I’ve added a new page to document my Authenticode Tools like AnalyzePESig.
It has a small explanation for each field found in the output of AnalyzePESig. For example, the fields Issuer Unique ID and Subject Unique ID should always be 0. In the case of the Flame certificate, they are not, because the Issuer Unique ID field was used to help produce the MD5 collision:
Filename: WuSetupV.exe.vir MD5: 1f61d280067e2564999cac20e386041c Entropy: 6.79663 ... Issuer unique ID chain: 887 Issuer unique ID chain: 0 Issuer unique ID chain: 0 Issuer unique ID chain: 0 Issuer unique ID chain: 0
I also use this tool to periodically review new executables on my machines.
Didier Stevens 
AnalyzPESig is a fantastic tool and quite unique to be open-source, very useful, so thanks a lot for sharing!
Comment by Ad — Friday 7 December 2012 @ 13:01