Different result from Signtool #102
Description
nc.exe from int0x33/nc.exe is signed and it is verified by signtool.
>signtool verify /pa nc.exe
File: nc.exe
Index Algorithm Timestamp
========================================
0 sha1 Authenticode
Successfully verified: nc.exe
But it is not verified by uthenticode.
>svcli nc.exe
This PE is NOT verified!
nc.exe has 1 certificate entries
Calculated checksums:
MD5: 93013015944D906D98AC97C32274D8E7
SHA1: 612E98A6DABA999F46EE8CE82176E10B77B60C87
SHA256: F2CB0E58C668B2C289D7CBAD47030E3FB82126180270EE99E69076AFDE997F8E
SignedData entry:
Embedded checksum: 612E98A6DABA999F46EE8CE82176E10B77B60C87
Signers:
Subject: /C=SI/CN=Jernej Simoncic
Issuer: /C=BE/O=GlobalSign nv-sa/OU=ObjectSign CA/CN=GlobalSign ObjectSign CA
Serial: 010000000001307A27872D
Certificates:
Subject: /C=BE/O=GlobalSign nv-sa/OU=Primary Object Publishing CA/CN=GlobalSign Primary Object Publishing CA
Issuer: /C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA
Serial: 040000000001239E0FACB3
Subject: /OU=Timestamping CA/O=GlobalSign/CN=GlobalSign Timestamping CA
Issuer: /C=BE/O=GlobalSign nv-sa/OU=Root CA/CN=GlobalSign Root CA
Serial: 0400000000012019C19066
Subject: /C=BE/O=GlobalSign NV/CN=GlobalSign Time Stamping Authority
Issuer: /OU=Timestamping CA/O=GlobalSign/CN=GlobalSign Timestamping CA
Serial: 01000000000125B0B4CC01
Subject: /C=SI/CN=Jernej Simoncic
Issuer: /C=BE/O=GlobalSign nv-sa/OU=ObjectSign CA/CN=GlobalSign ObjectSign CA
Serial: 010000000001307A27872D
Subject: /C=BE/O=GlobalSign nv-sa/OU=ObjectSign CA/CN=GlobalSign ObjectSign CA
Issuer: /C=BE/O=GlobalSign nv-sa/OU=Primary Object Publishing CA/CN=GlobalSign Primary Object Publishing CA
Serial: 040000000001239E0FAF24
This SignedData is invalid!
Some other software has the same problem, while some of them are normal. I understand there are caveats that uthenticode may behave differently to Wintrust API because of not accessing Trusted Publishers store which causes the uthenticode-verified software can't run on some Windows environments. But this situation is that the signature can't be cryptographically verified, which I have no idea why it would happen.
The following are the versions of the dependencies I used:
- openssl 3.3.1
- pe-parse 2.1.1
- uthenticode 2.0.1