YARA signatures: hand-written from reverse-engineering work, plus generated family rules validated against clean software