Virustotal - new feature to detect malicious signed MSI files

guest · Jan 16, 2019

Virustotal - new feature to detect malicious signed MSI files
Distribution of malicious JAR appended to MSI files signed by third parties
January 15, 2019
https://blog.virustotal.com/2019/01/distribution-of-malicious-jar-appended.html

Microsoft Windows keeps the Authenticode signature valid after appending any content to the end of Windows Installer (.MSI) files signed by any software developer. This behaviour can be exploited by attackers to bypass some security solutions that rely on Microsoft Windows code signing to decide if files are trusted

[...] when you append any data to the end of a signed Windows Installer (.MSI), the resulting file will pass the verification process of Microsoft Windows and will show just the original signature as valid without any other warning.

Such an attack vector is not very interesting if the resulting file is not designed to execute the attached payload, because the attacker would need an additional component already running in the target to extract and execute the appended malicious code.
However, JAR files have a characteristic that allows them to run directly in this scenario, making them the perfect candidate to take advantage of this situation.
Click to expand...

In short, an attacker can append a malicious JAR to a MSI file signed by a trusted software developer (like Microsoft Corporation, Google Inc. or any other well-known developer), and the resulting file can be renamed with the .jar extension and will have a valid signature according Microsoft Windows.

For example, via the command "copy /b signed.msi + malicious.jar signed_malicious.jar". The victim can be infected with just a double-click in such a file.

Microsoft has decided that it will not be fixing this issue in the current versions of Windows and agreed we are able to blog about this case and our findings publicly.

[...] VirusTotal also detects this attack vector via the updated version of Sigcheck with the warning "Signed but the filesize is invalid (the file is too large)" in the Signature info section.
Click to expand...

Log in or Sign up

Virustotal - new feature to detect malicious signed MSI files

guest Guest

Log in or Sign up

Virustotal - new feature to detect malicious signed MSI files

guest Guest

Useful Searches