Microsoft Windows cryptoapi - SymCrypt Modular Inverse Algorithm Denial of Service

Microsoft Windows cryptoapi - SymCrypt Modular Inverse Algorithm Denial of Service There's a bug in the SymCrypt multi-precision arithmetic routines that can cause an infinite loop when calculating the modular inverse on specific bit patterns with bcryptprimitives!SymCryptFdefModInvGeneric. I've...

CVE-2019-5530

Windows binaries generated with InstallBuilder versions earlier than 19.7.0 are vulnerable to tampering even if they contain a valid Authenticode signature...

Design/Logic Flaw

Windows binaries generated with InstallBuilder versions earlier than 19.7.0 are vulnerable to tampering even if they contain a valid Authenticode signature...

CVE-2019-5530

Windows binaries generated with InstallBuilder versions earlier than 19.7.0 are vulnerable to tampering even if they contain a valid Authenticode signature...

Malicious Process Detection: Authenticode Microsoft Manufacturer

Binary data wmimalwareauthenticodemanufacturermicrosoft.nbin...

Malicious Process Detection: Authenticode Not Verified

Binary data wmimalwareauthenticodeinvalidsignedinfo.nbin...

Malicious Process Detection: Authenticode Not Signed

Binary data wmimalwareauthenticodenotsigned.nbin...

Malicious Process Detection: Authenticode Signed Bad Date

Binary data wmimalwareauthenticodebaddate.nbin...

Malicious Process Detection: Authenticode Signed

Binary data wmimalwareauthenticodesigned.nbin...

Malicious Process Detection: Authenticode With Invalid Signature

Binary data wmimalwareauthenticodeinvalidsigned.nbin...

When you shouldn’t trust a trusted root certificate

Root certificates are the cornerstone of authentication and security in software and on the Internet. They're issued by a certified authority CA and, essentially, verify that the software/website owner is who they say they are. We have talked about certificates in general before, but a recent eve...

Protect Your Organization from Petya / NotPetya Ransomware with Carbon Black

Organizations from Russia to Britain were hit by a ransomware attack on Tuesday in a hack with similarities to the recent WannaCry attacks. Initial analysis showed that the malware seen is a recent variant of the Petya ransomware family based upon how it encrypts files and displays its ransom not...

Microsoft Windows PowerShell Security Feature Bypass Vulnerability (CVE-2017-0007)

Over the past few months, I have had the pleasure to work side-by-side with Matt Graeber @mattifestation and Casey Smith @subtee in their previous job roles, researching Device Guard user mode code integrity UMCI bypasses. If you aren't familiar with Device Guard, you can read more about it here:...

Manalyze - A static analyzer for PE executables

Manalyzer is a free service which performs static analysis on PE executables to detect undesirable behavior. A static analyzer for PE files Manalyze was written in C++ for Windows and Linux and is released under the terms of the GPLv3 license . It is a robust parser for PE files with a flexible...

PE Executables Static Analyzer: Manalyze

PE Executables Static Analyzer Manalyze performs static analysis on PE files, in order to detect signs of malicious behavior. It is a versatile tool with a robust parser and a set of built-in tests, but can also be extended easily.Manalyze was written in C++ for Windows and Linux and is released...

CVE-2016-3986

Avast allows remote attackers to cause a denial of service memory corruption and possibly execute arbitrary code via a crafted PE file, related to authenticode parsing...

Memory corruption

Avast allows remote attackers to cause a denial of service memory corruption and possibly execute arbitrary code via a crafted PE file, related to authenticode parsing...

CVE-2016-3986

CVE-2016-3986 affects Avast Antivirus and is triggered by a crafted PE file, exploiting the authenticode parsing path to cause memory corruption and potentially execute arbitrary code. The vulnerability’s impact is a denial-of-service with memory corruption (and possible code execution). Affected...

CVE-2016-3986

Avast allows remote attackers to cause a denial of service memory corruption and possibly execute arbitrary code via a crafted PE file, related to authenticode parsing...

Avast! - Authenticode Parsing Memory Corruption

Source: https://code.google.com/p/google-security-research/issues/detail?id=668 The attached PE file causes memory corruption in Avast, it looks related to authenticode parsing. 474.c0c: Access violation - code c0000005 first chance First chance exceptions are reported before any exception...