deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: cert_blocklist_0a1dc99e4d5264c45a5090f93242a30a
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "K & D KOMPANI d.o.o." and
            pe.signatures[i].serial == "0a:1d:c9:9e:4d:52:64:c4:5a:50:90:f9:32:42:a3:0a" and
           [PII_REDACTED] <= pe.signatures[i].not_after
    

Full rule:
rule cert_blocklist_0a1dc99e4d5264c45a5090f93242a30a {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "K & D KOMPANI d.o.o." and
            pe.signatures[i].serial == "0a:1d:c9:9e:4d:52:64:c4:5a:50:90:f9:32:42:a3:0a" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_018093cfad72cdf402eecbe18b33ec71
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "FAT11 d.o.o." and 
            pe.signatures[i].serial == "01:80:93:cf:ad:72:cd:f4:02:ee:cb:e1:8b:33:ec:71" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )

Full rule:
rule cert_blocklist_018093cfad72cdf402eecbe18b33ec71 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "FAT11 d.o.o." and 
            pe.signatures[i].serial == "01:80:93:cf:ad:72:cd:f4:02:ee:cb:e1:8b:33:ec:71" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_569e03988af60d80ce[PII_REDACTED]0d9b
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "OORT inc." and (
                pe.signatures[i].serial == "00:56:9e:03:98:8a:f6:0d:80:ce:60:72:89:40:85:0d:9b" or
                pe.signatures[i].serial == "56:9e:03:98:8a:f

Full rule:
rule cert_blocklist_569e03988af60d80ce[PII_REDACTED]0d9b {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "OORT inc." and (
                pe.signatures[i].serial == "00:56:9e:03:98:8a:f6:0d:80:ce:60:72:89:40:85:0d:9b" or
                pe.signatures[i].serial == "56:9e:03:98:8a:f6:0d:80:ce:60:72:89:40:85:0d:9b"
            ) and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_418f6d959a8a0f82bef07ceba3603e52
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "OORT inc." and (
                pe.signatures[i].serial == "00:41:8f:6d:95:9a:8a:0f:82:be:f0:7c:eb:a3:60:3e:52" or
                pe.signatures[i].serial == "41:8f:6d:95:9a:8

Full rule:
rule cert_blocklist_418f6d959a8a0f82bef07ceba3603e52 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "OORT inc." and (
                pe.signatures[i].serial == "00:41:8f:6d:95:9a:8a:0f:82:be:f0:7c:eb:a3:60:3e:52" or
                pe.signatures[i].serial == "41:8f:6d:95:9a:8a:0f:82:be:f0:7c:eb:a3:60:3e:52"
            ) and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_5378c5bbeba0d3309a35bb47f63037f7
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "OORT inc." and (
                pe.signatures[i].serial == "00:53:78:c5:bb:eb:a0:d3:30:9a:35:bb:47:f6:30:37:f7" or
                pe.signatures[i].serial == "53:78:c5:bb:eb:a

Full rule:
rule cert_blocklist_5378c5bbeba0d3309a35bb47f63037f7 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "OORT inc." and (
                pe.signatures[i].serial == "00:53:78:c5:bb:eb:a0:d3:30:9a:35:bb:47:f6:30:37:f7" or
                pe.signatures[i].serial == "53:78:c5:bb:eb:a0:d3:30:9a:35:bb:47:f6:30:37:f7"
            ) and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_0bab6a2aa84b495d9e554a4c42c0126d
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "NOSOV SP Z O O" and
            pe.signatures[i].serial == "0b:ab:6a:2a:a8:4b:49:5d:9e:55:4a:4c:42:c0:12:6d" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )

Full rule:
rule cert_blocklist_0bab6a2aa84b495d9e554a4c42c0126d {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "NOSOV SP Z O O" and
            pe.signatures[i].serial == "0b:ab:6a:2a:a8:4b:49:5d:9e:55:4a:4c:42:c0:12:6d" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_6314001c3235cd59bcc3f5278c518804
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "GIE-MUTUALISTE" and
            pe.signatures[i].serial == "63:14:00:1c:32:35:cd:59:bc:c3:f5:27:8c:51:88:04" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )

Full rule:
rule cert_blocklist_6314001c3235cd59bcc3f5278c518804 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "GIE-MUTUALISTE" and
            pe.signatures[i].serial == "63:14:00:1c:32:35:cd:59:bc:c3:f5:27:8c:51:88:04" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_0ed8ade5d73b73dade6943d557ff87e5
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Rumikon LLC" and
            pe.signatures[i].serial == "0e:d8:ad:e5:d7:3b:73:da:de:69:43:d5:57:ff:87:e5" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )

Full rule:
rule cert_blocklist_0ed8ade5d73b73dade6943d557ff87e5 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Rumikon LLC" and
            pe.signatures[i].serial == "0e:d8:ad:e5:d7:3b:73:da:de:69:43:d5:57:ff:87:e5" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_0292c7d574132ba5c0441d1c7ffcb805
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "TES LOGISTIKA d.o.o." and
            pe.signatures[i].serial == "02:92:c7:d5:74:13:2b:a5:c0:44:1d:1c:7f:fc:b8:05" and
           [PII_REDACTED] <= pe.signatures[i].not_after
    

Full rule:
rule cert_blocklist_0292c7d574132ba5c0441d1c7ffcb805 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "TES LOGISTIKA d.o.o." and
            pe.signatures[i].serial == "02:92:c7:d5:74:13:2b:a5:c0:44:1d:1c:7f:fc:b8:05" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_1f23f001458716d435cca1a55d660ec5
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "OOO Ringen" and
            pe.signatures[i].serial == "1f:23:f0:01:45:87:16:d4:35:cc:a1:a5:5d:66:0e:c5" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )

Full rule:
rule cert_blocklist_1f23f001458716d435cca1a55d660ec5 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "OOO Ringen" and
            pe.signatures[i].serial == "1f:23:f0:01:45:87:16:d4:35:cc:a1:a5:5d:66:0e:c5" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_6e0ccbdfb4777e10ea6221b90dc350c2
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "TRAUMALAB INTERNATIONAL APS" and
            pe.signatures[i].serial == "6e:0c:cb:df:b4:77:7e:10:ea:62:21:b9:0d:c3:50:c2" and
           [PII_REDACTED] <= pe.signatures[i].not_aft

Full rule:
rule cert_blocklist_6e0ccbdfb4777e10ea6221b90dc350c2 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "TRAUMALAB INTERNATIONAL APS" and
            pe.signatures[i].serial == "6e:0c:cb:df:b4:77:7e:10:ea:62:21:b9:0d:c3:50:c2" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_0ed1847a2ae5d71def1e833fddd33d38
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "SNAB-RESURS, OOO" and
            pe.signatures[i].serial == "0e:d1:84:7a:2a:e5:d7:1d:ef:1e:83:3f:dd:d3:3d:38" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        

Full rule:
rule cert_blocklist_0ed1847a2ae5d71def1e833fddd33d38 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "SNAB-RESURS, OOO" and
            pe.signatures[i].serial == "0e:d1:84:7a:2a:e5:d7:1d:ef:1e:83:3f:dd:d3:3d:38" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_97df46acb26b7c81a13cc467b47688c8
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Information Civilized System Oy" and (
                pe.signatures[i].serial == "00:97:df:46:ac:b2:6b:7c:81:a1:3c:c4:67:b4:76:88:c8" or
                pe.signatures[i].seria

Full rule:
rule cert_blocklist_97df46acb26b7c81a13cc467b47688c8 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Information Civilized System Oy" and (
                pe.signatures[i].serial == "00:97:df:46:ac:b2:6b:7c:81:a1:3c:c4:67:b4:76:88:c8" or
                pe.signatures[i].serial == "97:df:46:ac:b2:6b:7c:81:a1:3c:c4:67:b4:76:88:c8"
            ) and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_186d49fac34ce99775b8e7ffbf50679d
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Hairis LLC" and
            pe.signatures[i].serial == "18:6d:49:fa:c3:4c:e9:97:75:b8:e7:ff:bf:50:67:9d" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )

Full rule:
rule cert_blocklist_186d49fac34ce99775b8e7ffbf50679d {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Hairis LLC" and
            pe.signatures[i].serial == "18:6d:49:fa:c3:4c:e9:97:75:b8:e7:ff:bf:50:67:9d" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_b1aea98bf0ce789b6c952310f14edde0
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Absolut LLC" and (
                pe.signatures[i].serial == "00:b1:ae:a9:8b:f0:ce:78:9b:6c:95:23:10:f1:4e:dd:e0" or
                pe.signatures[i].serial == "b1:ae:a9:8b:f0

Full rule:
rule cert_blocklist_b1aea98bf0ce789b6c952310f14edde0 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Absolut LLC" and (
                pe.signatures[i].serial == "00:b1:ae:a9:8b:f0:ce:78:9b:6c:95:23:10:f1:4e:dd:e0" or
                pe.signatures[i].serial == "b1:ae:a9:8b:f0:ce:78:9b:6c:95:23:10:f1:4e:dd:e0"
            ) and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_2dcd0699da08915dde6d044cb474157c
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "VENTE DE TOUT" and
            pe.signatures[i].serial == "2d:cd:06:99:da:08:91:5d:de:6d:04:4c:b4:74:15:7c" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )

Full rule:
rule cert_blocklist_2dcd0699da08915dde6d044cb474157c {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "VENTE DE TOUT" and
            pe.signatures[i].serial == "2d:cd:06:99:da:08:91:5d:de:6d:04:4c:b4:74:15:7c" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_4b03cabe6a0481f17a2dbeb9aefad425
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "RASSVET, OOO" and
            pe.signatures[i].serial == "4b:03:ca:be:6a:04:81:f1:7a:2d:be:b9:ae:fa:d4:25" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )

Full rule:
rule cert_blocklist_4b03cabe6a0481f17a2dbeb9aefad425 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "RASSVET, OOO" and
            pe.signatures[i].serial == "4b:03:ca:be:6a:04:81:f1:7a:2d:be:b9:ae:fa:d4:25" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_64cd303fa289790afa03c403e9240002
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "MAITLAND TRIFECTA, INC." and 
            pe.signatures[i].serial == "64:cd:30:3f:a2:89:79:0a:fa:03:c4:03:e9:24:00:02" and
           [PII_REDACTED] <= pe.signatures[i].not_after


Full rule:
rule cert_blocklist_64cd303fa289790afa03c403e9240002 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "MAITLAND TRIFECTA, INC." and 
            pe.signatures[i].serial == "64:cd:30:3f:a2:89:79:0a:fa:03:c4:03:e9:24:00:02" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_07cef66a71c35bc3aed6d100c6493863
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Fubon Technologies Ltd" and
            pe.signatures[i].serial == "07:ce:f6:6a:71:c3:5b:c3:ae:d6:d1:00:c6:49:38:63" and
           [PII_REDACTED] <= pe.signatures[i].not_after
  

Full rule:
rule cert_blocklist_07cef66a71c35bc3aed6d100c6493863 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Fubon Technologies Ltd" and
            pe.signatures[i].serial == "07:ce:f6:6a:71:c3:5b:c3:ae:d6:d1:00:c6:49:38:63" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_be77fe5c58b7a360add6a3fced4e8334
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Incar LLC" and (
                pe.signatures[i].serial == "00:be:77:fe:5c:58:b7:a3:60:ad:d6:a3:fc:ed:4e:83:34" or
                pe.signatures[i].serial == "be:77:fe:5c:58:b

Full rule:
rule cert_blocklist_be77fe5c58b7a360add6a3fced4e8334 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Incar LLC" and (
                pe.signatures[i].serial == "00:be:77:fe:5c:58:b7:a3:60:ad:d6:a3:fc:ed:4e:83:34" or
                pe.signatures[i].serial == "be:77:fe:5c:58:b7:a3:60:ad:d6:a3:fc:ed:4e:83:34"
            ) and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}