A colleague asked me for help with extracting code signing certificates from malicious files, to add them to Defender’s block list.
The procedure involves right-clicking the EXE in Windows Explorer, selecting properties to view the digital signature, and so on …
But I don’t like procedures where one has to click on malware.
So I looked for a PowerShell command, and found this.
Get-AuthenticodeSignature .\malware.exe.vir | Select-Object -ExpandProperty SignerCertificate | Export-Certificate -Type CERT -FilePath SignerCertificate.cer
Didier Stevens 
[…] Didier StevensExtracting Certificates For Defender […]
Pingback by Week 50 – 2022 – This Week In 4n6 — Sunday 11 December 2022 @ 11:47