VirusTotal/yara
1
0
Fork 0
mirror of https://github.com/VirusTotal/yara.git synced 2026-10-12 10:49:55 +00:00
Code Issues Packages Projects Releases Wiki Activity

Ignore Authenticode signatures that are somehow corrupt.

Browse Source
This commit is contained in:
Victor M. Alvarez
2024-05-06 10:46:46 +02:00
parent 2479a7104e
commit 8501962919
1 changed files with 16 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files
libyara/modules/pe/pe.c
+16
View File
@@ -1758,6 +1758,22 @@ void _process_authenticode(
for (size_t i = 0; i < auth_array->count; ++i)
{
const Authenticode* authenticode = auth_array->signatures[i];
if (authenticode->verify_flags & AUTHENTICODE_VFY_CANT_PARSE)
continue;
if (authenticode->verify_flags & AUTHENTICODE_VFY_WRONG_PKCS7_TYPE)
continue;
if (authenticode->verify_flags & AUTHENTICODE_VFY_NO_SIGNER_INFO)
continue;
if (authenticode->verify_flags & AUTHENTICODE_VFY_NO_SIGNER_CERT)
continue;
if (authenticode->verify_flags & AUTHENTICODE_VFY_INTERNAL_ERROR)
continue;
bool verified = authenticode->verify_flags == AUTHENTICODE_VFY_VALID;
/* If any signature is valid -> file is correctly signed */