day2 FakePDF PE

This YARA rule detects malicious PE executable files that masquerade as PDF documents by embedding known PDF-related icons within their resource section. It inspects the PE file header and calculates the SHA256 hash of the first resource, matching it against a list of hashes corresponding to legitimate PDF icons.