Some cert-spoofed stealers I'd written off as unbeatable static-analysis, turns out I was just checking the wrong field

I'm building a PE static analysis engine and for months I had a bunch of infostealers in my benchmark I'd basically given up on. A fake Zoom and a few game cheat loaders, all signed with a real NVIDIA code-signing cert (looks like one from the 2022 leak). The cert chains to a trusted root so Windows trusts it, and structurally these things look cleaner than half the legit Intel installers I have. I couldn't find any static signal that separated them from real signed software, so I wrote it off as something you'd need a sandbox to catch and moved on.

​

Well i was wrong, and pretty dumb in hindsight as i was checking whether the cert chained to a trusted root. I was never checking whether the file's authenticode hash actually matched the hash that got signed. These are two different questions and although my engine answered the first i assumed it covered the second.

​

When I finally recomputed the hashes, all four came back as digest mismatches. The cert blobs are genuinely NVIDIA's, they were just copied onto a different binary. The signature doesn't match the file it's attached to.

​

Wired up two checks off the back of it: digest mismatch (signed hash isn't the file's real hash), and signer EKU (a bunch of these use a TLS/serverAuth cert that can't legally sign a PE at all). Between them they catch most of the signed stealers in my set, with zero false positives on legit signed binaries, which was the part I actually cared about.

​

The one I haven't cracked is the burner-LLC case. Malware signed with a real, properly-issued code-signing cert that's just been abused. Digest matches, chain's valid, EKU's correct. Anyone solved this kind of issue?

​