Malware Analysis - 3CX SmoothOperator Authenticode Abuse

SmoothOperator abuses Microsoft Authenticode signatures to seem valid. Here is an explanation how it works and how to detect it in files.

Buy me a coffee: https://ko-fi.com/struppigel
Follow me on Twitter: https://twitter.com/struppigel

AnalysePESig: https://blog.didierstevens.com/programs/authenticode-tools/

SigFlip: https://github.com/med0x2e/SigFlip

Sysinternals: https://learn.microsoft.com/en-us/sysinternals/downloads/sysinternals-suite

Using unauthenticated data inside authenticode signed binaries: https://web.archive.org/web/20150426192725/http://blogs.msdn.com/b/ieinternals/archive/2014/09/04/personalizing-installers-using-unauthenticated-data-inside-authenticode-signed-binaries.aspx

00:00 Intro
00:37 Signature verification
02:09 SigFlip and SigLoader
03:05 Ways to hide data in authenticode structures
06:00 Detecting hidden authenticode data
08:11 Why this still works
09:05 Outro

3cx abuse analysis authenticode data detect files hidden hide malware malware analysis microsoft sigflip signature signatures valid verification