Some cert-spoofed stealers I'd written off as unbeatable static-analysis, turns out I was just checking the wrong field

«I'm building a PE static analysis engine and for months I had a bunch of infostealers in my benchmark I'd basically given up on. A fake Zoom and a few game cheat loaders, all signed with a real NVIDIA code-signing cert (...»