diff --git a/executable/subfile/pe/contain-an-embedded-pe-file.yml b/executable/subfile/pe/contain-an-embedded-pe-file.yml
index 1c44f248..8106abc3 100644
--- a/executable/subfile/pe/contain-an-embedded-pe-file.yml
+++ b/executable/subfile/pe/contain-an-embedded-pe-file.yml
@@ -9,4 +9,6 @@ rule:
     examples:
       - Practical Malware Analysis Lab 01-04.exe_:0x4060
   features:
-    - count(characteristic(embedded pe)): 1 or more
+    - or:
+      - count(characteristic(embedded pe)): 1 or more
+      - count(string(This program cannot be run in DOS mode.)): 2 or more