Add rule for PE stored as UUID

[corkamig]

No description provided.

[mr-tz]

I think a reference sample would be helpful for this rule.

[corkamig]

Renaming the branch accidentally closed the PR.

[corkamig]

I prefer keeping the nops string in the first version of the rule:
they are frequent in PEs, and present in the sample.

00 and FF are extremly frequent, and 4d5a could happen randomly.
Let's test the waters and avoid unexpected FPs with a robust rule first, and adapt it and loosen it later accordingly.