As an aside, for those looking to understand YARA rules, [1] provides a brief introduction and [2] introduces how to write them. I needed to look it up myself, but seems relatively straightforward if you have a programming background.

tl;dr: YARA rules are a method of categorizing malware based on their characteristics. So the PDF here released a YARA rule to determine a specific piece of malware used in the hack (it's not clear to me what it identifies, other than a PHP script).

For convenience, here's the YARA rule presented in the PDF formatted to be more readable:

rule PAS_TOOL_PHP_WEB_KIT {

  meta:
    description = "PAS TOOL PHP WEB KIT FOUND"

  strings:
    $php = "<?php"
    $base64decode = /\='base'\.\(\d+\*\d+\)\.'_de'\.'code'/
    $strreplace = "(str_replace("
    $md5 = ".substr(md5(strrev("
    $gzinflate = "gzinflate"
    $cookie = "_COOKIE"
    $isset = "isset"

  condition:
    (filesize > 20KB and filesize < 22KB) and
    #cookie == 2 and
    #isset == 3 and
    all of them

}

[1] https://securityintelligence.com/signature-based-detection-w...

[2] http://yara.readthedocs.io/en/v3.5.0/writingrules.html

EDIT: formatting