deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: cert_blocklist_4929ab561c812af93ddb9758b545f546
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Everything Wow s.r.o." and
            pe.signatures[i].serial == "49:29:ab:56:1c:81:2a:f9:3d:db:97:58:b5:45:f5:46" and
           [PII_REDACTED] <= pe.signatures[i].not_after
   

Full rule:
rule cert_blocklist_4929ab561c812af93ddb9758b545f546 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Everything Wow s.r.o." and
            pe.signatures[i].serial == "49:29:ab:56:1c:81:2a:f9:3d:db:97:58:b5:45:f5:46" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_25c6dbce3d5499f65d9df16e9007465d
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "AMCERT,LLC" and
            pe.signatures[i].serial == "25:c6:db:ce:3d:54:99:f6:5d:9d:f1:6e:90:07:46:5d" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )

Full rule:
rule cert_blocklist_25c6dbce3d5499f65d9df16e9007465d {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "AMCERT,LLC" and
            pe.signatures[i].serial == "25:c6:db:ce:3d:54:99:f6:5d:9d:f1:6e:90:07:46:5d" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_bc6a1812e[PII_REDACTED]41108973bbd52
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "AMCERT,LLC" and (
                pe.signatures[i].serial == "00:bc:6a:18:12:e0:01:36:24:69:54:11:08:97:3b:bd:52" or
                pe.signatures[i].serial == "bc:6a:18:12:e0:

Full rule:
rule cert_blocklist_bc6a1812e[PII_REDACTED]41108973bbd52 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "AMCERT,LLC" and (
                pe.signatures[i].serial == "00:bc:6a:18:12:e0:01:36:24:69:54:11:08:97:3b:bd:52" or
                pe.signatures[i].serial == "bc:6a:18:12:e0:01:36:24:69:54:11:08:97:3b:bd:52"
            ) and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_bde1d6dc3622724f427a39e6a34f5124
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "AMCERT,LLC" and (
                pe.signatures[i].serial == "00:bd:e1:d6:dc:36:22:72:4f:42:7a:39:e6:a3:4f:51:24" or
                pe.signatures[i].serial == "bd:e1:d6:dc:36:

Full rule:
rule cert_blocklist_bde1d6dc3622724f427a39e6a34f5124 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "AMCERT,LLC" and (
                pe.signatures[i].serial == "00:bd:e1:d6:dc:36:22:72:4f:42:7a:39:e6:a3:4f:51:24" or
                pe.signatures[i].serial == "bd:e1:d6:dc:36:22:72:4f:42:7a:39:e6:a3:4f:51:24"
            ) and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_5c9f5f96726a6e6fc3b8bb153ac82af2
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "1105 SOFTWARE LLC" and
            pe.signatures[i].serial == "5c:9f:5f:96:72:6a:6e:6f:c3:b8:bb:15:3a:c8:2a:f2" and
           [PII_REDACTED] <= pe.signatures[i].not_after
       

Full rule:
rule cert_blocklist_5c9f5f96726a6e6fc3b8bb153ac82af2 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "1105 SOFTWARE LLC" and
            pe.signatures[i].serial == "5c:9f:5f:96:72:6a:6e:6f:c3:b8:bb:15:3a:c8:2a:f2" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_6e889bb3b7f7194b674c6a0335a608e0
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "CLEVERCONTROL LLC" and
            pe.signatures[i].serial == "6e:88:9b:b3:b7:f7:19:4b:67:4c:6a:03:35:a6:08:e0" and
           [PII_REDACTED] <= pe.signatures[i].not_after
       

Full rule:
rule cert_blocklist_6e889bb3b7f7194b674c6a0335a608e0 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "CLEVERCONTROL LLC" and
            pe.signatures[i].serial == "6e:88:9b:b3:b7:f7:19:4b:67:4c:6a:03:35:a6:08:e0" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_0f62f760704bdf8dc30c7baa7376f484
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Shanghai XuSong investment partnership Enterprise(Limited)" and
            pe.signatures[i].serial == "0f:62:f7:60:70:4b:df:8d:c3:0c:7b:aa:73:76:f4:84" and
            1659398

Full rule:
rule cert_blocklist_0f62f760704bdf8dc30c7baa7376f484 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Shanghai XuSong investment partnership Enterprise(Limited)" and
            pe.signatures[i].serial == "0f:62:f7:60:70:4b:df:8d:c3:0c:7b:aa:73:76:f4:84" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_071202dbfda40b629c5e7acac947c2d3
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Crossfire Industries, LLC" and
            pe.signatures[i].serial == "07:12:02:db:fd:a4:0b:62:9c:5e:7a:ca:c9:47:c2:d3" and
           [PII_REDACTED] <= pe.signatures[i].not_after

Full rule:
rule cert_blocklist_071202dbfda40b629c5e7acac947c2d3 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Crossfire Industries, LLC" and
            pe.signatures[i].serial == "07:12:02:db:fd:a4:0b:62:9c:5e:7a:ca:c9:47:c2:d3" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_98ab9585c04d7f0e4cf4de98c14b684d
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "AMCERT,LLC" and (
                pe.signatures[i].serial == "00:98:ab:95:85:c0:4d:7f:0e:4c:f4:de:98:c1:4b:68:4d" or
                pe.signatures[i].serial == "98:ab:95:85:c0:

Full rule:
rule cert_blocklist_98ab9585c04d7f0e4cf4de98c14b684d {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "AMCERT,LLC" and (
                pe.signatures[i].serial == "00:98:ab:95:85:c0:4d:7f:0e:4c:f4:de:98:c1:4b:68:4d" or
                pe.signatures[i].serial == "98:ab:95:85:c0:4d:7f:0e:4c:f4:de:98:c1:4b:68:4d"
            ) and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_4631713e66e91347f0388b98cf747794
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "\\xE5\\xB9\\xBF\\xE5\\xB7\\x9E\\xE6\\x98\\x8A\\xE5\\x8A\\xA8\\xE7\\xBD\\x91\\xE7\\xBB\\x9C\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\

Full rule:
rule cert_blocklist_4631713e66e91347f0388b98cf747794 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "\\xE5\\xB9\\xBF\\xE5\\xB7\\x9E\\xE6\\x98\\x8A\\xE5\\x8A\\xA8\\xE7\\xBD\\x91\\xE7\\xBB\\x9C\\xE7\\xA7\\x91\\xE6\\x8A\\x80\\xE6\\x9C\\x89\\xE9\\x99\\x90\\xE5\\x85\\xAC\\xE5\\x8F\\xB8" and
            pe.signatures[i].serial == "46:31:71:3e:66:e9:13:47:f0:38:8b:98:cf:74:77:94" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_e963f8983d21b4c1a69c66a9d37498e5
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Max Steinhard" and (
                pe.signatures[i].serial == "00:e9:63:f8:98:3d:21:b4:c1:a6:9c:66:a9:d3:74:98:e5" or
                pe.signatures[i].serial == "e9:63:f8:98:

Full rule:
rule cert_blocklist_e963f8983d21b4c1a69c66a9d37498e5 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Max Steinhard" and (
                pe.signatures[i].serial == "00:e9:63:f8:98:3d:21:b4:c1:a6:9c:66:a9:d3:74:98:e5" or
                pe.signatures[i].serial == "e9:63:f8:98:3d:21:b4:c1:a6:9c:66:a9:d3:74:98:e5"
            ) and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_6e44fcedd49f22f7a28cecc99104f61a
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "M-Trans Maciej Caban" and
            pe.signatures[i].serial == "6e:44:fc:ed:d4:9f:22:f7:a2:8c:ec:c9:91:04:f6:1a" and
           [PII_REDACTED] <= pe.signatures[i].not_after
    

Full rule:
rule cert_blocklist_6e44fcedd49f22f7a28cecc99104f61a {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "M-Trans Maciej Caban" and
            pe.signatures[i].serial == "6e:44:fc:ed:d4:9f:22:f7:a2:8c:ec:c9:91:04:f6:1a" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_35b49ee870aea532e6ef0a4987105c8f
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Kancelaria Adwokacka Adwokat Aleksandra Krzemi\\xC5\\x84ska" and
            pe.signatures[i].serial == "35:b4:9e:e8:70:ae:a5:32:e6:ef:0a:49:87:10:5c:8f" and
            166315

Full rule:
rule cert_blocklist_35b49ee870aea532e6ef0a4987105c8f {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Kancelaria Adwokacka Adwokat Aleksandra Krzemi\\xC5\\x84ska" and
            pe.signatures[i].serial == "35:b4:9e:e8:70:ae:a5:32:e6:ef:0a:49:87:10:5c:8f" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_063dcd7d7b0bc77cac844c7213be3989
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "HANNAH SISK LIMITED" and
            pe.signatures[i].serial == "06:3d:cd:7d:7b:0b:c7:7c:ac:84:4c:72:13:be:39:89" and
           [PII_REDACTED] <= pe.signatures[i].not_after
     

Full rule:
rule cert_blocklist_063dcd7d7b0bc77cac844c7213be3989 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "HANNAH SISK LIMITED" and
            pe.signatures[i].serial == "06:3d:cd:7d:7b:0b:c7:7c:ac:84:4c:72:13:be:39:89" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_6f8777aa866142ad7120e5e1c9321e37
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "CLOUD SOFTWARE LINE CO., LTD." and
            pe.signatures[i].serial == "6f:87:77:aa:86:61:42:ad:71:20:e5:e1:c9:32:1e:37" and
           [PII_REDACTED] <= pe.signatures[i].not_a

Full rule:
rule cert_blocklist_6f8777aa866142ad7120e5e1c9321e37 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "CLOUD SOFTWARE LINE CO., LTD." and
            pe.signatures[i].serial == "6f:87:77:aa:86:61:42:ad:71:20:e5:e1:c9:32:1e:37" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_4a7f07c5d4ad2e23f9e8e03f0e229dd4
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Danalis LLC" and
            pe.signatures[i].serial == "4a:7f:07:c5:d4:ad:2e:23:f9:e8:e0:3f:0e:22:9d:d4" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )

Full rule:
rule cert_blocklist_4a7f07c5d4ad2e23f9e8e03f0e229dd4 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Danalis LLC" and
            pe.signatures[i].serial == "4a:7f:07:c5:d4:ad:2e:23:f9:e8:e0:3f:0e:22:9d:d4" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_f5f9c8f8c33e4ce84dd48fcb03ccb075
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Abdulkadir \\xC5\\x9Eahin" and (
                pe.signatures[i].serial == "00:f5:f9:c8:f8:c3:3e:4c:e8:4d:d4:8f:cb:03:cc:b0:75" or
                pe.signatures[i].serial == "

Full rule:
rule cert_blocklist_f5f9c8f8c33e4ce84dd48fcb03ccb075 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Abdulkadir \\xC5\\x9Eahin" and (
                pe.signatures[i].serial == "00:f5:f9:c8:f8:c3:3e:4c:e8:4d:d4:8f:cb:03:cc:b0:75" or
                pe.signatures[i].serial == "f5:f9:c8:f8:c3:3e:4c:e8:4d:d4:8f:cb:03:cc:b0:75"
            ) and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_57fc55239f21f139978609e323097132
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Aidem Media Limited" and
            pe.signatures[i].serial == "57:fc:55:23:9f:21:f1:39:97:86:09:e3:23:09:71:32" and
           [PII_REDACTED] <= pe.signatures[i].not_after
     

Full rule:
rule cert_blocklist_57fc55239f21f139978609e323097132 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Aidem Media Limited" and
            pe.signatures[i].serial == "57:fc:55:23:9f:21:f1:39:97:86:09:e3:23:09:71:32" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_eeefec4308abe63323600e1608f5e6f2
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "YUPITER-STROI, OOO" and (
                pe.signatures[i].serial == "00:ee:ef:ec:43:08:ab:e6:33:23:60:0e:16:08:f5:e6:f2" or
                pe.signatures[i].serial == "ee:ef:e

Full rule:
rule cert_blocklist_eeefec4308abe63323600e1608f5e6f2 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "YUPITER-STROI, OOO" and (
                pe.signatures[i].serial == "00:ee:ef:ec:43:08:ab:e6:33:23:60:0e:16:08:f5:e6:f2" or
                pe.signatures[i].serial == "ee:ef:ec:43:08:ab:e6:33:23:60:0e:16:08:f5:e6:f2"
            ) and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}