Forum » Support and Bug Reports »

Post a reply

Before posting, please read how to report bug or request support effectively.

Bug reports without an attached log file are usually useless.

Username

Subject

Message body

Font colour:

Font size:

Options

Disable BBCode in this post

Notify me when a reply is posted (registered users only)

Add an Attachment

If you do not want to add an Attachment to your Post, please leave the Fields blank.

Filename

(maximum 10 MB; please compress large files; only common media, archive, text and programming file formats are allowed)

File Comment

Options

Private file (available to author and site moderators only)

Topic review

martin

Re: Detects executables signed with stolen, revoked or invalid certificate

2022-03-17

@concernedcitizen: Thanks. But I still do not know what to report and whether it is even worth reporting. I only got the screenshot in the post above. I do not even know, where it comes from. If you are concerned, please report it yourself. Thanks.

concernedcitizen

Re: Detects executables signed with stolen, revoked or invalid certificate

2022-03-17 13:00

Others with similar detections have successfully reached out to ditekshen on https://github.com/ditekshen/detection/issues?q=is%3Aissue to get explanation/fix of false detections for their software

martin

Re: Detects executables signed with stolen, revoked or invalid certificate

2022-02-25

Can you post a link to that page? I was not able to find it. I do not know who @ditekshen is, and what significance does his/her rule have.
I've found that the rule was added 15 months ago and noone ever asked about it until now:
https://github.com/ditekshen/detection/commit/4a2fd52f13aaefb28681458f33b8b9afc092c161

alexroz

Re: Detects executables signed with stolen, revoked or invalid certificate

2022-02-24 13:34

@martin

martin

Re: Detects executables signed with stolen, revoked or invalid certificate

2022-02-23

I do not even know what does that "rule" means. Where did you get it?
I do not see any problem for WinSCP-5.19.6-Setup.exe at VirusTotal:
https://www.virustotal.com/gui/file/d5402b38b60099335e091c6d6b8143eb64a6eb02f24bf014edbd598313440463

Guest

Detects executables signed with stolen, revoked or invalid certificate

2022-02-22 16:19

According to VirusTotal WinSCP-5.19.6-Setup.exe signed with "signed with stolen, revoked or invalid certificate"

rule INDICATOR_KB_CERT_0232466dc95b40ec9d21d9329abfcd5d {

    meta:

         author = "ditekSHen"

         description = "Detects executables signed with stolen, revoked or invalid certificate"

         thumbprint = "fb845245cfbb0ee97e76c775348caa31d74bec4c"

    condition:

        uint16(0) == 0x5a4d and

        for any i in (0..pe.number_of_signatures): (

            pe.signatures[i].subject contains "Martin Prikryl" and

            pe.signatures[i].serial == "02:32:46:6d:c9:5b:40:ec:9d:21:d9:32:9a:bf:cd:5d"

        )

}

What does it mean?