pe.is_signed is now defined for all PE files.

Until now, `pe.is_signed` was undefined for every PE file that was not signed, making impossible to use it in negated conditions, like `pe.is_pe and not pe.is_signed`. With this change, `pe.is_signed` is false for every PE file that is not signed.

Closes #2040

libyara/modules/pe/pe.c

@@ -1767,8 +1767,7 @@ void _process_authenticode(
     /* If any signature is valid -> file is correctly signed */
     signature_valid |= verified;
 
-    yr_set_integer(
-        verified, pe->object, "signatures[%i].verified", *sig_count);
+    yr_set_integer(verified, pe->object, "signatures[%i].verified", *sig_count);
 
     yr_set_string(
         authenticode->digest_alg,
@@ -1956,6 +1955,8 @@ static void pe_parse_certificates(PE* pe)
 
   // Default to 0 signatures until we know otherwise.
   yr_set_integer(0, pe->object, "number_of_signatures");
+  // Default to not signed until we know otherwise.
+  yr_set_integer(0, pe->object, "is_signed");
 
   PIMAGE_DATA_DIRECTORY directory = pe_get_directory_entry(
       pe, IMAGE_DIRECTORY_ENTRY_SECURITY);

tests/test-pe.c

@@ -389,6 +389,24 @@ int main(int argc, char** argv)
       "tests/data/"
       "079a472d22290a94ebb212aa8015cdc8dd28a968c6b4d3b88acdd58ce2d3b885");
 
+  assert_true_rule_file(
+      "import \"pe\" \
+      rule test { \
+        condition: \
+          not pe.is_signed \
+      }",
+      "tests/data/"
+      "e3d45a2865818756068757d7e319258fef40dad54532ee4355b86bc129f27345");
+
+  assert_true_rule_file(
+      "import \"pe\" \
+      rule test { \
+        condition: \
+          pe.is_signed \
+      }",
+      "tests/data/"
+      "3b8b90159fa9b6048cc5410c5d53f116943564e4d05b04a843f9b3d0540d0c1c");
+
   assert_true_rule_file(
       "import \"pe\" \
       rule test { \