Reply to thread

Message

<blockquote data-quote="cruelsister" data-source="post: 997919" data-attributes="member: 7463">Just a fun fact regarding how DefenderUIPro 1.07 (installed with Recommended Profile) will now handle signed malware. As we know, malware can either be unsigned (most common), signed but certificate revoked, or signed with valid certificate but without countersignature. DefenderUIPro gives alerts for each as follows:1). Unsigned (common):[ATTACH=full]268272[/ATTACH] 2). Signed but certificate revoked (unusual):[ATTACH=full]268273[/ATTACH]3). Signed, certificate valid but without countersignature (fortunately quite rare):[ATTACH=full]268274[/ATTACH]Note that when these files are initially executed one can see the WhiteCloud entry showing &quot;analyzing&quot; prior to a judgement being made. I&#039;m certainly not aware of any other security product that differentiates a signed baddies like this.Really nice work, Dan!</blockquote>

[QUOTE="cruelsister, post: 997919, member: 7463"] Just a fun fact regarding how DefenderUIPro 1.07 (installed with Recommended Profile) will now handle signed malware. As we know, malware can either be unsigned (most common), signed but certificate revoked, or signed with valid certificate but without countersignature. DefenderUIPro gives alerts for each as follows: 1). Unsigned (common):[ATTACH type="full" alt="1ns.png"]268272[/ATTACH] 2). Signed but certificate revoked (unusual): [ATTACH type="full" alt="1snv.png"]268273[/ATTACH] 3). Signed, certificate valid but without countersignature (fortunately quite rare): [ATTACH type="full" alt="1sv.png"]268274[/ATTACH] Note that when these files are initially executed one can see the WhiteCloud entry showing "analyzing" prior to a judgement being made. I'm certainly not aware of any other security product that differentiates a signed baddies like this. Really nice work, Dan! [/QUOTE]

Verification