deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: cert_blocklist_101d6a5a29d9a77807553ceac669d853
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "BIC GROUP LIMITED" and
            pe.signatures[i].serial == "10:1d:6a:5a:29:d9:a7:78:07:55:3c:ea:c6:69:d8:53" and
           [PII_REDACTED] <= pe.signatures[i].not_after
       

Full rule:
rule cert_blocklist_101d6a5a29d9a77807553ceac669d853 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "BIC GROUP LIMITED" and
            pe.signatures[i].serial == "10:1d:6a:5a:29:d9:a7:78:07:55:3c:ea:c6:69:d8:53" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_6000f8c02b0a15b1e53b8399845faddf
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "SAY LIMITED" and
            pe.signatures[i].serial == "60:00:f8:c0:2b:0a:15:b1:e5:3b:83:99:84:5f:ad:df" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )

Full rule:
rule cert_blocklist_6000f8c02b0a15b1e53b8399845faddf {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "SAY LIMITED" and
            pe.signatures[i].serial == "60:00:f8:c0:2b:0a:15:b1:e5:3b:83:99:84:5f:ad:df" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_121070be1e782f206985543bc7bc58b6
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Prod Can Holdings Inc." and
            pe.signatures[i].serial == "12:10:70:be:1e:78:2f:20:69:85:54:3b:c7:bc:58:b6" and
           [PII_REDACTED] <= pe.signatures[i].not_after
  

Full rule:
rule cert_blocklist_121070be1e782f206985543bc7bc58b6 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Prod Can Holdings Inc." and
            pe.signatures[i].serial == "12:10:70:be:1e:78:2f:20:69:85:54:3b:c7:bc:58:b6" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_5226a724cfa0b4bc0164ecda3f02a3dc
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "VALENTE SP Z O O" and
            pe.signatures[i].serial == "52:26:a7:24:cf:a0:b4:bc:01:64:ec:da:3f:02:a3:dc" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        

Full rule:
rule cert_blocklist_5226a724cfa0b4bc0164ecda3f02a3dc {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "VALENTE SP Z O O" and
            pe.signatures[i].serial == "52:26:a7:24:cf:a0:b4:bc:01:64:ec:da:3f:02:a3:dc" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_0a7be7722b65a866ebcd3bd7f8f10825
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Rebound Infotech Limited" and
            pe.signatures[i].serial == "0a:7b:e7:72:2b:65:a8:66:eb:cd:3b:d7:f8:f1:08:25" and
           [PII_REDACTED] <= pe.signatures[i].not_after


Full rule:
rule cert_blocklist_0a7be7722b65a866ebcd3bd7f8f10825 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Rebound Infotech Limited" and
            pe.signatures[i].serial == "0a:7b:e7:72:2b:65:a8:66:eb:cd:3b:d7:f8:f1:08:25" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_05634456dbedb3556ca8415e64815c5d
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Walden Intertech Inc." and
            pe.signatures[i].serial == "05:63:44:56:db:ed:b3:55:6c:a8:41:5e:64:81:5c:5d" and
           [PII_REDACTED] <= pe.signatures[i].not_after
   

Full rule:
rule cert_blocklist_05634456dbedb3556ca8415e64815c5d {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Walden Intertech Inc." and
            pe.signatures[i].serial == "05:63:44:56:db:ed:b3:55:6c:a8:41:5e:64:81:5c:5d" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_2e07a8d6e3b25ae010c8ed2c4ab0fb37
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Emurasoft, Inc." and
            pe.signatures[i].serial == "2e:07:a8:d6:e3:b2:5a:e0:10:c8:ed:2c:4a:b0:fb:37" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )

Full rule:
rule cert_blocklist_2e07a8d6e3b25ae010c8ed2c4ab0fb37 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Emurasoft, Inc." and
            pe.signatures[i].serial == "2e:07:a8:d6:e3:b2:5a:e0:10:c8:ed:2c:4a:b0:fb:37" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_30b4eeebd88fd205acc8577bbaed8655
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Enforcer Srl" and
            pe.signatures[i].serial == "30:b4:ee:eb:d8:8f:d2:05:ac:c8:57:7b:ba:ed:86:55" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )

Full rule:
rule cert_blocklist_30b4eeebd88fd205acc8577bbaed8655 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Enforcer Srl" and
            pe.signatures[i].serial == "30:b4:ee:eb:d8:8f:d2:05:ac:c8:57:7b:ba:ed:86:55" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_b3391a6c1b3c[PII_REDACTED]e2384ab4ca
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "VERIFIED SOFTWARE LLC" and (
                pe.signatures[i].serial == "00:b3:39:1a:6c:1b:3c:68:36:53:39:59:e2:38:4a:b4:ca" or
                pe.signatures[i].serial == "b3:3

Full rule:
rule cert_blocklist_b3391a6c1b3c[PII_REDACTED]e2384ab4ca {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "VERIFIED SOFTWARE LLC" and (
                pe.signatures[i].serial == "00:b3:39:1a:6c:1b:3c:68:36:53:39:59:e2:38:4a:b4:ca" or
                pe.signatures[i].serial == "b3:39:1a:6c:1b:3c:68:36:53:39:59:e2:38:4a:b4:ca"
            ) and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_05d50a0e09bb9a836ffb90a3
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Toliz Info Tech Solutions INC." and
            pe.signatures[i].serial == "05:d5:0a:0e:09:bb:9a:83:6f:fb:90:a3" and
           [PII_REDACTED] <= pe.signatures[i].not_after
      

Full rule:
rule cert_blocklist_05d50a0e09bb9a836ffb90a3 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Toliz Info Tech Solutions INC." and
            pe.signatures[i].serial == "05:d5:0a:0e:09:bb:9a:83:6f:fb:90:a3" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_0a2787fbb4627c91611573e323584113
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "exxon.com" and
            pe.signatures[i].serial == "0a:27:87:fb:b4:62:7c:91:61:15:73:e3:23:58:41:13" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )

Full rule:
rule cert_blocklist_0a2787fbb4627c91611573e323584113 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "exxon.com" and
            pe.signatures[i].serial == "0a:27:87:fb:b4:62:7c:91:61:15:73:e3:23:58:41:13" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_1d36c4f439d[PII_REDACTED]18f
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "REDWOOD MARKETING SOLUTIONS INC." and
            pe.signatures[i].serial == "1d:36:c4:f4:39:d6:51:50:35:89:31:8f" and
           [PII_REDACTED] <= pe.signatures[i].not_after
    

Full rule:
rule cert_blocklist_1d36c4f439d[PII_REDACTED]18f {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "REDWOOD MARKETING SOLUTIONS INC." and
            pe.signatures[i].serial == "1d:36:c4:f4:39:d6:51:50:35:89:31:8f" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_26f855a25890b749578f13e4b9459768
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Boo\\xE2\\x80\\x99s Q & Sweets Corporation" and
            pe.signatures[i].serial == "26:f8:55:a2:58:90:b7:49:57:8f:13:e4:b9:45:97:68" and
           [PII_REDACTED] <= pe.signat

Full rule:
rule cert_blocklist_26f855a25890b749578f13e4b9459768 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Boo\\xE2\\x80\\x99s Q & Sweets Corporation" and
            pe.signatures[i].serial == "26:f8:55:a2:58:90:b7:49:57:8f:13:e4:b9:45:97:68" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_0f1ae2239bb96c5aef49d0ae50266912
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Aarav Consulting Inc." and
            pe.signatures[i].serial == "0f:1a:e2:23:9b:b9:6c:5a:ef:49:d0:ae:50:26:69:12" and
           [PII_REDACTED] <= pe.signatures[i].not_after
   

Full rule:
rule cert_blocklist_0f1ae2239bb96c5aef49d0ae50266912 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Aarav Consulting Inc." and
            pe.signatures[i].serial == "0f:1a:e2:23:9b:b9:6c:5a:ef:49:d0:ae:50:26:69:12" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_1deea179f5757fe[PII_REDACTED]62419df
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "SPIRIT CONSULTING s. r. o." and
            pe.signatures[i].serial == "1d:ee:a1:79:f5:75:7f:e5:29:04:35:77:76:24:19:df" and
           [PII_REDACTED] <= pe.signatures[i].not_afte

Full rule:
rule cert_blocklist_1deea179f5757fe[PII_REDACTED]62419df {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "SPIRIT CONSULTING s. r. o." and
            pe.signatures[i].serial == "1d:ee:a1:79:f5:75:7f:e5:29:04:35:77:76:24:19:df" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_5b1f9ec88d185631ab032dbfd5166c0d
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "TOPFLIGHT GROUP LIMITED" and
            pe.signatures[i].serial == "5b:1f:9e:c8:8d:18:56:31:ab:03:2d:bf:d5:16:6c:0d" and
           [PII_REDACTED] <= pe.signatures[i].not_after
 

Full rule:
rule cert_blocklist_5b1f9ec88d185631ab032dbfd5166c0d {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "TOPFLIGHT GROUP LIMITED" and
            pe.signatures[i].serial == "5b:1f:9e:c8:8d:18:56:31:ab:03:2d:bf:d5:16:6c:0d" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_58af00ce542760fc116b41fa92e18589
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "DICKIE MUSDALE WINDFARM LIMITED" and
            pe.signatures[i].serial == "58:af:00:ce:54:27:60:fc:11:6b:41:fa:92:e1:85:89" and
           [PII_REDACTED] <= pe.signatures[i].not

Full rule:
rule cert_blocklist_58af00ce542760fc116b41fa92e18589 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "DICKIE MUSDALE WINDFARM LIMITED" and
            pe.signatures[i].serial == "58:af:00:ce:54:27:60:fc:11:6b:41:fa:92:e1:85:89" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_25ba18a267d6d8e08ebc6e2457d58d1e
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "5Y TECHNOLOGY LIMITED" and
            pe.signatures[i].serial == "25:ba:18:a2:67:d6:d8:e0:8e:bc:6e:24:57:d5:8d:1e" and
           [PII_REDACTED] <= pe.signatures[i].not_after
   

Full rule:
rule cert_blocklist_25ba18a267d6d8e08ebc6e2457d58d1e {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "5Y TECHNOLOGY LIMITED" and
            pe.signatures[i].serial == "25:ba:18:a2:67:d6:d8:e0:8e:bc:6e:24:57:d5:8d:1e" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_12df5ff3460979cec1288d874a9fbf83
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "FORWARD MUSIC AGENCY SRL" and
            pe.signatures[i].serial == "12:df:5f:f3:46:09:79:ce:c1:28:8d:87:4a:9f:bf:83" and
           [PII_REDACTED] <= pe.signatures[i].not_after


Full rule:
rule cert_blocklist_12df5ff3460979cec1288d874a9fbf83 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "FORWARD MUSIC AGENCY SRL" and
            pe.signatures[i].serial == "12:df:5f:f3:46:09:79:ce:c1:28:8d:87:4a:9f:bf:83" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_df2547b2cab5689a81d61de80eaaa3a2
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "FORWARD MUSIC AGENCY SRL" and (
                pe.signatures[i].serial == "00:df:25:47:b2:ca:b5:68:9a:81:d6:1d:e8:0e:aa:a3:a2" or
                pe.signatures[i].serial == "d

Full rule:
rule cert_blocklist_df2547b2cab5689a81d61de80eaaa3a2 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "FORWARD MUSIC AGENCY SRL" and (
                pe.signatures[i].serial == "00:df:25:47:b2:ca:b5:68:9a:81:d6:1d:e8:0e:aa:a3:a2" or
                pe.signatures[i].serial == "df:25:47:b2:ca:b5:68:9a:81:d6:1d:e8:0e:aa:a3:a2"
            ) and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}