[FSC] It's Signed, therefore it's Clean, right?

Jarno Niemelä from our lab did a study on malicious Windows binaries that have been signed (with Microsoft Authenticode).

Turns out, we have copies of tens of thousands of malware samples that have been signed.

Malware authors are attempting to use code signing techniques to their advantage.

http://www.f-secure.com/weblog/archives/signed.png

Details of this surprising find are presented in Jarno's presentation file, which can be downloaded from here (PDF). It was first presented in the CARO 2010 Technical Workshop in May 2010.
On 21/06/10 At 11:08 AM

**Hidden Content: To see this hidden content your post count must be 1 or greater.**