deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: Private_Personal_Packer_PPP_v102_ConquestOfTroycom_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Private_Personal_Packer_PPP_v102_ConquestOfTroycom_additional: PEiD
{
    strings:
        $a = { E8 17 00 00 00 E8 68 00 00 00 FF 35 2C 37 00 10 E8 ED 01 00 00 6A 00 E8 2E 04 00 00 E8 41 04 00 00 A3 74 37 00 10 6A 64 E8 5F 04 00 00 E8 30 04 00 00 A3 78 37 00 10 6A 64 E8 4E 04 00 00 E8 1F 04 00 00 A3 7C 37 00 10 A1 74 37 00 10 8B 1D 78 37 00 10 2B D8 8B 0D 7C 37 00 10 2B C8 83 FB 64 73 0F 81 F9 C8 00 00 00 73 07 6A 00 E8 D9 03 00 00 C3 6A 0A 6A 07 6A 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: _PseudoSigner_02_PE_Intro_10
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A }

Detection condition:
$a at pe.entry_point

Full rule:
rule _PseudoSigner_02_PE_Intro_10: PEiD
{
    strings:
        $a = { 8B 04 24 9C 60 E8 14 00 00 00 5D 81 ED 0A 45 40 90 80 BD 67 44 40 90 90 0F 85 48 FF ED 0A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: WIBU_Key_V410A_WIBU_SYSTEMS_AG
Repository: Yara-Rules/rules

Pattern signatures:
$a = { F7 05 ?? ?? ?? ?? FF 00 00 00 75 12 }

Detection condition:
$a at pe.entry_point

Full rule:
rule WIBU_Key_V410A_WIBU_SYSTEMS_AG: PEiD
{
    strings:
        $a = { F7 05 ?? ?? ?? ?? FF 00 00 00 75 12 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASProtect_SKE_21x_exe_Alexey_Solodovnikov_h
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASProtect_SKE_21x_exe_Alexey_Solodovnikov_h: PEiD
{
    strings:
        $a = { 90 60 E8 03 00 00 00 E9 EB 04 5D 45 55 C3 E8 01 00 00 00 EB 5D BB ED FF FF FF 03 DD 81 EB 00 ?? ?? ?? 80 7D 4D 01 75 0C 8B 74 24 28 83 FE 01 89 5D 4E 75 31 8D 45 53 50 53 FF B5 ED 09 00 00 8D 45 35 50 E9 82 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: yodas_Protector_1031_Ashkibiz_Danehlar
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 74 72 42 00 8B D5 81 C2 C3 72 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3F A9 42 00 81 E9 6E 73 42 00 8B D5 81 C2 6E 73 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 98 2E 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC }

Detection condition:
$a at pe.entry_point

Full rule:
rule yodas_Protector_1031_Ashkibiz_Danehlar: PEiD
{
    strings:
        $a = { E8 03 00 00 00 EB 01 ?? BB 55 00 00 00 E8 03 00 00 00 EB 01 ?? E8 8F 00 00 00 E8 03 00 00 00 EB 01 ?? E8 82 00 00 00 E8 03 00 00 00 EB 01 ?? E8 B8 00 00 00 E8 03 00 00 00 EB 01 ?? E8 AB 00 00 00 E8 03 00 00 00 EB 01 ?? 83 FB 55 E8 03 00 00 00 EB 01 ?? 75 2E E8 03 00 00 00 EB 01 ?? C3 60 E8 00 00 00 00 5D 81 ED 74 72 42 00 8B D5 81 C2 C3 72 42 00 52 E8 01 00 00 00 C3 C3 E8 03 00 00 00 EB 01 ?? E8 0E 00 00 00 E8 D1 FF FF FF C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 CC C3 E8 03 00 00 00 EB 01 ?? 33 C0 64 FF 30 64 89 20 4B CC C3 E8 03 00 00 00 EB 01 ?? 33 DB B9 3F A9 42 00 81 E9 6E 73 42 00 8B D5 81 C2 6E 73 42 00 8D 3A 8B F7 33 C0 E8 03 00 00 00 EB 01 ?? E8 17 00 00 00 90 90 90 E9 98 2E 00 00 33 C0 64 FF 30 64 89 20 43 CC C3 90 EB 01 ?? AC }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EXECryptor_2xx_max_compressed_resources
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 EC FC 53 57 56 89 45 FC 89 55 F8 89 C6 89 D7 66 81 3E 4A 43 0F 85 23 01 00 00 83 C6 0A C7 45 F4 08 00 00 00 31 DB BA 00 00 00 80 43 31 C0 E8 11 01 00 00 73 0E 8B 4D F0 E8 1F 01 00 00 02 45 EF AA EB E9 E8 FC 00 00 00 0F 82 97 00 00 00 E8 F1 00 00 00 73 5B B9 04 00 00 00 E8 FD 00 00 00 48 74 DE 0F 89 C7 00 00 00 E8 D7 00 00 00 73 1B 55 BD 00 01 00 00 E8 D7 00 00 00 88 07 47 4D 75 F5 E8 BF 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 C8 00 00 00 83 C0 07 89 45 F0 C6 45 EF 00 83 F8 08 74 89 E8 A9 00 00 00 88 45 EF E9 7C FF FF FF B9 07 00 00 00 E8 A2 00 00 00 50 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EXECryptor_2xx_max_compressed_resources: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 EC FC 53 57 56 89 45 FC 89 55 F8 89 C6 89 D7 66 81 3E 4A 43 0F 85 23 01 00 00 83 C6 0A C7 45 F4 08 00 00 00 31 DB BA 00 00 00 80 43 31 C0 E8 11 01 00 00 73 0E 8B 4D F0 E8 1F 01 00 00 02 45 EF AA EB E9 E8 FC 00 00 00 0F 82 97 00 00 00 E8 F1 00 00 00 73 5B B9 04 00 00 00 E8 FD 00 00 00 48 74 DE 0F 89 C7 00 00 00 E8 D7 00 00 00 73 1B 55 BD 00 01 00 00 E8 D7 00 00 00 88 07 47 4D 75 F5 E8 BF 00 00 00 72 E9 5D EB A2 B9 01 00 00 00 E8 C8 00 00 00 83 C0 07 89 45 F0 C6 45 EF 00 83 F8 08 74 89 E8 A9 00 00 00 88 45 EF E9 7C FF FF FF B9 07 00 00 00 E8 A2 00 00 00 50 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: eXPressor_12_CGSoftLabs_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 }

Detection condition:
$a at pe.entry_point

Full rule:
rule eXPressor_12_CGSoftLabs_additional: PEiD
{
    strings:
        $a = { 55 8B EC 81 EC D4 01 00 00 53 56 57 EB 0C 45 78 50 72 2D 76 2E 31 2E 32 2E 2E B8 ?? ?? ?? ?? 2B 05 84 ?? ?? ?? A3 ?? ?? ?? ?? 83 3D ?? ?? ?? ?? 00 74 16 A1 ?? ?? ?? ?? 03 05 80 ?? ?? ?? 89 85 54 FE FF FF E9 ?? 07 00 00 C7 05 ?? ?? ?? ?? 01 00 00 00 68 04 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: OptLink_Pass_1
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 87 C0 55 56 57 52 51 53 50 9C FC 8C DA 83 C2 10 16 07 0E 1F 01 16 4E 01 01 16 52 01 33 F6 33 FF B9 AD 00 F3 A5 06 B8 30 00 50 BD 01 00 CB FD 8B 1E 54 01 B9 00 10 3B D9 77 02 8B CB 2B D9 8C D8 2B C1 8E D8 8C C0 2B C1 8E C0 03 C9 03 C9 03 C9 }

Detection condition:
$a at pe.entry_point

Full rule:
rule OptLink_Pass_1: PEiD
{
    strings:
        $a = { 87 C0 55 56 57 52 51 53 50 9C FC 8C DA 83 C2 10 16 07 0E 1F 01 16 4E 01 01 16 52 01 33 F6 33 FF B9 AD 00 F3 A5 06 B8 30 00 50 BD 01 00 CB FD 8B 1E 54 01 B9 00 10 3B D9 77 02 8B CB 2B D9 8C D8 2B C1 8E D8 8C C0 2B C1 8E C0 03 C9 03 C9 03 C9 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: RCryptor_v1_Vaska_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule RCryptor_v1_Vaska_additional: PEiD
{
    strings:
        $a = { 90 58 90 50 90 8B 00 90 3C 50 90 58 0F 85 67 D6 EF 11 50 68 ?? ?? ?? ?? B8 ?? ?? ?? ?? 3D ?? ?? ?? ?? 74 06 80 30 ?? 40 EB F3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Pelles_C_290_EXE_X86_CRT_LIB
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 02 E8 ?? ?? ?? ?? 59 A3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Pelles_C_290_EXE_X86_CRT_LIB: PEiD
{
    strings:
        $a = { 55 89 E5 6A FF 68 ?? ?? ?? ?? 68 ?? ?? ?? ?? 64 FF 35 ?? ?? ?? ?? 64 89 25 ?? ?? ?? ?? 83 EC ?? 83 EC ?? 53 56 57 89 65 E8 68 00 00 00 02 E8 ?? ?? ?? ?? 59 A3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Obsidium_v1331_Obsidium_Software_h_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 04 ?? ?? ?? ?? E8 2A 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsidium_v1331_Obsidium_Software_h_additional: PEiD
{
    strings:
        $a = { EB 04 ?? ?? ?? ?? E8 2A 00 00 00 EB 03 ?? ?? ?? EB 04 ?? ?? ?? ?? 8B 54 24 0C EB 02 ?? ?? 83 82 B8 00 00 00 26 EB 04 ?? ?? ?? ?? 33 C0 EB 02 ?? ?? C3 EB 01 ?? EB 03 ?? ?? ?? 64 67 FF 36 00 00 EB 02 ?? ?? 64 67 89 26 00 00 EB 02 ?? ?? EB 01 ?? 50 EB 04 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Jovian_VI_graphics_file
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 56 49 ?? ?? ?? ?? ?? 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Jovian_VI_graphics_file: PEiD
{
    strings:
        $a = { 56 49 ?? ?? ?? ?? ?? 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Obsidium_V1311_Obsidium_Software
Repository: Yara-Rules/rules

Pattern signatures:
$a = { EB 02 ?? ?? E8 27 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 22 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsidium_V1311_Obsidium_Software: PEiD
{
    strings:
        $a = { EB 02 ?? ?? E8 27 00 00 00 EB 02 ?? ?? EB 03 ?? ?? ?? 8B 54 24 0C EB 01 ?? 83 82 B8 00 00 00 22 EB 04 ?? ?? ?? ?? 33 C0 EB 01 ?? C3 EB 02 ?? ?? EB 02 ?? ?? 64 67 FF 36 00 00 EB 04 ?? ?? ?? ?? 64 67 89 26 00 00 EB 01 ?? EB 03 ?? ?? ?? 50 EB 03 ?? ?? ?? 33 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: DrWeb_v400p_Virus_DataBase
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 49 44 52 57 }

Detection condition:
$a at pe.entry_point

Full rule:
rule DrWeb_v400p_Virus_DataBase: PEiD
{
    strings:
        $a = { 49 44 52 57 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: EncryptPE_V22006710_V220070411_WFS_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule EncryptPE_V22006710_V220070411_WFS_additional: PEiD
{
    strings:
        $a = { 60 9C 64 FF 35 00 00 00 00 E8 1B 02 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? 00 00 00 00 6B 65 72 6E 65 6C 33 32 2E 64 6C 6C 00 00 00 47 65 74 54 65 6D 70 50 61 74 68 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 41 00 00 00 43 72 65 61 74 65 46 69 6C 65 4D 61 70 70 69 6E 67 41 00 00 00 4D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 55 6E 6D 61 70 56 69 65 77 4F 66 46 69 6C 65 00 00 00 43 6C 6F 73 65 48 61 6E 64 6C 65 00 00 00 4C 6F 61 64 4C 69 62 72 61 72 79 41 00 00 00 47 65 74 50 72 6F 63 41 64 64 72 65 73 73 00 00 00 45 78 69 74 50 72 6F 63 65 73 73 00 00 00 00 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Visual_Cpp_50_SP3_debug
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 00 00 40 00 68 00 00 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 94 53 56 57 89 65 E8 C7 45 FC 00 00 00 00 6A 02 FF 15 00 00 40 00 83 C4 04 C7 05 00 00 40 00 FF FF FF FF A1 00 00 40 00 A3 00 00 40 00 FF 15 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Visual_Cpp_50_SP3_debug: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 00 00 40 00 68 00 00 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 C4 94 53 56 57 89 65 E8 C7 45 FC 00 00 00 00 6A 02 FF 15 00 00 40 00 83 C4 04 C7 05 00 00 40 00 FF FF FF FF A1 00 00 40 00 A3 00 00 40 00 FF 15 00 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Upack_v037_v038_Beta_Strip_base_relocation_table_Option
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Upack_v037_v038_Beta_Strip_base_relocation_table_Option: PEiD
{
    strings:
        $a = { 53 18 33 C0 55 40 51 D3 E0 8B EA 91 FF 56 4C 33 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: DalKrypt_10_by_DalKiT_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 00 10 40 00 58 68 ?? ?? ?? 00 5F 33 DB EB 0D 8A 14 03 80 EA 07 80 F2 04 88 14 03 43 81 FB ?? ?? ?? 00 72 EB FF E7 }

Detection condition:
$a at pe.entry_point

Full rule:
rule DalKrypt_10_by_DalKiT_additional: PEiD
{
    strings:
        $a = { 68 00 10 40 00 58 68 ?? ?? ?? 00 5F 33 DB EB 0D 8A 14 03 80 EA 07 80 F2 04 88 14 03 43 81 FB ?? ?? ?? 00 72 EB FF E7 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Com4mail_v10
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 42 45 47 49 4E 3D 3D 3D 74 66 75 64 23 6F 66 5F 43 6F 6D 34 4D 61 69 6C 5F 66 69 6C 65 23 0D 0A }

Detection condition:
$a at pe.entry_point

Full rule:
rule Com4mail_v10: PEiD
{
    strings:
        $a = { 42 45 47 49 4E 3D 3D 3D 74 66 75 64 23 6F 66 5F 43 6F 6D 34 4D 61 69 6C 5F 66 69 6C 65 23 0D 0A }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ARJ_SFX_Custom
Repository: Yara-Rules/rules

Pattern signatures:
$a = { B8 ?? ?? ?? ?? 66 9C 60 50 8D 90 5C 01 00 00 68 00 00 40 00 83 3A 00 0F 84 C6 C1 FF FF 8B 04 24 8B 0A 0F BA F1 1F 73 13 FD 8B F0 8B F8 03 72 04 03 7A 08 F3 A5 83 C2 0C FC EB D9 83 C2 10 8B 5A }
        $b = { 60 BE 15 F0 40 00 8D BE EB 1F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule ARJ_SFX_Custom: PEiD
{
    strings:
        $a = { B8 ?? ?? ?? ?? 66 9C 60 50 8D 90 5C 01 00 00 68 00 00 40 00 83 3A 00 0F 84 C6 C1 FF FF 8B 04 24 8B 0A 0F BA F1 1F 73 13 FD 8B F0 8B F8 03 72 04 03 7A 08 F3 A5 83 C2 0C FC EB D9 83 C2 10 8B 5A }
        $b = { 60 BE 15 F0 40 00 8D BE EB 1F FF FF 57 83 CD FF EB 10 90 90 90 90 90 90 8A 06 46 88 07 47 01 DB 75 07 8B 1E 83 EE FC 11 DB 72 ED B8 01 00 00 00 01 DB 75 07 8B 1E 83 EE FC 11 DB 11 C0 01 DB 73 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: PEX_v099_bart
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 FA 30 41 00 C3 20 20 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PEX_v099_bart: PEiD
{
    strings:
        $a = { 68 FA 30 41 00 C3 20 20 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Setup_Factory_6003_Setup_Launcher
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Setup_Factory_6003_Setup_Launcher: PEiD
{
    strings:
        $a = { 55 8B EC 6A FF 68 90 61 40 00 68 70 3B 40 00 64 A1 00 00 00 00 50 64 89 25 00 00 00 00 83 EC 58 53 56 57 89 65 E8 FF 15 14 61 40 00 33 D2 8A D4 89 15 5C 89 40 00 8B C8 81 E1 FF 00 00 00 89 0D 58 89 40 00 C1 E1 08 03 CA 89 0D 54 89 40 00 C1 E8 10 A3 50 89 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: ASProtect_123_RC4_Solodovnikov_Alexey
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 68 01 F0 58 00 E8 01 00 00 00 C3 C3 }

Detection condition:
$a at pe.entry_point

Full rule:
rule ASProtect_123_RC4_Solodovnikov_Alexey: PEiD
{
    strings:
        $a = { 68 01 F0 58 00 E8 01 00 00 00 C3 C3 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: FreeJoiner_Small_build_014_021024_027_GlOFF
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 ?? ?? FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }
        $b = { E8 ?? ?? FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule FreeJoiner_Small_build_014_021024_027_GlOFF: PEiD
{
    strings:
        $a = { E8 ?? ?? FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 FF 25 AC 10 40 00 }
        $b = { E8 ?? ?? FF FF 6A 00 E8 0D 00 00 00 CC FF 25 78 10 40 00 FF 25 7C 10 40 00 FF 25 80 10 40 00 FF 25 84 10 40 00 FF 25 88 10 40 00 FF 25 8C 10 40 00 FF 25 90 10 40 00 FF 25 94 10 40 00 FF 25 98 10 40 00 FF 25 9C 10 40 00 FF 25 A0 10 40 00 FF 25 A4 10 40 00 }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: PH_Icons_file_Trilobyte_Hint_FILE_START
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 69 63 6F 6E 01 00 10 00 10 }

Detection condition:
$a at pe.entry_point

Full rule:
rule PH_Icons_file_Trilobyte_Hint_FILE_START: PEiD
{
    strings:
        $a = { 69 63 6F 6E 01 00 10 00 10 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Nullsoft_Install_System_v1xx_Nullsoft
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 83 EC 0C 53 56 57 FF 15 ?? ?? 40 00 05 E8 03 00 00 BE ?? ?? ?? 00 89 44 24 10 B3 20 FF 15 28 80 40 00 68 00 04 00 00 FF 15 ?? 81 40 00 50 56 FF 15 ?? 81 40 00 80 3D ?? ?? ?? 00 22 75 08 80 C3 02 BE ?? ?? ?? 00 8A 06 8B 3D F4 81 40 00 84 C0 74 19 3A C3 74 0B 56 FF D7 8B F0 8A 06 84 C0 75 F1 80 3E 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Nullsoft_Install_System_v1xx_Nullsoft: PEiD
{
    strings:
        $a = { 83 EC 0C 53 56 57 FF 15 ?? ?? 40 00 05 E8 03 00 00 BE ?? ?? ?? 00 89 44 24 10 B3 20 FF 15 28 80 40 00 68 00 04 00 00 FF 15 ?? 81 40 00 50 56 FF 15 ?? 81 40 00 80 3D ?? ?? ?? 00 22 75 08 80 C3 02 BE ?? ?? ?? 00 8A 06 8B 3D F4 81 40 00 84 C0 74 19 3A C3 74 0B 56 FF D7 8B F0 8A 06 84 C0 75 F1 80 3E 00 }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: CC_v261_Beta_additional
Repository: Yara-Rules/rules

Pattern signatures:
$a = { BA ?? ?? B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB }

Detection condition:
$a at pe.entry_point

Full rule:
rule CC_v261_Beta_additional: PEiD
{
    strings:
        $a = { BA ?? ?? B4 30 CD 21 3C 02 73 ?? 33 C0 06 50 CB }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Borland_Delphi_v60_KOL
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 83 C4 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 }
        $b = { 55 8B EC 83 C4 F0 B8 ?? ?? 40 00 E8 ?? ?? FF FF A1 ?? 72 40 00 33 D2 E8 ?? ?? FF FF A1 ?? 72 40 00 8B 00 83 C0 14 E8 ?? ?? FF FF E8 ?? ?? FF FF }

Detection condition:
for any of ($*) : ( $ at pe.entry_point )

Full rule:
rule Borland_Delphi_v60_KOL: PEiD
{
    strings:
        $a = { 55 8B EC 83 C4 53 56 57 33 C0 89 45 F0 89 45 D4 89 45 D0 }
        $b = { 55 8B EC 83 C4 F0 B8 ?? ?? 40 00 E8 ?? ?? FF FF A1 ?? 72 40 00 33 D2 E8 ?? ?? FF FF A1 ?? 72 40 00 8B 00 83 C0 14 E8 ?? ?? FF FF E8 ?? ?? FF FF }
    condition:
        for any of ($*) : ( $ at pe.entry_point )

}
YARA Detection Rule: eXPressorStandardV1701_CGSoftLabs_20090603
Repository: Yara-Rules/rules

Pattern signatures:
$a = { 55 8B EC 81 EC ?? 02 00 00 53 56 57 83 A5 A0 FD FF FF 00 F3 EB 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 40 04 25 00 00 00 80 74 61 83 7D 0C 01 75 2A 8B 45 08 A3 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 19 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 7D 0C 00 75 13 83 ?? ?? ?? ?? ?? ?? 74 0A E9 66 0A 00 00 E9 61 0A 00 00 83 ?? ?? ?? ?? ?? ?? 74 05 E9 BE 09 00 00 C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 78 60 00 75 1C 6A 10 6A 00 E8 AD 17 00 00 59 50 6A 01 E8 A4 17 00 00 59 50 6A 00 FF 15 ?? ?? ?? ?? E8 98 0A 00 00 A3 ?? ?? ?? ?? 6A 04 68 00 10 00 00 68 80 00 00 00 6A 00 FF 15 ?? ?? ?? ?? 89 85 D0 FD FF FF 68 04 01 00 00 8D 85 D8 FD FF FF 50 FF ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 84 05 D7 FD FF FF 89 85 A4 FD FF FF 8B 85 A4 FD FF FF 0F BE 00 83 F8 5C }

Detection condition:
$a at pe.entry_point

Full rule:
rule eXPressorStandardV1701_CGSoftLabs_20090603: PEiD
{
    strings:
        $a = { 55 8B EC 81 EC ?? 02 00 00 53 56 57 83 A5 A0 FD FF FF 00 F3 EB 0C ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 05 ?? ?? ?? ?? A3 ?? ?? ?? ?? A1 ?? ?? ?? ?? 8B 40 04 25 00 00 00 80 74 61 83 7D 0C 01 75 2A 8B 45 08 A3 ?? ?? ?? ?? 83 ?? ?? ?? ?? ?? ?? 75 19 6A 04 68 00 10 00 00 68 20 03 00 00 6A 00 FF 15 ?? ?? ?? ?? A3 ?? ?? ?? ?? 83 7D 0C 00 75 13 83 ?? ?? ?? ?? ?? ?? 74 0A E9 66 0A 00 00 E9 61 0A 00 00 83 ?? ?? ?? ?? ?? ?? 74 05 E9 BE 09 00 00 C7 ?? ?? ?? ?? ?? ?? ?? ?? ?? A1 ?? ?? ?? ?? 83 78 60 00 75 1C 6A 10 6A 00 E8 AD 17 00 00 59 50 6A 01 E8 A4 17 00 00 59 50 6A 00 FF 15 ?? ?? ?? ?? E8 98 0A 00 00 A3 ?? ?? ?? ?? 6A 04 68 00 10 00 00 68 80 00 00 00 6A 00 FF 15 ?? ?? ?? ?? 89 85 D0 FD FF FF 68 04 01 00 00 8D 85 D8 FD FF FF 50 FF ?? ?? ?? ?? ?? FF 15 ?? ?? ?? ?? 8D 84 05 D7 FD FF FF 89 85 A4 FD FF FF 8B 85 A4 FD FF FF 0F BE 00 83 F8 5C }
    condition:
        $a at pe.entry_point

}
YARA Detection Rule: Obsidium_v1250_Obsidium_Software_
Repository: Yara-Rules/rules

Pattern signatures:
$a = { E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00 }

Detection condition:
$a at pe.entry_point

Full rule:
rule Obsidium_v1250_Obsidium_Software_: PEiD
{
    strings:
        $a = { E8 0E 00 00 00 8B 54 24 0C 83 82 B8 00 00 00 0D 33 C0 C3 64 67 FF 36 00 00 64 67 89 26 00 00 50 33 C0 8B 00 C3 E9 FA 00 00 00 E8 D5 FF FF FF 58 64 67 8F 06 00 00 83 C4 04 E8 2B 13 00 00 }
    condition:
        $a at pe.entry_point

}