reverse-skills-max/vendor-new/analyst-ai-pack/skills/analyzing-authenticode-signatures/SKILL.md

name, description, domain, subdomain, tags, version, author, license, mitre_attack, d3fend, references

name	description	domain	subdomain	tags	version	author	license	mitre_attack	d3fend	references
analyzing-authenticode-signatures	Analyzes Windows Authenticode signatures on PE files: checking for a signature, reading the signer certificate chain, detecting revoked/expired/stolen certs, and recognizing signature-stripping and catalog-signing abuse. Activates for requests to analyze a code signature, verify Authenticode, or assess signer trust on a PE.	cybersecurity	malware-analysis	malware-analysis authenticode code-signing pe certificates	1.0.0	analyst-ai-pack	Apache-2.0	T1553.002 T1036.001	D3-FCR	Windows Authenticode PE signature format — https://learn.microsoft.com/windows-hardware/drivers/install/authenticode Microsoft PE/COFF specification (security directory) — https://learn.microsoft.com/windows/win32/debug/pe-format

Analyzing Authenticode Signatures

When to Use

• You need to know whether a PE is signed and whether the signer is trustworthy.
• You suspect a stolen/abused code-signing certificate or a forged/invalid signature.
• You are distinguishing legitimately signed software from signed malware.

Do not use "is signed" as "is safe" — adversaries use stolen certs, abuse catalog signing, and append invalid signatures; a valid signature only attests the signer, not benignity.

Prerequisites

• Access to the PE security directory (Python struct/pefile); on Windows, signtool/PowerShell Get-AuthenticodeSignature for authoritative verification.

Safety & Handling

• Parse the signature statically; never execute the sample.
• Keep the sample password-protected at rest and reference it by hash.

Workflow

Step 1: Check for a signature

Read the PE security directory (certificate table). Absent entry = unsigned; present = embedded PKCS#7. Note that valid signing can also be via a catalog file (not embedded).

python scripts/analyst.py check sample.exe

Step 2: Extract signer details

Parse the PKCS#7 to read the signer certificate: subject, issuer, validity dates, and serial. Cross-reference against known-abused/stolen certs.

Step 3: Verify, do not just read

On Windows, verify the signature cryptographically and check revocation (Get-AuthenticodeSignature). A present-but-invalid signature is a strong red flag.

Step 4: Assess trust in context

Weigh signer reputation, certificate age, and whether the signed file's behavior matches the purported publisher. Treat anomalies (recently issued cert, mismatched publisher) as suspicious.

Validation

• Signature presence is determined from the security directory, and verified (not just read) on Windows.
• Signer certificate details are extracted and checked against abuse intel.
• The trust conclusion accounts for revocation/validity, not mere presence.

Pitfalls

• Equating a present signature with safety; stolen-cert malware is common.
• Missing catalog-signed files by only checking embedded signatures.
• Reading the signature without cryptographically verifying it.

References

• See references/api-reference.md for the signature checker.
• Authenticode format and the PE/COFF security directory (linked in frontmatter).