> Concept · Stolen Certificate Signing_

~/packetpursuit $ cat /intel/concepts/stolen-certificate-signing.md

typeconceptconfidencehighcreated2026-06-12updated2026-07-05signingauthenticodemasqueradingcertificate

Stolen Certificate Signing

Malware authors re-use or repurpose legitimate TLS/Authenticode certificates stolen from compromised organizations to sign their payloads. This grants the binary a veneer of trust that bypasses "unknown publisher" warnings and improves execution rates in social-engineering scenarios.

Pattern

  • Certificate Subject CN belongs to a real organization (e.g. *.merriam-webster.com, sedo.com, askart.com)
  • Issuer is a well-known public CA (Amazon, Sectigo, GoDaddy)
  • Validity window is current or recent
  • The certificate does not belong to the malware author

Distinction from Fabricated Certificates

Feature Stolen Fabricated
Issuer Real CA Self-signed or unknown CA
Subject Real org Nonsense or attacker-owned domain
Chain validation Passes (until revoked) Fails on strict systems
Serial entropy Normal CA serial Often low entropy or duplicated

Observed In

  • vidar — Amazon RSA 2048 M01 issued cert for *.merriam-webster.com (sample 3799d1f74d95)
  • neuralpulsecore5sbs — Sectigo DV cert CN=sedo.com
  • menomoushop — Go Daddy DV cert CN=maybe.us
  • 54e64e — fabricated godaddy.com/WE1 (not stolen — belongs to the fabricated category)
  • unclassified-dotnet eea0dcbc — COMODO RSA Code Signing CA chain, end-entity CN=Simon Tatham (PuTTY developer), embedded URL https://www.chiark.greenend.org.uk/~sgtatham/putty/. Benign attendance-tracker application (WpfUI/zOYY.exe/AttendanceTracker) masquerading as PAYMENT_CANCELLED_AND_RETURNED.PDF.exe. ^[/intel/analyses/eea0dcbc84b2e7113b9110e2f50fdf830c9f6ba67cad97bbe648270b810d757a.html]
  • unclassified-dotnet c4ee3a31081d — Same COMODO RSA Code Signing CA chain, CN=Simon Tatham, same embedded URL. Benign Spanish-language WinForms educational app (PrimeraVentana/InXv.exe) masquerading as HAWB_#4532222.exe. Sibling to eea0dcbc with identical stolen certificate but different payload. ^[/intel/analyses/c4ee3a31081db5feff937ed7a716fd805b467dacc6c1d679c4508e5b51ba8895.html]
  • unclassified-dotnet cae7ac1dc419 — Third confirmed sibling: same COMODO RSA Code Signing CA chain, CN=Simon Tatham, same embedded URL. Benign Spanish-language WinForms educational app (PrimeraVentana/WVmY.exe) masquerading as TRANSACTION_ERROR.PDF.exe. Same stolen certificate, different benign payload. Third distinct build in the stolen-Tatham-cert cluster. ^[/intel/analyses/cae7ac1dc4191db8041bca77127910f900f9effbe1b9e87492ba49549de14676.html]
  • unclassified-dotnet a1e6dc7a — Fourth confirmed sibling: same COMODO RSA Code Signing CA chain, CN=Simon Tatham, same embedded URL. Benign WinForms paint/drawing program (gZUs.exe, v2.0.0.781) masquerading as 62C0j88GAD91tR5.exe. VS_VERSIONINFO masquerades as Adobe Reader / Microsoft PDF Document. ^[/intel/analyses/a1e6dc7a3172ae52663e446cb8286a8aeec8c92fe75eb97f290df80f2e1ac398.html]
  • unclassified-dotnet b4814a17 — Fifth confirmed sibling: same COMODO RSA Code Signing CA chain, CN=Simon Tatham, same embedded URL. Benign dual-namespace .NET PE32 (VD_Pacman + CalculatorWinForms) masquerading as INQUIRY.exe. VS_VERSIONINFO masquerades as lodctr / Microsoft Corporation. ^[/intel/analyses/b4814a1725a288805097151348d07a8322d14ced20eb5137fbf368d245fe6c68.html]
  • unclassified-dotnet 724d94aa — Sixth confirmed sibling: same COMODO RSA Code Signing CA chain, CN=Simon Tatham, same embedded URL. Benign .NET Framework 4.0 WinForms calculator (AdvWinProgHW2 namespace, pKDK.exe, v2.0.0.781) masquerading as uZdFE99gyouWC1t.exe (random-noise filename). VS_VERSIONINFO masquerades as Adobe Reader / Microsoft PDF Document. Contains Trif32 Caesar-shift-23 decoder shared with PrimeraVentana/GoldenCity clusters. ^[/intel/analyses/724d94aa2eb7c09cdd8eca00e68017b430fe332c68a2201b5e308fe04715c545.html]
  • unclassified-dotnet 0a0a24fc — Tenth confirmed sibling: same COMODO RSA Code Signing CA chain, CN=Simon Tatham, same embedded URL. Benign .NET Framework 4.0 WinForms Polish-language stock-charting app (GAD_HW2 namespace, fCGm.exe) masquerading as payment_Slip.exe. VS_VERSIONINFO masquerades as pdf / microsoft / exel / zip. Contains Trif32 decoder. No malicious payload. ^[/intel/analyses/0a0a24fc88ba87cd8c77b6a493547b2dc780f60df1838e7b0ddcc87bb1277680.html]

Detection

Compare the certificate Subject CN against the file's version-info / filename / behavioral profile. A dictionary publisher signing a .exe named f4fdb4.exe with no associated application metadata is a mismatch worth flagging.