCITT4_Graphics_format: PEiD
{
    strings:
        $a = { 80 00 00 00 ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CreateInstall_200335
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CreateInstall_200335: PEiD
{
    strings:
        $a = { 81 EC 0C 04 00 00 53 56 57 55 68 60 50 40 00 6A 01 6A 00 FF 15 D8 80 40 00 8B F0 FF 15 D4 80 40 00 3D B7 00 00 00 75 0F 56 FF 15 B8 80 40 00 6A 02 FF 15 A4 80 40 00 33 DB E8 F2 FE FF FF 68 02 7F 00 00 89 1D 94 74 40 00 53 89 1D 98 74 40 00 FF 15 E4 80 40 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Phar_Lap_DOS_Extender_1986_91_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB ?? 8C D8 8E C0 B8 ?? ?? 8E D8 BB ?? ?? 8C C0 2B D8 81 ?? ?? ?? B4 4A CD 21 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Phar_Lap_DOS_Extender_1986_91_Hint_DOS_EP: PEiD
{
    strings:
        $a = { EB ?? 8C D8 8E C0 B8 ?? ?? 8E D8 BB ?? ?? 8C C0 2B D8 81 ?? ?? ?? B4 4A CD 21 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: aPack_v098_m_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 1E 06 8C C8 8E D8 05 ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B2 ?? BD ?? ?? 33 C9 50 A4 BB ?? ?? 3B F3 76 }

Detection condition:
$a at pe.entry_point

Full rule:
rule aPack_v098_m_additional: PEiD
{
    strings:
        $a = { 1E 06 8C C8 8E D8 05 ?? ?? 8E C0 50 BE ?? ?? 33 FF FC B2 ?? BD ?? ?? 33 C9 50 A4 BB ?? ?? 3B F3 76 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: aPack_066_COM
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8C C8 05 00 00 8E C0 59 8E D0 51 BE 9C 01 BF 00 01 50 57 FC B6 01 BD 7D 01 FF D5 73 5D FF D5 73 1C FF D5 73 3B BB 94 01 33 C9 FF D3 FF D3 FF D3 FF D3 8B D9 B1 01 85 DB 75 36 93 EB 38 E8 48 00 49 49 75 06 2E A1 00 01 EB 08 49 AC 8A E1 2E A3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule aPack_066_COM: PEiD
{
    strings:
        $a = { 8C C8 05 00 00 8E C0 59 8E D0 51 BE 9C 01 BF 00 01 50 57 FC B6 01 BD 7D 01 FF D5 73 5D FF D5 73 1C FF D5 73 3B BB 94 01 33 C9 FF D3 FF D3 FF D3 FF D3 8B D9 B1 01 85 DB 75 36 93 EB 38 E8 48 00 49 49 75 06 2E A1 00 01 EB 08 49 AC 8A E1 2E A3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASProtect_v123_RC4_build_0807_dll_Alexey_Solodovnikov
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASProtect_v123_RC4_build_0807_dll_Alexey_Solodovnikov: PEiD
{
    strings:
        $a = { 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 D5 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: COOLcryptor_09_kongfoo
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 03 00 00 00 E9 EB 07 FF 04 24 EB 01 FF C3 E8 03 00 00 00 EB 02 EA C3 EB 08 8D 8D 72 08 }

Detection condition:
$a at pe.entry_point

Full rule:
rule COOLcryptor_09_kongfoo: PEiD
{
    strings:
        $a = { E8 03 00 00 00 E9 EB 07 FF 04 24 EB 01 FF C3 E8 03 00 00 00 EB 02 EA C3 EB 08 8D 8D 72 08 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PEnguinCrypt_v10_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 8C D3 15 33 75 81 3E E8 0F 00 9A E8 F9 FF 9A 9C EB 01 9A 59 80 CD 01 51 9D EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule PEnguinCrypt_v10_additional: PEiD
{
    strings:
        $a = { B8 8C D3 15 33 75 81 3E E8 0F 00 9A E8 F9 FF 9A 9C EB 01 9A 59 80 CD 01 51 9D EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PEncrypt_10_JunkCode_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 9C BE 00 10 40 00 8B FE B9 ?? ?? ?? ?? BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61 E9 ?? ?? ?? FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule PEncrypt_10_JunkCode_additional: PEiD
{
    strings:
        $a = { 60 9C BE 00 10 40 00 8B FE B9 ?? ?? ?? ?? BB 78 56 34 12 AD 33 C3 AB E2 FA 9D 61 E9 ?? ?? ?? FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Borland_Pascal_v70_for_Windows
Repository: Yara-Rules/rules

Pattern signatures:
$a = { A1 C1 A3 83 75 57 51 33 C0 }
        $b = { 9A FF FF 00 00 9A FF FF 00 00 55 89 E5 31 C0 9A FF FF 00 00 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Borland_Pascal_v70_for_Windows: PEiD
{
    strings:
        $a = { A1 C1 A3 83 75 57 51 33 C0 }
        $b = { 9A FF FF 00 00 9A FF FF 00 00 55 89 E5 31 C0 9A FF FF 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: ASPack_108_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 90 90 75 01 90 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASPack_108_additional: PEiD
{
    strings:
        $a = { 90 90 90 75 01 90 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Thinstall_Virtualization_Suite_V310X_Thinstall_Company
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 2C FF FF FF E9 90 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 }
        $b = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 2C FF FF FF E9 90 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Thinstall_Virtualization_Suite_V310X_Thinstall_Company: PEiD
{
    strings:
        $a = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 2C FF FF FF E9 90 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 C0 E8 19 01 00 00 73 0E 8B 4D F8 E8 27 01 00 00 02 45 F7 AA EB E9 }
        $b = { 9C 60 68 53 74 41 6C 68 54 68 49 6E E8 00 00 00 00 58 BB ?? ?? ?? ?? 2B C3 50 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? E8 2C FF FF FF E9 90 FF FF FF CC CC 55 8B EC 83 C4 F4 FC 53 57 56 8B 75 08 8B 7D 0C C7 45 FC 08 00 00 00 33 DB BA 00 00 00 80 43 33 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Jam_211_EXE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 06 16 07 BE 22 02 8B FE B9 12 01 FD FA F3 2E A5 FB 06 BD 78 00 55 CB BE 00 00 8B FE BD 00 00 55 8D 9E 00 00 8D 97 00 00 B9 00 00 80 EF 10 8E DB 80 EE 10 8E C2 F3 A5 B5 80 3B DD 77 EE 33 C9 BE 00 00 8B FE 8E DA 8E C3 FC BA 01 00 EB 5E 5D }

Detection condition:
$a at pe.entry_point

Full rule:
rule Jam_211_EXE: PEiD
{
    strings:
        $a = { 50 06 16 07 BE 22 02 8B FE B9 12 01 FD FA F3 2E A5 FB 06 BD 78 00 55 CB BE 00 00 8B FE BD 00 00 55 8D 9E 00 00 8D 97 00 00 B9 00 00 80 EF 10 8E DB 80 EE 10 8E C2 F3 A5 B5 80 3B DD 77 EE 33 C9 BE 00 00 8B FE 8E DA 8E C3 FC BA 01 00 EB 5E 5D }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_FaxFreeTopo_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FA 06 33 C0 8E C0 B8 ?? ?? 26 ?? ?? ?? ?? 50 8C C8 26 ?? ?? ?? ?? 50 CC 58 9D 58 26 ?? ?? ?? ?? 58 26 ?? ?? ?? ?? 07 FB }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_FaxFreeTopo_additional: PEiD
{
    strings:
        $a = { FA 06 33 C0 8E C0 B8 ?? ?? 26 ?? ?? ?? ?? 50 8C C8 26 ?? ?? ?? ?? 50 CC 58 9D 58 26 ?? ?? ?? ?? 58 26 ?? ?? ?? ?? 07 FB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SimplePack_1X_Method2_bagie_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule SimplePack_1X_Method2_bagie_additional: PEiD
{
    strings:
        $a = { 4D 5A 90 EB 01 00 52 E9 ?? 01 00 00 50 45 00 00 4C 01 02 00 00 00 00 00 00 00 00 00 00 00 00 00 E0 00 0F 03 0B 01 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 0C 00 00 00 00 ?? ?? ?? 00 10 00 00 00 02 00 00 01 00 00 00 00 00 00 00 04 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_v190c
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 10 F2 40 00 68 74 9D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_v190c: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 10 F2 40 00 68 74 9D 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: NTkrnl_Secure_Suite_V01_V015_NTkrnl_Software
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule NTkrnl_Secure_Suite_V01_V015_NTkrnl_Software: PEiD
{
    strings:
        $a = { 00 00 00 00 00 00 00 00 00 00 00 00 34 10 00 00 28 10 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 4B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 68 ?? ?? ?? ?? E8 01 00 00 00 C3 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_v190a
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 64 FF 68 10 F2 40 00 68 14 9B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_v190a: PEiD
{
    strings:
        $a = { 55 8B EC 64 FF 68 10 F2 40 00 68 14 9B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: WARNING_TROJAN_ADinjector_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 61 BE 00 20 44 00 8D BE 00 F0 FB FF C7 87 9C E0 04 00 6A F0 8A 5E 57 83 CD FF EB 0E }

Detection condition:
$a at pe.entry_point

Full rule:
rule WARNING_TROJAN_ADinjector_additional: PEiD
{
    strings:
        $a = { 90 61 BE 00 20 44 00 8D BE 00 F0 FB FF C7 87 9C E0 04 00 6A F0 8A 5E 57 83 CD FF EB 0E }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EPW_120_COM
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 06 57 1E 56 55 52 51 53 50 BB 03 00 81 C3 00 01 2E 8B 07 8C CB 03 C3 05 10 00 50 B8 F3 00 50 CB 8C C0 05 10 00 8E C0 05 05 00 8E D8 2E 8B 0E 00 00 2B F6 2B FF FC F3 A4 0E 1F BA 20 00 B4 09 CD 21 BB 00 00 B9 10 00 B8 20 09 CD 10 BA 0E 00 B4 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EPW_120_COM: PEiD
{
    strings:
        $a = { 06 57 1E 56 55 52 51 53 50 BB 03 00 81 C3 00 01 2E 8B 07 8C CB 03 C3 05 10 00 50 B8 F3 00 50 CB 8C C0 05 10 00 8E C0 05 05 00 8E D8 2E 8B 0E 00 00 2B F6 2B FF FC F3 A4 0E 1F BA 20 00 B4 09 CD 21 BB 00 00 B9 10 00 B8 20 09 CD 10 BA 0E 00 B4 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_Microsoft_Visual_Cpp_620
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 55 8B EC 83 EC 50 53 56 57 BE 90 90 90 90 8D 7D F4 A5 A5 66 A5 8B }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_Microsoft_Visual_Cpp_620: PEiD
{
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 55 8B EC 83 EC 50 53 56 57 BE 90 90 90 90 8D 7D F4 A5 A5 66 A5 8B }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SuckStop_v111_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 2C 11 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30 00 00 00 38 00 00 00 00 00 00 00 37 BB 71 EC A4 E1 98 4C 9B FE 8F 0F FA 6A 07 F6 00 00 00 00 00 00 01 00 00 00 20 20 46 6F 72 20 73 74 75 64 00 20 54 6F 00 00 00 00 06 00 00 00 CC 1A 40 00 07 00 00 00 D4 }

Detection condition:
$a at pe.entry_point

Full rule:
rule SuckStop_v111_additional: PEiD
{
    strings:
        $a = { 68 2C 11 40 00 E8 F0 FF FF FF 00 00 00 00 00 00 30 00 00 00 38 00 00 00 00 00 00 00 37 BB 71 EC A4 E1 98 4C 9B FE 8F 0F FA 6A 07 F6 00 00 00 00 00 00 01 00 00 00 20 20 46 6F 72 20 73 74 75 64 00 20 54 6F 00 00 00 00 06 00 00 00 CC 1A 40 00 07 00 00 00 D4 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: XCR_v013_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 93 71 08 ?? ?? ?? ?? ?? ?? ?? ?? 8B D8 78 E2 ?? ?? ?? ?? 9C 33 C3 ?? ?? ?? ?? 60 79 CE ?? ?? ?? ?? E8 01 ?? ?? ?? ?? 83 C4 04 E8 AB FF FF FF ?? ?? ?? ?? 2B E8 ?? ?? ?? ?? 03 C5 FF 30 ?? ?? ?? ?? C6 ?? EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule XCR_v013_additional: PEiD
{
    strings:
        $a = { 93 71 08 ?? ?? ?? ?? ?? ?? ?? ?? 8B D8 78 E2 ?? ?? ?? ?? 9C 33 C3 ?? ?? ?? ?? 60 79 CE ?? ?? ?? ?? E8 01 ?? ?? ?? ?? 83 C4 04 E8 AB FF FF FF ?? ?? ?? ?? 2B E8 ?? ?? ?? ?? 03 C5 FF 30 ?? ?? ?? ?? C6 ?? EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PE_Diminisher_V01_Teraphy
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 53 51 52 56 57 55 E8 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PE_Diminisher_V01_Teraphy: PEiD
{
    strings:
        $a = { 53 51 52 56 57 55 E8 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PKLITE_v150_Device_driver_compression
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B4 09 BA 14 01 CD 21 B8 00 4C CD 21 F8 9C 50 53 51 52 56 57 55 1E 06 BB }

Detection condition:
$a at pe.entry_point

Full rule:
rule PKLITE_v150_Device_driver_compression: PEiD
{
    strings:
        $a = { B4 09 BA 14 01 CD 21 B8 00 4C CD 21 F8 9C 50 53 51 52 56 57 55 1E 06 BB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ExeSplitter_12_Bill_Prisoner_TPOC_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 95 02 00 00 64 A1 00 00 00 00 83 38 FF 74 04 8B 00 EB F7 8B 40 04 C3 55 8B EC B8 00 00 00 00 8B 75 08 81 E6 00 00 FF FF B9 06 00 00 00 56 56 E8 B0 00 00 00 5E 83 F8 01 75 06 8B C6 C9 C2 04 00 81 EE 00 00 01 00 E2 E5 C9 C2 04 00 55 8B EC 8B 75 0C 8B DE }

Detection condition:
$a at pe.entry_point

Full rule:
rule ExeSplitter_12_Bill_Prisoner_TPOC_additional: PEiD
{
    strings:
        $a = { E9 95 02 00 00 64 A1 00 00 00 00 83 38 FF 74 04 8B 00 EB F7 8B 40 04 C3 55 8B EC B8 00 00 00 00 8B 75 08 81 E6 00 00 FF FF B9 06 00 00 00 56 56 E8 B0 00 00 00 5E 83 F8 01 75 06 8B C6 C9 C2 04 00 81 EE 00 00 01 00 E2 E5 C9 C2 04 00 55 8B EC 8B 75 0C 8B DE }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PEtite_v13_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 66 9C 60 50 8D 88 ?? F0 ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1 68 ?? ?? ?? ?? 53 50 80 04 24 08 50 80 04 24 42 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PEtite_v13_additional: PEiD
{
    strings:
        $a = { 66 9C 60 50 8D 88 ?? F0 ?? ?? 8D 90 04 16 ?? ?? 8B DC 8B E1 68 ?? ?? ?? ?? 53 50 80 04 24 08 50 80 04 24 42 }
    condition:
        $a at pe.entry_point

}