[Avira] Malware signed with fake Avira Certificate

[chantal11]

Bonjour,

While analyzing new malware samples we stumbled over a sample which contains a digital Avira signature. Something we need to check! Viewing the properties of the digital signature, Microsoft Windows shows a note “A certificate chain processed, but terminated in a root certificate which is not trusted by the trust provider”. Don’t misunderstand that message – it means that this certificate is not created by Avira GmbH and therefore it’s not a stolen certificate. Stuxnet gained a lot of attention by the media because it contained a valid digital signature from “Realtek Semiconductor” which was obviously stolen by the malware authors.

The certificate used in this malware sample is issued to Avira GmbH and is valid from 2011-02-10 till 2039-31-12.

Lire la suite sur Avira – TechBlog

@+