deardaniel/secdata-raw huggingface dataset:
YARA Detection Rule: cert_blocklist_06a164ec[PII_REDACTED]ee6cec9966871b
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "JOHN WILLIAM RICHARD" and
            pe.signatures[i].serial == "06:a1:64:ec:59:78:49:77:41:ee:6c:ec:99:66:87:1b" and
           [PII_REDACTED] <= pe.signatures[i].not_after
    

Full rule:
rule cert_blocklist_06a164ec[PII_REDACTED]ee6cec9966871b {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "JOHN WILLIAM RICHARD" and
            pe.signatures[i].serial == "06:a1:64:ec:59:78:49:77:41:ee:6c:ec:99:66:87:1b" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_1121ed568764e75be35574448feadefcd3bc
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "FRINORTE COMERCIO DE PECAS E SERVICOS LTDA - ME" and
            pe.signatures[i].serial == "11:21:ed:56:87:64:e7:5b:e3:55:74:44:8f:ea:de:fc:d3:bc" and
           [PII_REDACTED] <

Full rule:
rule cert_blocklist_1121ed568764e75be35574448feadefcd3bc {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "FRINORTE COMERCIO DE PECAS E SERVICOS LTDA - ME" and
            pe.signatures[i].serial == "11:21:ed:56:87:64:e7:5b:e3:55:74:44:8f:ea:de:fc:d3:bc" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_6ed2450ceac0f72e73fda1727e66e654
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Hohhot Handing Trade and Business Co., Ltd." and
            pe.signatures[i].serial == "6e:d2:45:0c:ea:c0:f7:2e:73:fd:a1:72:7e:66:e6:54" and
           [PII_REDACTED] <= pe.signa

Full rule:
rule cert_blocklist_6ed2450ceac0f72e73fda1727e66e654 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Hohhot Handing Trade and Business Co., Ltd." and
            pe.signatures[i].serial == "6e:d2:45:0c:ea:c0:f7:2e:73:fd:a1:72:7e:66:e6:54" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_32665079c5a5854a6833623ca77ff5ac
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Ohanae" and
            pe.signatures[i].serial == "32:66:50:79:c5:a5:85:4a:68:33:62:3c:a7:7f:f5:ac" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )

Full rule:
rule cert_blocklist_32665079c5a5854a6833623ca77ff5ac {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Ohanae" and
            pe.signatures[i].serial == "32:66:50:79:c5:a5:85:4a:68:33:62:3c:a7:7f:f5:ac" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_01a90094c83412c00cf98dd2eb0d7042
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "FreeVox SA" and
            pe.signatures[i].serial == "01:a9:00:94:c8:34:12:c0:0c:f9:8d:d2:eb:0d:70:42" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )

Full rule:
rule cert_blocklist_01a90094c83412c00cf98dd2eb0d7042 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "FreeVox SA" and
            pe.signatures[i].serial == "01:a9:00:94:c8:34:12:c0:0c:f9:8d:d2:eb:0d:70:42" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_55efe24b9674855baf16e67716479c71
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "S2BVISIO BELGIQUE SA" and
            pe.signatures[i].serial == "55:ef:e2:4b:96:74:85:5b:af:16:e6:77:16:47:9c:71" and
           [PII_REDACTED] <= pe.signatures[i].not_after
    

Full rule:
rule cert_blocklist_55efe24b9674855baf16e67716479c71 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "S2BVISIO BELGIQUE SA" and
            pe.signatures[i].serial == "55:ef:e2:4b:96:74:85:5b:af:16:e6:77:16:47:9c:71" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_094bf19d509d[PII_REDACTED]160b195b6c
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Porral Twinware S.L.L." and
            pe.signatures[i].serial == "09:4b:f1:9d:50:9d:30:74:91:39:95:16:0b:19:5b:6c" and
           [PII_REDACTED] <= pe.signatures[i].not_after
  

Full rule:
rule cert_blocklist_094bf19d509d[PII_REDACTED]160b195b6c {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Porral Twinware S.L.L." and
            pe.signatures[i].serial == "09:4b:f1:9d:50:9d:30:74:91:39:95:16:0b:19:5b:6c" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_0a77cf3ba49b64e6cbe5fb4a6a6aacc6
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "I.ST.SAN. Srl" and
            pe.signatures[i].serial == "0a:77:cf:3b:a4:9b:64:e6:cb:e5:fb:4a:6a:6a:ac:c6" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )

Full rule:
rule cert_blocklist_0a77cf3ba49b64e6cbe5fb4a6a6aacc6 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "I.ST.SAN. Srl" and
            pe.signatures[i].serial == "0a:77:cf:3b:a4:9b:64:e6:cb:e5:fb:4a:6a:6a:ac:c6" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_1f4c22da1107d20c1eda04569d58e573
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "PlanView, Inc." and
            pe.signatures[i].serial == "1f:4c:22:da:11:07:d2:0c:1e:da:04:56:9d:58:e5:73" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )

Full rule:
rule cert_blocklist_1f4c22da1107d20c1eda04569d58e573 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "PlanView, Inc." and
            pe.signatures[i].serial == "1f:4c:22:da:11:07:d2:0c:1e:da:04:56:9d:58:e5:73" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_4fe68d48634893d18de040d8f1c289d2
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Xinghua Yile Network Tech Co.,Ltd." and
            pe.signatures[i].serial == "4f:e6:8d:48:63:48:93:d1:8d:e0:40:d8:f1:c2:89:d2" and
           [PII_REDACTED] <= pe.signatures[i].

Full rule:
rule cert_blocklist_4fe68d48634893d18de040d8f1c289d2 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Xinghua Yile Network Tech Co.,Ltd." and
            pe.signatures[i].serial == "4f:e6:8d:48:63:48:93:d1:8d:e0:40:d8:f1:c2:89:d2" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_6767def972d6ea702d8c8a53af1832d3
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Guangzhou typical corner Network Technology Co., Ltd." and
            pe.signatures[i].serial == "67:67:de:f9:72:d6:ea:70:2d:8c:8a:53:af:18:32:d3" and
           [PII_REDACTED] <

Full rule:
rule cert_blocklist_6767def972d6ea702d8c8a53af1832d3 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Guangzhou typical corner Network Technology Co., Ltd." and
            pe.signatures[i].serial == "67:67:de:f9:72:d6:ea:70:2d:8c:8a:53:af:18:32:d3" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_06477e3425f1448995ced539789e6842
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Karim Lammali" and
            pe.signatures[i].serial == "06:47:7e:34:25:f1:44:89:95:ce:d5:39:78:9e:68:42" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )

Full rule:
rule cert_blocklist_06477e3425f1448995ced539789e6842 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Karim Lammali" and
            pe.signatures[i].serial == "06:47:7e:34:25:f1:44:89:95:ce:d5:39:78:9e:68:42" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_0450a7c1c36951da09c8ad0e7f716ff2
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "PS Partnership" and
            pe.signatures[i].serial == "04:50:a7:c1:c3:69:51:da:09:c8:ad:0e:7f:71:6f:f2" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )

Full rule:
rule cert_blocklist_0450a7c1c36951da09c8ad0e7f716ff2 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "PS Partnership" and
            pe.signatures[i].serial == "04:50:a7:c1:c3:69:51:da:09:c8:ad:0e:7f:71:6f:f2" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_0f9fbdab9b39645cf3211f87abb5ddb7
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "The Motivo Group, Inc." and
            pe.signatures[i].serial == "0f:9f:bd:ab:9b:39:64:5c:f3:21:1f:87:ab:b5:dd:b7" and
           [PII_REDACTED] <= pe.signatures[i].not_after
  

Full rule:
rule cert_blocklist_0f9fbdab9b39645cf3211f87abb5ddb7 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "The Motivo Group, Inc." and
            pe.signatures[i].serial == "0f:9f:bd:ab:9b:39:64:5c:f3:21:1f:87:ab:b5:dd:b7" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_4211d2e4f0e[PII_REDACTED]2c55b85bcf2
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "yinsheng xie" and
            pe.signatures[i].serial == "42:11:d2:e4:f0:e8:71:27:31:93:02:c5:5b:85:bc:f2" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )

Full rule:
rule cert_blocklist_4211d2e4f0e[PII_REDACTED]2c55b85bcf2 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "yinsheng xie" and
            pe.signatures[i].serial == "42:11:d2:e4:f0:e8:71:27:31:93:02:c5:5b:85:bc:f2" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_07b44cdbfffb78de05f4261672a67312
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Buster Paper Comercial Ltda" and
            pe.signatures[i].serial == "07:b4:4c:db:ff:fb:78:de:05:f4:26:16:72:a6:73:12" and
           [PII_REDACTED] <= pe.signatures[i].not_aft

Full rule:
rule cert_blocklist_07b44cdbfffb78de05f4261672a67312 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "Buster Paper Comercial Ltda" and
            pe.signatures[i].serial == "07:b4:4c:db:ff:fb:78:de:05:f4:26:16:72:a6:73:12" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_4f8b9a1ba5e60c754dbb40ddee7905e2
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "NOX Entertainment Co., Ltd" and
            pe.signatures[i].serial == "4f:8b:9a:1b:a5:e6:0c:75:4d:bb:40:dd:ee:79:05:e2" and
           [PII_REDACTED] <= pe.signatures[i].not_afte

Full rule:
rule cert_blocklist_4f8b9a1ba5e60c754dbb40ddee7905e2 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "NOX Entertainment Co., Ltd" and
            pe.signatures[i].serial == "4f:8b:9a:1b:a5:e6:0c:75:4d:bb:40:dd:ee:79:05:e2" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_0a389b95ee736dd13bc0ed743fd74d2f
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "BUSTER ASSISTENCIA TECNICA ELETRONICA LTDA - ME" and
            pe.signatures[i].serial == "0a:38:9b:95:ee:73:6d:d1:3b:c0:ed:74:3f:d7:4d:2f" and
           [PII_REDACTED] <= pe.s

Full rule:
rule cert_blocklist_0a389b95ee736dd13bc0ed743fd74d2f {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "BUSTER ASSISTENCIA TECNICA ELETRONICA LTDA - ME" and
            pe.signatures[i].serial == "0a:38:9b:95:ee:73:6d:d1:3b:c0:ed:74:3f:d7:4d:2f" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_1a3faaeb3a8b93b2394fec36345996e6
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "salvatore macchiarella" and
            pe.signatures[i].serial == "1a:3f:aa:eb:3a:8b:93:b2:39:4f:ec:36:34:59:96:e6" and
           [PII_REDACTED] <= pe.signatures[i].not_after
  

Full rule:
rule cert_blocklist_1a3faaeb3a8b93b2394fec36345996e6 {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "salvatore macchiarella" and
            pe.signatures[i].serial == "1a:3f:aa:eb:3a:8b:93:b2:39:4f:ec:36:34:59:96:e6" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}
YARA Detection Rule: cert_blocklist_1a35acce5b0c77206b1c3dc2a6a2417c
Repository: reversinglabs/reversinglabs-yara-rules
Detects: Certificate used for digitally signing malware.
Author: ReversingLabs

Detection condition:
uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "cd ingegneri associati srl" and
            pe.signatures[i].serial == "1a:35:ac:ce:5b:0c:77:20:6b:1c:3d:c2:a6:a2:41:7c" and
           [PII_REDACTED] <= pe.signatures[i].not_afte

Full rule:
rule cert_blocklist_1a35acce5b0c77206b1c3dc2a6a2417c {
    meta:
        author      = "ReversingLabs"
        source      = "ReversingLabs"
        status      = "RELEASED"
        sharing     = "TLP:WHITE"
        category    = "INFO"
        description = "Certificate used for digitally signing malware."

    condition:
        uint16(0) == 0x5A4D and
        for any i in (0..pe.number_of_signatures): (
            pe.signatures[i].subject contains "cd ingegneri associati srl" and
            pe.signatures[i].serial == "1a:35:ac:ce:5b:0c:77:20:6b:1c:3d:c2:a6:a2:41:7c" and
           [PII_REDACTED] <= pe.signatures[i].not_after
        )
}