⚠️ Some cert-spoofed stealers I'd written off as unbeatable static-analysis, turns out I was just checking the wrong field

I'm building a PE static analysis engine and for months I had a bunch of infostealers in my benchmark I'd basically given up on. A fake Zoom and a few game cheat loaders, all signed with a real NVIDIA code-signing cert (looks like one from the 2022 leak). The cert chains to a trusted root so Windows trusts it, and structurally these things look...