Analyzing authenticode signatures
Skill meltedinhex/analyst-ai-pack/skills/analyzing-authenticode-signatures
An open agent-skills library for malware analysis, reverse engineering, and threat hunting - 118 curated, runnable skills mapped to MITRE ATT&CK, D3FEND, and CAR.
npx -y skills add meltedinhex/analyst-ai-pack --skill analyzing-authenticode-signaturesAssembled from the repository path, not quoted from the project. Check it against their README if it does not work.
One thing to look at
- 19 stars19 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.
What its author says it does
Copied from the file, not written here
Analyzes Windows Authenticode signatures on PE files: checking for a signature, reading the signer certificate chain, detecting revoked/expired/stolen certs, and recognizing signature-stripping and catalog-signing abuse. Activates for requests to analyze a code signature, verify Authenticode, or assess signer trust on a PE.
The file declares its own license as Apache-2.0. That is the author’s claim about this one file, and it is not the same thing as the license GitHub reports for the repository, which is listed with the other numbers below.
SKILL.md
3.2 KB, as published. Nobody here has run it
Analyzing Authenticode Signatures
When to Use
- You need to know whether a PE is signed and whether the signer is trustworthy.
- You suspect a stolen/abused code-signing certificate or a forged/invalid signature.
- You are distinguishing legitimately signed software from signed malware.
Do not use "is signed" as "is safe" — adversaries use stolen certs, abuse catalog signing, and append invalid signatures; a valid signature only attests the signer, not benignity.
Prerequisites
- Access to the PE security directory (Python
struct/pefile); on Windows,signtool/PowerShellGet-AuthenticodeSignaturefor authoritative verification.
Safety & Handling
- Parse the signature statically; never execute the sample.
- Keep the sample password-protected at rest and reference it by hash.
Workflow
Step 1: Check for a signature
Read the PE security directory (certificate table). Absent entry = unsigned; present = embedded PKCS#7. Note that valid signing can also be via a catalog file (not embedded).
python scripts/analyst.py check sample.exe
Step 2: Extract signer details
Parse the PKCS#7 to read the signer certificate: subject, issuer, validity dates, and serial. Cross-reference against known-abused/stolen certs.
Step 3: Verify, do not just read
On Windows, verify the signature cryptographically and check revocation
(Get-AuthenticodeSignature). A present-but-invalid signature is a strong red flag.
Step 4: Assess trust in context
Weigh signer reputation, certificate age, and whether the signed file's behavior matches the purported publisher. Treat anomalies (recently issued cert, mismatched publisher) as suspicious.
Validation
- Signature presence is determined from the security directory, and verified (not just read) on Windows.
- Signer certificate details are extracted and checked against abuse intel.
- The trust conclusion accounts for revocation/validity, not mere presence.
Pitfalls
- Equating a present signature with safety; stolen-cert malware is common.
- Missing catalog-signed files by only checking embedded signatures.
- Reading the signature without cryptographically verifying it.
References
- See
references/api-reference.mdfor the signature checker. - Authenticode format and the PE/COFF security directory (linked in frontmatter).