Code signatures on Windows executables provide guarantees about the integrity of a signed executable, as well as information about the identity of the signer.
Attackers who are able to obscure their identity in signatures without affecting the integrity of the signature can avoid detection longer and extend the lifetime of their code-signing certificates to infect more systems.
OpenSUpdater, a known family of unwanted software which violates our policies and is harmful to the user experience, is used to download and install other suspicious programs.
The actor behind OpenSUpdater tries to infect as many users as possible and while they do not have specific targeting, most targets appear to be within the United States and prone to downloading game cracks and grey-area software.
Groups of OpenSUpdater samples are often signed with the same code-signing certificate, obtained from a legitimate certificate authority.
Since mid-August, OpenSUpdater samples have carried an invalid signature, and further investigation showed this was a deliberate attempt to evade detection.
In these new samples, the signature was edited such that an End of Content (EOC) marker replaced a NULL tag for the ‘parameters’ element of the SignatureAlgorithm signing the leaf X.509 certificate.
EOC markers terminate indefinite-length encodings, but in this case an EOC is used within a definite-length encoding (l= 13).