Didier Stevens

Tuesday 4 December 2012

Authenticode Tools Page

Filed under: Announcement,My Software — Didier Stevens @ 13:53

I’ve added a new page to document my Authenticode Tools like AnalyzePESig.

It has a small explanation for each field found in the output of AnalyzePESig. For example, the fields Issuer Unique ID and Subject Unique ID should always be 0. In the case of the Flame certificate, they are not, because the Issuer Unique ID field was used to help produce the MD5 collision:

Filename:                       WuSetupV.exe.vir
MD5:                            1f61d280067e2564999cac20e386041c
Entropy:                        6.79663
Issuer unique ID chain:         887
Issuer unique ID chain:         0
Issuer unique ID chain:         0
Issuer unique ID chain:         0
Issuer unique ID chain:         0

I also use this tool to periodically review new executables on my machines.

1 Comment »

  1. AnalyzPESig is a fantastic tool and quite unique to be open-source, very useful, so thanks a lot for sharing!

    Comment by Ad — Friday 7 December 2012 @ 13:01

RSS feed for comments on this post. TrackBack URI

Leave a Reply (comments are moderated)

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s

This site uses Akismet to reduce spam. Learn how your comment data is processed.

Blog at WordPress.com.