While analyzing/studying/RE exe's/dll's you see the certificates in peview/hexeditor etc. but how does one come to know that the certificate is a fake/malicious/expired one, there has to be a central repository of all the good or bad certificates,one which I know of is HerdProtect[.]com which tells you if the company/developer is known to distribute malware.

Plus, I have read that people steal code signing certificates from companies and use them to sign their malware, my question is while reversing what strings should I look for in Olly/IDA ,I'm guessing the malware will be enumerating using FindFirstFile, FindNextFile etc. for a specific file(certificate file) in the system what string do such malware look for, "OR HAVE I GOT IT WRONG".

Also many exe's are signed twice why so?Is it to fool security vendors or is it normal to sign with multiple certificates.


For an executable with a digital certificate, it's easy enough to check for the certificate's information and origin by looking at the executable's properties. For example, here's what is shown for Skype:

enter image description here

These certificates are issued to a developer from a trusted Certification Authority (CA) and are used to sign the executable before distributing it. In theory, the CA should fully verify the identity of the developer applying for a certificate before issuing one, but in practice a CA is still a system involving imperfect entities and it's possible for a malware author to apply for and receive a "good" certificate from a trusted CA while never producing anything but malware.

If you refer back to the first image of the Skype certificates and select "Details", you'll be able to get more information about the certificate and its origin:

enter image description here

In this image, we can see exactly who the certificate was issued to and who issued it, along with relevant issue date and expiration information. This is a direct download from the official Skype site, so I can be pretty confident that the software was made by who it says. Likewise, the certificate was issued by the Microsoft Code Signing PCA, so we can be at least reasonably confident that the certificate is trustworthy. If you look at the "Certification Path" tab, you can trace the certificate all the way back to the root CA and again verify that everything looks as it should.

Determining whether or not the certificate is malicious or stolen can be difficult to detect, but is somewhat a matter of common sense. Does your certificate claim to be issued to a legitimate publisher (e.g., Microsoft) but you know that the software you downloaded is not from them? Something may be amiss. You can also look at the issuing CA and try to find information online about their reputation. Does the CA do a bad job of screening out people who distribute malware? Do they have a reputation for poor information security? If the issuer seems sketchy, then they very well may be. Relying on the reputation of CAs is a known vulnerability.

Now, as to your second question: the certificate consists of a private/public key pair, with the private key kept private (of course) and the public key distributed with the application. Using a code signing tool, a developer generates a hash of the executable and encrypts it with the private key. This hash is distributed with the public key portion of the certificate in the executable. On the user's end, a new hash of the executable is taken and decrypted with the public key to verify its integrity. This means that executables that have been modified after having been signed won't have a valid certificate and you should get a warning when trying to install or run them. If you want to see a list of certificates on your system (both trusted and untrusted), open up a command prompt window and run certmgr

Note that in order for a legitimate certificate to be "stolen" and malware to sign itself with it, it would need access to the private key. If the private key is exposed (like what happened to Dell several years ago...) then it is possible for a malware author to sign their software as if they were the developer to whom the certificate was issued. If this private key is kept private, then it should theoretically be safe. I think the answer to your second question is that you're a bit confused as to how code signing works, but if you did manage to come across a bit of malware that was attempting to generate signed code, I would keep an eye out for sections of code attempting to launch a signtool instance, loading a .pfx or other private key file, etc.

I am not an expert on code signing or certification authorities, so it's possible that there are cases where malware generates self-signed certificates, messes with root CAs on the system, etc., but someone more experienced than me would have to weigh in on that...

As for the dual-signing in your third question, it would be helpful to see an example of what you're talking about, but I did find that Skype is signed with two certificates. The primary difference between the two is the digest algorithm, with one being sha1 and the other sha256. This is likely a mechanism to deal with legacy users who have an operating system for which sha256 is not currently supported and require the older (and deprecated) sha1 digest algorithm. (see: https://security.stackexchange.com/questions/109629/deprecation-of-sha1-code-signing-certificates-on-windows)

For a more in-depth look at code signing and certification authorities, feel free to check out this MSDN article.

  • Great answer,thank you for this very detailed and crisp answer... – rebel87 Mar 18 '16 at 16:58
  • Great answer, @Cheibriados! @rebel87, regarding exfiltration of private keys, you may want to read through this paper I wrote five years ago on the subject: nccgroup.trust/globalassets/our-research/uk/whitepapers/… – Jason Geffner Mar 21 '16 at 13:15
  • It was a great read @JasonGeffner..@Cheibriados is spot on with the dual-signing answer for a more detailed answer regarding why malware do so one can take a look at :symantec.com/connect/blogs/… – rebel87 Mar 28 '16 at 6:08

Your Answer

