reverse-skills-max: initial public release (restored, redacted, hardened)

vendor-new/analyst-ai-pack/skills/analyzing-authenticode-signatures/references/api-reference.md

@@ -0,0 +1,39 @@
+# API Reference: Analyzing Authenticode Signatures
+
+## Overview
+
+`scripts/analyst.py` parses the PE security data directory (index 4) to detect an embedded PKCS#7
+Authenticode signature (WIN_CERTIFICATE), reporting presence, size, revision, and type. It is a
+dependency-free presence check; cryptographic verification requires OS tooling. It parses bytes
+statically and never executes the sample.
+
+## Dependencies
+
+| Package | Version | Purpose |
+|---------|---------|---------|
+| (stdlib) | — | struct parsing, file IO |
+
+## External tools
+
+| Tool | Purpose |
+|------|---------|
+| signtool / Get-AuthenticodeSignature | Cryptographically verify the signature and revocation |
+
+## Core functions
+
+### `check(path)`
+Returns whether an embedded signature exists and the WIN_CERTIFICATE header fields.
+
+## Usage
+
+```bash
+python scripts/analyst.py check sample.exe
+```
+
+## Sources
+
+- Windows Authenticode PE signature format —
+  https://learn.microsoft.com/windows-hardware/drivers/install/authenticode
+- PE/COFF security data directory (index 4, file-offset semantics) —
+  https://learn.microsoft.com/windows/win32/debug/pe-format
+- Stolen/abused signing certificates (T1553.002), MITRE ATT&CK