yara_runascs [yara_rules]

(uint32be(0) == 0x7f454c46 or uint16be(0) == 0x4d5a) and
        filesize < 4MB and
        all of them and
        not (
            pe.version_info["OriginalFilename"] == "Atera.AgentPackages.CommonLib.dll" and
            for any sig in pe.signatures: (
                sig.subject contains "CN=Atera Networks Ltd" and
                sig.issuer contains "CN=DigiCert Trusted G4 Code Signing RSA4096 SHA384 2021 CA1"
            )
        )