deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Vx_CIH_Version_12_TTIT_WIN95CIH_
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8D ?? ?? ?? 33 DB 64 87 03 E8 ?? ?? ?? ?? 5B 8D }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_CIH_Version_12_TTIT_WIN95CIH_: PEiD
{
    strings:
        $a = { 55 8D ?? ?? ?? 33 DB 64 87 03 E8 ?? ?? ?? ?? 5B 8D }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: North_Star_PE_Shrinker_13_Liuxingping_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 }

Detection condition:
$a at pe.entry_point

Full rule:
rule North_Star_PE_Shrinker_13_Liuxingping_additional: PEiD
{
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 B3 85 40 00 2D AC 85 40 00 2B E8 8D B5 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Noon1163_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? 5B 50 56 B4 CB CD 21 3C 07 ?? ?? 81 ?? ?? ?? 2E ?? ?? 4D 5A ?? ?? BF 00 01 89 DE FC }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Noon1163_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E8 ?? ?? 5B 50 56 B4 CB CD 21 3C 07 ?? ?? 81 ?? ?? ?? 2E ?? ?? 4D 5A ?? ?? BF 00 01 89 DE FC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Protect_31_EXE
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 2E A3 00 00 8C D8 2E A3 02 00 8C C8 2E A3 06 00 2E 89 2E 04 00 33 C0 8E D8 FA FC BE 04 00 0E 07 BF 08 00 A5 A5 BE 0C 00 A5 A5 1E 07 BE 04 00 BF 0C 00 B8 D4 01 AB 87 FE AB 2E A1 06 00 87 FE AB 87 F7 AB 89 E0 8C D3 0E 17 BC 85 00 B9 CD 01 4C }

Detection condition:
$a at pe.entry_point

Full rule:
rule Protect_31_EXE: PEiD
{
    strings:
        $a = { 2E A3 00 00 8C D8 2E A3 02 00 8C C8 2E A3 06 00 2E 89 2E 04 00 33 C0 8E D8 FA FC BE 04 00 0E 07 BF 08 00 A5 A5 BE 0C 00 A5 A5 1E 07 BE 04 00 BF 0C 00 B8 D4 01 AB 87 FE AB 2E A1 06 00 87 FE AB 87 F7 AB 89 E0 8C D3 0E 17 BC 85 00 B9 CD 01 4C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: MEW_11_SE_12
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
        $b = { E9 ?? ?? ?? ?? 0C ?? ?? ?? 00 00 00 00 00 00 00 00 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule MEW_11_SE_12: PEiD
{
    strings:
        $a = { E9 ?? ?? ?? FF 0C ?? 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? 00 0C ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
        $b = { E9 ?? ?? ?? ?? 0C ?? ?? ?? 00 00 00 00 00 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: Thinstall_24x_25x_Jitit_Software_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Thinstall_24x_25x_Jitit_Software_additional: PEiD
{
    strings:
        $a = { 6A 00 FF 15 20 50 40 00 E8 D4 F8 FF FF E9 E9 AD FF FF FF 8B C1 8B 4C 24 04 89 88 29 04 00 00 C7 40 0C 01 00 00 00 0F B6 49 01 D1 E9 89 48 10 C7 40 14 80 00 00 00 C2 04 00 8B 44 24 04 C7 41 0C 01 00 00 00 89 81 29 04 00 00 0F B6 40 01 D1 E8 89 41 10 C7 41 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: NsPack_v23_North_Star_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD }

Detection condition:
$a at pe.entry_point

Full rule:
rule NsPack_v23_North_Star_h: PEiD
{
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 07 00 00 00 2B E8 8D B5 ?? ?? FF FF 8B 06 83 F8 00 74 11 8D B5 ?? ?? FF FF 8B 06 83 F8 01 0F 84 4B 02 00 00 C7 06 01 00 00 00 8B D5 8B 85 ?? ?? FF FF 2B D0 89 95 ?? ?? FF FF 01 95 ?? ?? FF FF 8D B5 ?? ?? FF FF 01 16 8B 36 8B FD }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Crypto_Lock_202_Eng_Ryan_Thian_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Crypto_Lock_202_Eng_Ryan_Thian_additional: PEiD
{
    strings:
        $a = { 60 BE 15 90 40 00 8D BE EB 7F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 EF 75 09 8B 1E 83 EE FC 11 DB 73 E4 31 C9 83 E8 03 72 0D C1 E0 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Obsidium_10069_Obsidium_Software
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 02 ?? ?? E8 A3 1C 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsidium_10069_Obsidium_Software: PEiD
{
    strings:
        $a = { EB 02 ?? ?? E8 A3 1C 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SDProtector_11x_Randy_Li
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 }
        $b = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 00 00 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule SDProtector_11x_Randy_Li: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 1D 32 13 05 68 88 88 88 08 64 A1 }
        $b = { 55 8B EC 6A FF 68 ?? ?? ?? ?? 68 88 88 88 08 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 58 64 A3 00 00 00 00 58 58 58 58 8B E8 ?? ?? ?? ?? ?? ?? ?? 00 00 00 ?? ?? ?? ?? 00 00 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: PC_Guard_v500d_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { FC 2E 8C 0E ?? ?? A1 ?? ?? 8C CB 81 C3 ?? ?? 3B C3 72 ?? 2D ?? ?? 2D ?? ?? FA BC ?? ?? 8E D0 FB }

Detection condition:
$a at pe.entry_point

Full rule:
rule PC_Guard_v500d_additional: PEiD
{
    strings:
        $a = { FC 2E 8C 0E ?? ?? A1 ?? ?? 8C CB 81 C3 ?? ?? 3B C3 72 ?? 2D ?? ?? 2D ?? ?? FA BC ?? ?? 8E D0 FB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PAK_SFX_Archive_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 ?? ?? A1 ?? ?? 2E ?? ?? ?? 2E ?? ?? ?? ?? ?? 8C D7 8E C7 8D ?? ?? BE ?? ?? FC AC 3C 0D }

Detection condition:
$a at pe.entry_point

Full rule:
rule PAK_SFX_Archive_additional: PEiD
{
    strings:
        $a = { 55 8B EC 83 ?? ?? A1 ?? ?? 2E ?? ?? ?? 2E ?? ?? ?? ?? ?? 8C D7 8E C7 8D ?? ?? BE ?? ?? FC AC 3C 0D }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: AHTeam_EP_Protector_03_fake_Xtreme_Protector_105_FEUERRADER
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E8 00 00 00 00 5D 81 00 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule AHTeam_EP_Protector_03_fake_Xtreme_Protector_105_FEUERRADER: PEiD
{
    strings:
        $a = { 90 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 90 FF E0 E8 00 00 00 00 5D 81 00 00 00 00 00 6A 45 E8 A3 00 00 00 68 00 00 00 00 E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: GEM_Image_graphics_file_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 00 01 00 08 00 04 00 02 }

Detection condition:
$a at pe.entry_point

Full rule:
rule GEM_Image_graphics_file_Hint_FILE_START: PEiD
{
    strings:
        $a = { 00 01 00 08 00 04 00 02 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CRC2COM_v124_packed_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB ?? 8B FC 83 EF ?? 83 EC ?? BE ?? ?? B9 ?? ?? 57 F3 A4 5F FF E7 }

Detection condition:
$a at pe.entry_point

Full rule:
rule CRC2COM_v124_packed_Hint_DOS_EP: PEiD
{
    strings:
        $a = { EB ?? 8B FC 83 EF ?? 83 EC ?? BE ?? ?? B9 ?? ?? 57 F3 A4 5F FF E7 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PECompact_v14xp_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PECompact_v14xp_additional: PEiD
{
    strings:
        $a = { EB 06 68 ?? ?? ?? ?? C3 9C 60 E8 02 ?? ?? ?? 33 C0 8B C4 83 C0 04 93 8B E3 8B 5B FC 81 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FSG_v110_Eng_dulekxt_Microsoft_Visual_Basic_50_60
Repository: Yara-Rules/rules

Pattern signatures:
$a = { C1 CB 10 EB 01 0F B9 03 74 F6 EE 0F B6 D3 8D 05 83 ?? ?? EF 80 F3 F6 2B C1 EB 01 DE 68 77 }

Detection condition:
$a at pe.entry_point

Full rule:
rule FSG_v110_Eng_dulekxt_Microsoft_Visual_Basic_50_60: PEiD
{
    strings:
        $a = { C1 CB 10 EB 01 0F B9 03 74 F6 EE 0F B6 D3 8D 05 83 ?? ?? EF 80 F3 F6 2B C1 EB 01 DE 68 77 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Vx_Igor_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 1E B8 CD 7B CD 21 81 FB CD 7B 75 03 E9 87 00 33 DB 0E 1F 8C }

Detection condition:
$a at pe.entry_point

Full rule:
rule Vx_Igor_additional: PEiD
{
    strings:
        $a = { 1E B8 CD 7B CD 21 81 FB CD 7B 75 03 E9 87 00 33 DB 0E 1F 8C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: NsPack_14_Liuxingping_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 9C 60 E8 00 00 00 00 5D B8 ?? ?? 40 00 2D ?? ?? 40 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule NsPack_14_Liuxingping_additional: PEiD
{
    strings:
        $a = { 9C 60 E8 00 00 00 00 5D B8 ?? ?? 40 00 2D ?? ?? 40 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_V028_V0399_Dwing_20080321
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 09 00 00 00 ?? ?? ?? ?? E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 1C F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 1C B1 30 8B 5D 0C 03 D1 FF 16 73 4C 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 18 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 38 FF 56 0C 5B 91 FF 66 30 3C 07 B0 07 72 02 B0 0A 50 87 5D 10 87 5D 14 89 5D 18 8B D5 03 56 3C FF 56 0C 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D 9C 85 7C 03 00 00 FF 56 04 3C 04 8B D8 72 5F 33 DB D1 E8 13 DB 48 43 91 43 D3 E3 80 F9 05 8D 94 9D 7C 01 00 00 76 

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_V028_V0399_Dwing_20080321: PEiD
{
    strings:
        $a = { 60 E8 09 00 00 00 ?? ?? ?? ?? E9 06 02 00 00 33 C9 5E 87 0E E3 F4 2B F1 8B DE AD 2B D8 AD 03 C3 50 97 AD 91 F3 A5 5E AD 56 91 01 1E AD E2 FB AD 8D 6E 10 01 5D 00 8D 7D 1C B5 1C F3 AB 5E AD 53 50 51 97 58 8D 54 85 5C FF 16 72 57 2C 03 73 02 B0 00 3C 07 72 02 2C 03 50 0F B6 5F FF C1 E3 03 B3 00 8D 1C 5B 8D 9C 9D 0C 10 00 00 B0 01 E3 29 8B D7 2B 55 0C 8A 2A 33 D2 84 E9 0F 95 C6 52 FE C6 8A D0 8D 14 93 FF 16 5A 9F 12 C0 D0 E9 74 0E 9E 1A F2 74 E4 B4 00 33 C9 B5 01 FF 56 08 33 C9 FF 66 1C B1 30 8B 5D 0C 03 D1 FF 16 73 4C 03 D1 FF 16 72 19 03 D1 FF 16 72 29 3C 07 B0 09 72 02 B0 0B 50 8B C7 2B 45 0C 8A 00 FF 66 18 83 C2 60 FF 16 87 5D 10 73 0C 03 D1 FF 16 87 5D 14 73 03 87 5D 18 3C 07 B0 08 72 02 B0 0B 50 53 8B D5 03 56 38 FF 56 0C 5B 91 FF 66 30 3C 07 B0 07 72 02 B0 0A 50 87 5D 10 87 5D 14 89 5D 18 8B D5 03 56 3C FF 56 0C 6A 03 59 50 48 3B C1 72 02 8B C1 C1 E0 06 B1 40 8D 9C 85 7C 03 00 00 FF 56 04 3C 04 8B D8 72 5F 33 DB D1 E8 13 DB 48 43 91 43 D3 E3 80 F9 05 8D 94 9D 7C 01 00 00 76 2E 80 E9 04 33 C0 8B 55 00 D1 6D 08 8B 12 0F CA 2B 55 04 03 C0 3B 55 08 72 07 8B 55 08 40 01 55 04 FF 56 10 E2 E0 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: HACKSTOP_v111c_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 ?? CD 21 B0 ?? B4 4C CD 21 53 BB ?? ?? 5B EB }

Detection condition:
$a at pe.entry_point

Full rule:
rule HACKSTOP_v111c_Hint_DOS_EP: PEiD
{
    strings:
        $a = { B4 30 CD 21 86 E0 3D ?? ?? 73 ?? B4 ?? CD 21 B0 ?? B4 4C CD 21 53 BB ?? ?? 5B EB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Microsoft_QBasic
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B4 30 CD 21 3C 02 73 02 CD 20 BF 00 00 8B 36 02 00 2B F7 81 FE 00 10 72 03 BE 00 10 FA 8E D7 81 C4 00 00 FB 73 0B 33 C0 36 C7 06 00 00 00 00 EB 7D 83 E4 FE 36 89 26 00 00 8B C6 B1 04 D3 E0 48 36 A3 00 00 03 F7 89 36 02 00 8C C3 2B DE F7 DB }

Detection condition:
$a at pe.entry_point

Full rule:
rule Microsoft_QBasic: PEiD
{
    strings:
        $a = { B4 30 CD 21 3C 02 73 02 CD 20 BF 00 00 8B 36 02 00 2B F7 81 FE 00 10 72 03 BE 00 10 FA 8E D7 81 C4 00 00 FB 73 0B 33 C0 36 C7 06 00 00 00 00 EB 7D 83 E4 FE 36 89 26 00 00 8B C6 B1 04 D3 E0 48 36 A3 00 00 03 F7 89 36 02 00 8C C3 2B DE F7 DB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ActiveMark_Trymedia_Systems_Inc
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 89 25 ?? ?? ?? ?? 33 ED 55 8B EC E8 ?? ?? ?? ?? 8B D0 81 E2 FF 00 00 00 89 15 ?? ?? ?? ?? 8B D0 C1 EA 08 81 E2 FF 00 00 00 A3 ?? ?? ?? ?? D1 E0 0F 93 C3 33 C0 8A C3 A3 ?? ?? ?? ?? 68 FF 00 00 00 E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? BB ?? ?? ?? ?? C7 03 44 00 00 00 }
        $b = { 89 25 ?? ?? ?? ?? EB }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule ActiveMark_Trymedia_Systems_Inc: PEiD
{
    strings:
        $a = { 89 25 ?? ?? ?? ?? 33 ED 55 8B EC E8 ?? ?? ?? ?? 8B D0 81 E2 FF 00 00 00 89 15 ?? ?? ?? ?? 8B D0 C1 EA 08 81 E2 FF 00 00 00 A3 ?? ?? ?? ?? D1 E0 0F 93 C3 33 C0 8A C3 A3 ?? ?? ?? ?? 68 FF 00 00 00 E8 ?? ?? ?? ?? 6A 00 E8 ?? ?? ?? ?? A3 ?? ?? ?? ?? BB ?? ?? ?? ?? C7 03 44 00 00 00 }
        $b = { 89 25 ?? ?? ?? ?? EB }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: FreeJoiner_Small_build_033_GlOFF
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 50 66 33 C3 66 8B C1 58 E8 AC FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }
        $b = { 50 66 33 C3 66 8B C1 58 E8 AC FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule FreeJoiner_Small_build_033_GlOFF: PEiD
{
    strings:
        $a = { 50 66 33 C3 66 8B C1 58 E8 AC FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }
        $b = { 50 66 33 C3 66 8B C1 58 E8 AC FD FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: PESpin_1304_Cyberbob_h_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }

Detection condition:
$a at pe.entry_point

Full rule:
rule PESpin_1304_Cyberbob_h_additional: PEiD
{
    strings:
        $a = { EB 01 68 60 E8 00 00 00 00 8B 1C 24 83 C3 12 81 2B E8 B1 06 00 FE 4B FD 82 2C 24 AC DF 46 00 0B E4 74 9E 75 01 C7 81 73 04 D7 7A F7 2F 81 73 19 77 00 43 B7 F6 C3 6B B7 00 00 F9 FF E3 C9 C2 08 00 A3 68 72 01 FF 5D 33 C9 41 E2 17 EB 07 EA EB 01 EB EB 0D FF }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_301_305
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_301_305: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F B9 EB 0F B8 EB 07 B9 EB 0F 90 EB 08 FD EB 0B F2 EB F5 EB F6 F2 EB 08 FD EB E9 F3 EB E4 FC E9 59 58 50 51 EB 0F }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: TAV_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? 4D 5A CB }

Detection condition:
$a at pe.entry_point

Full rule:
rule TAV_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E8 ?? ?? 4D 5A CB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Safeguard_103_Simonzh
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Safeguard_103_Simonzh: PEiD
{
    strings:
        $a = { E8 ?? 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Armadillo_v260b2_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 90 ?? ?? ?? 68 24 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 60 ?? ?? ?? 33 D2 8A D4 89 15 3C }

Detection condition:
$a at pe.entry_point

Full rule:
rule Armadillo_v260b2_additional: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 90 ?? ?? ?? 68 24 ?? ?? ?? 64 A1 ?? ?? ?? ?? 50 64 89 25 ?? ?? ?? ?? 83 EC 58 53 56 57 89 65 E8 FF 15 60 ?? ?? ?? 33 D2 8A D4 89 15 3C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: BJFnt_v12_RC_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 02 09 94 0F B7 FF 68 80 ?? ?? 00 81 F6 8E 00 00 00 5B EB 02 11 C2 8D 05 F4 00 00 00 47 }

Detection condition:
$a at pe.entry_point

Full rule:
rule BJFnt_v12_RC_additional: PEiD
{
    strings:
        $a = { EB 02 09 94 0F B7 FF 68 80 ?? ?? 00 81 F6 8E 00 00 00 5B EB 02 11 C2 8D 05 F4 00 00 00 47 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: File_Analyzer_Compiled_Datafile_Version_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 46 69 6C 65 20 41 6E 61 6C 79 7A 65 72 20 43 6F 6D 70 69 6C 65 64 20 44 61 74 61 66 69 6C 65 20 56 65 72 73 69 6F 6E }

Detection condition:
$a at pe.entry_point

Full rule:
rule File_Analyzer_Compiled_Datafile_Version_additional: PEiD
{
    strings:
        $a = { 46 69 6C 65 20 41 6E 61 6C 79 7A 65 72 20 43 6F 6D 70 69 6C 65 64 20 44 61 74 61 66 69 6C 65 20 56 65 72 73 69 6F 6E }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Comprot_v10b_Hint_DOS_EP
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E9 ?? ?? E8 ?? ?? 5E 8B EE 81 ?? ?? ?? 8D ?? ?? ?? B9 ?? ?? F6 14 46 E2 ?? 4B }

Detection condition:
$a at pe.entry_point

Full rule:
rule Comprot_v10b_Hint_DOS_EP: PEiD
{
    strings:
        $a = { E9 ?? ?? E8 ?? ?? 5E 8B EE 81 ?? ?? ?? 8D ?? ?? ?? B9 ?? ?? F6 14 46 E2 ?? 4B }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Pohernah_Crypter_V103_Kas
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 E8 00 00 00 00 5D 81 ED 2A 27 40 00 31 C0 40 83 F0 06 40 3D 40 1F 00 00 75 07 BE 6A 27 40 00 EB 02 EB EB 8B 85 9E 28 40 00 83 F8 01 75 17 31 C0 01 EE 3D 99 00 00 00 74 0C 8B 8D 86 28 40 00 30 0E 40 46 EB ED }

Detection condition:
$a at pe.entry_point

Full rule:
rule Pohernah_Crypter_V103_Kas: PEiD
{
    strings:
        $a = { 60 E8 00 00 00 00 5D 81 ED 2A 27 40 00 31 C0 40 83 F0 06 40 3D 40 1F 00 00 75 07 BE 6A 27 40 00 EB 02 EB EB 8B 85 9E 28 40 00 83 F8 01 75 17 31 C0 01 EE 3D 99 00 00 00 74 0C 8B 8D 86 28 40 00 30 0E 40 46 EB ED }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: XMI_music_file_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 46 4F 52 4D ?? ?? ?? ?? 58 4D 49 44 }

Detection condition:
$a at pe.entry_point

Full rule:
rule XMI_music_file_additional: PEiD
{
    strings:
        $a = { 46 4F 52 4D ?? ?? ?? ?? 58 4D 49 44 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: PseudoSigner_01_FSG_10_Anorganix
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PseudoSigner_01_FSG_10_Anorganix: PEiD
{
    strings:
        $a = { 90 90 90 90 68 ?? ?? ?? ?? 67 64 FF 36 00 00 67 64 89 26 00 00 F1 90 90 90 90 BB D0 01 40 00 BF 00 10 40 00 BE 90 90 90 90 53 E8 0A 00 00 00 02 D2 75 05 8A 16 46 12 D2 C3 FC B2 80 A4 6A 02 5B E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_VOB_ProtectCD_5
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 36 3E 26 8A C0 60 E8 00 00 00 00 E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_VOB_ProtectCD_5: PEiD
{
    strings:
        $a = { 36 3E 26 8A C0 60 E8 00 00 00 00 E9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: SLVc0deProtector_06_SLV
Repository: Yara-Rules/rules

Pattern signatures:
$a = { ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 }

Detection condition:
$a at pe.entry_point

Full rule:
rule SLVc0deProtector_06_SLV: PEiD
{
    strings:
        $a = { ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? E8 49 00 00 00 69 E8 49 00 00 00 95 E8 4F 00 00 00 68 E8 1F 00 00 00 49 E8 E9 FF FF FF 67 E8 1F 00 00 00 93 E8 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_01_LCC_Win32_DLL
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 ?? ?? ?? ?? E9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_01_LCC_Win32_DLL: PEiD
{
    strings:
        $a = { 55 89 E5 53 56 57 83 7D 0C 01 75 05 E8 17 90 90 90 FF 75 10 FF 75 0C FF 75 08 A1 ?? ?? ?? ?? E9 }
    condition:
        $a at pe.entry_point

}