Validate NMAP Executable by Hash and PE Characteristics

This rule identifies a specific NMAP executable by checking its PE header characteristics and MD5 hash. It looks for a 32-bit executable (pe.machine == pe.MACHINE_I386), a specific MD5 hash value ("bd457e3fb19a7f127a23369e70ee84fc"), a major linker version of 6, and a section named ".rdata" at index 1. This is intended to confirm if a file is a legitimate, specific version of the NMAP executable.