reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/malware-analysis-claude-skills/tests/fixtures/yara/fixture.yar

@@ -0,0 +1,15 @@
+rule Test_Fixture_Invoice2024 {
+    meta:
+        description = "Detects the benign PE test fixture built by tests/make_pe.py"
+        author = "malware-analysis-skills test harness"
+        reference = "tests/make_pe.py"
+        note = "Fixture only — not a real malware signature"
+    strings:
+        $mz  = { 4D 5A }
+        $c2  = "update-cdn.example.test/gate.php" ascii
+        $ua  = "TestUA/1.0" ascii
+        $mtx = "Global\\TestFixtureMutex_9f2a" ascii
+        $tag = "BENIGN TEST FIXTURE" ascii
+    condition:
+        $mz at 0 and 3 of ($c2, $ua, $mtx, $tag)
+}