Researchers Hide Malware Inside Digitally-Signed Files Without Breaking Hashes

A team of security researchers from Deep Instinct have discovered a method of injecting malware inside a digitally-signed binary without affecting the overall file hash, which almost certainly ensures that antivirus and security software won't detect the malicious file.

When users double-click an executable and launch it into execution, Windows does three things. It first reads the file's PE headers, validates the certificate, and validate's the file hash.

After reverse engineering this entire process, the Deep Instinct team discovered that Windows does not include three fields from the PE headers in the file hash validation process and that modifying these three fields does not break the certificate's validity.

Researchers first made the file undetectable

The fields are the file's Checksum, the IMAGE_DIRECTORY_ENTRY_SECURITY field from the DataDirectory section, and the file's attribute certificate table.

In proof-of-concept code they did not r...