analyzing-authenticode-signatures

Name: analyzing-authenticode-signatures
Author: meltedinhex

18stars5forks

How to install analyzing-authenticode-signatures?

meltedinhex/analyst-ai-pack/analyzing-authenticode-signatures

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-authenticode-signatures

Installs into the current project.

Summary

Analyzes Windows Authenticode signatures on PE files: checking for a signature,

Files · 1

View on GitHub

SKILL.md

1	# Analyzing Authenticode Signatures
2
3	## When to Use
4
5	- You need to know whether a PE is signed and whether the signer is trustworthy.
6	- You suspect a stolen/abused code-signing certificate or a forged/invalid signature.
7	- You are distinguishing legitimately signed software from signed malware.
8
9	Do not use "is signed" as "is safe" — adversaries use stolen certs, abuse catalog signing,
10	and append invalid signatures; a valid signature only attests the signer, not benignity.
11
12	## Prerequisites
13
14	- Access to the PE security directory (Python `struct`/`pefile`); on Windows, `signtool`/PowerShell
15	`Get-AuthenticodeSignature` for authoritative verification.
16
17	## Safety & Handling
18
19	- Parse the signature statically; never execute the sample.
20	- Keep the sample password-protected at rest and reference it by hash.
21
22	## Workflow
23
24	### Step 1: Check for a signature
25
26	Read the PE security directory (certificate table). Absent entry = unsigned; present = embedded
27	PKCS#7. Note that valid signing can also be via a catalog file (not embedded).
28
29	```bash
30	python scripts/analyst.py check sample.exe
31	```
32
33	### Step 2: Extract signer details
34
35	Parse the PKCS#7 to read the signer certificate: subject, issuer, validity dates, and serial.
36	Cross-reference against known-abused/stolen certs.
37
38	### Step 3: Verify, do not just read
39
40	On Windows, verify the signature cryptographically and check revocation
41	(`Get-AuthenticodeSignature`). A present-but-invalid signature is a strong red flag.
42
43	### Step 4: Assess trust in context
44
45	Weigh signer reputation, certificate age, and whether the signed file's behavior matches the
46	purported publisher. Treat anomalies (recently issued cert, mismatched publisher) as suspicious.
47
48	## Validation
49
50	- Signature presence is determined from the security directory, and verified (not just read) on
51	Windows.
52	- Signer certificate details are extracted and checked against abuse intel.
53	- The trust conclusion accounts for revocation/validity, not mere presence.
54
55	## Pitfalls
56
57	- Equating a present signature with safety; stolen-cert malware is common.
58	- Missing catalog-signed files by only checking embedded signatures.
59	- Reading the signature without cryptographically verifying it.
60
61	## References
62
63	- See [`references/api-reference.md`](references/api-reference.md) for the signature checker.
64	- Authenticode format and the PE/COFF security directory (linked in frontmatter).

People who liked this also viewed

6 picks

Type

find-skillsHelps users discover and install agent skills when they ask questions like "how do I do X", "find a skill for X", "is there a skill that can...", or express interest in extending capabilities. This skSkillsJul 20262.6M27k
grill-meA relentless interview to sharpen a plan or design.SkillsJul 2026633k182k
vercel-react-best-practicesVercel's official collection of agent skillsSkillsJul 2026573k29k
improve-codebase-architectureScan a codebase for deepening opportunities, present them as a visual HTML report, then grill through whichever one you pick.SkillsJul 2026522k182k
setup-matt-pocock-skillsConfigure this repo for the engineering skills — set up its issue tracker, triage label vocabulary, and domain doc layout. Run once before first use of the other engineering skills.SkillsJul 2026454k182k
triageMove issues and external PRs through a state machine of triage roles — categorise, verify, grill if needed, and write agent-ready briefs.SkillsJul 2026424k182k

analyzing-authenticode-signatures

18stars5forks

View on GitHub

How to install analyzing-authenticode-signatures?

meltedinhex/analyst-ai-pack/analyzing-authenticode-signatures

$npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-authenticode-signatures

Installs into the current project.

Summary

Analyzes Windows Authenticode signatures on PE files: checking for a signature,

Files · 1

View on GitHub

SKILL.md

1	# Analyzing Authenticode Signatures
2
3	## When to Use
4
5	- You need to know whether a PE is signed and whether the signer is trustworthy.
6	- You suspect a stolen/abused code-signing certificate or a forged/invalid signature.
7	- You are distinguishing legitimately signed software from signed malware.
8
9	Do not use "is signed" as "is safe" — adversaries use stolen certs, abuse catalog signing,
10	and append invalid signatures; a valid signature only attests the signer, not benignity.
11
12	## Prerequisites
13
14	- Access to the PE security directory (Python `struct`/`pefile`); on Windows, `signtool`/PowerShell
15	`Get-AuthenticodeSignature` for authoritative verification.
16
17	## Safety & Handling
18
19	- Parse the signature statically; never execute the sample.
20	- Keep the sample password-protected at rest and reference it by hash.
21
22	## Workflow
23
24	### Step 1: Check for a signature
25
26	Read the PE security directory (certificate table). Absent entry = unsigned; present = embedded
27	PKCS#7. Note that valid signing can also be via a catalog file (not embedded).
28
29	```bash
30	python scripts/analyst.py check sample.exe
31	```
32
33	### Step 2: Extract signer details
34
35	Parse the PKCS#7 to read the signer certificate: subject, issuer, validity dates, and serial.
36	Cross-reference against known-abused/stolen certs.
37
38	### Step 3: Verify, do not just read
39
40	On Windows, verify the signature cryptographically and check revocation
41	(`Get-AuthenticodeSignature`). A present-but-invalid signature is a strong red flag.
42
43	### Step 4: Assess trust in context
44
45	Weigh signer reputation, certificate age, and whether the signed file's behavior matches the
46	purported publisher. Treat anomalies (recently issued cert, mismatched publisher) as suspicious.
47
48	## Validation
49
50	- Signature presence is determined from the security directory, and verified (not just read) on
51	Windows.
52	- Signer certificate details are extracted and checked against abuse intel.
53	- The trust conclusion accounts for revocation/validity, not mere presence.
54
55	## Pitfalls
56
57	- Equating a present signature with safety; stolen-cert malware is common.
58	- Missing catalog-signed files by only checking embedded signatures.
59	- Reading the signature without cryptographically verifying it.
60
61	## References
62
63	- See [`references/api-reference.md`](references/api-reference.md) for the signature checker.
64	- Authenticode format and the PE/COFF security directory (linked in frontmatter).

People who liked this also viewed

6 picks

Type