Consider migrate the PEFile signatures functionality from peutils/peid to YARA signatures

[wesinator]

Feature

Cuckoo inherits the pre-processing PE packer and linker signature identification from the pefile / peutils module, which leverages signatures in the old PEiD sig format (really an ini format).
The peid sigs can have low fidelity packer identification (e.g. cuckoosandbox/cuckoo#2538 (comment)), and the mechanism is somewhat opaque compared with more modern frameworks like YARA

Proposed solution

Rip out the peutils sigdb code that is within the PEFile class, the old peutils/userdb.txt peid sig format file, and replace it with a YARA ruleset that can be run using the existing yara processing module.

The peid_signatures field would get collapsed into signatures

Alternative would be to leave the peutils sigdb file in place and maintain it as needed.

[cert-ee-raidar]

@wesinator
Thank you for submitting the proposal.
We will look into this first chance we get and I will get back to you with an answer.