check for PEiD and/or Yara signatures