stolen-authenticode-certificate-signing
Technique: Signing a benign or malicious binary with a stolen, expired, or revoked code-signing certificate to bypass Windows SmartScreen, application whitelisting, and user suspicion.
Observed Implementations
Simon Tatham (PuTTY) COMODO RSA Code Signing CA Cluster
The most prolific observed instance in this corpus: eleven confirmed samples across the unclassified-dotnet cluster, all signed with the same stolen Simon Tatham (PuTTY developer) COMODO RSA Code Signing CA certificate.
| Sample | Distribution Filename | Payload | Notes |
|---|---|---|---|
eea0dcbc |
PAYMENT_CANCELLED_AND_RETURNED.PDF.exe |
WPF/WinForms attendance tracker (WpfUI / zOYY.exe) |
First observed sibling |
c4ee3a31081d |
HAWB_#4532222.exe |
Spanish PrimeraVentana educational app (InXv.exe) |
Second sibling |
cae7ac1dc419 |
TRANSACTION_ERROR.PDF.exe |
Spanish PrimeraVentana educational app (WVmY.exe) |
Third sibling |
a1e6dc7a |
62C0j88GAD91tR5.exe |
Paint/drawing app (gZUs.exe) |
Fourth sibling |
b4814a17 |
INQUIRY.exe |
Pacman + calculator dual-project (OdOg.exe) |
Fifth sibling |
724d94aa |
uZdFE99gyouWC1t.exe |
Calculator (AdvWinProgHW2 / pKDK.exe) |
Sixth sibling |
72d8e3b2 |
RE_GOVT_OF_SHARJAH__UNIVERSITY_OF_SHARJAH_-_Project_0238.exe |
k-means clustering GUI (kmc / HbxE.exe) |
Seventh sibling |
5ea6b79d |
52oTaV20K4bWnvN.exe |
Brazilian pizza-shop POS/CRM (Yhdk.exe) |
Eighth sibling |
0a0a24fc |
payment_Slip.exe |
Polish stock-charting app (fCGm.exe) |
Tenth sibling |
5e34f10a |
PO#82924A.exe |
Spanish student-evaluation CRUD (iAQe.exe) |
Unsigned; same cluster |
0e9cc5f81798 |
NewXOrder_00200457.exe |
Spanish student-evaluation CRUD (SjbQ.exe) |
Eleventh sibling, stolen cert + Adobe Reader masquerade |
Certificate details (consistent across all):
- Subject:
CN=Simon Tatham, O=Simon Tatham, L=Cambridge, ST=Cambridgeshire, C=GB - Issuer:
COMODO RSA Code Signing CA→COMODO RSA Certification Authority - Serial:
0x7c1118cbbadc95da3752c46e47a27438 - Validity: 2018-11-13 to 2021-11-08 (expired)
Capabilities
stolen-authenticode-certificate-signing— Signing with a compromised or stolen legitimate code-signing certificate to evade reputation-based defencesexpired-certificate-trust-bypass— Relying on expired but not revoked certificates where validation does not enforce expiry