I have a bunch of samples right now that fake signatures.<p>Here&#x27;s one example:
<a href="https:&#x2F;&#x2F;virustotal.com&#x2F;en&#x2F;file&#x2F;fe8fa4daa404ebb3bd6df4c20650a1c94ee686d0fe624aa4cda3fe7d1282ce32&#x2F;analysis&#x2F;" rel="nofollow">https:&#x2F;&#x2F;virustotal.com&#x2F;en&#x2F;file&#x2F;fe8fa4daa404ebb3bd6df4c20650a...</a><p>All of them are self-extracting installers (happen to be 7zip&#x2F;Nullsoft). That successfully fake sigs.  Nullsoft is the most popular packer&#x2F;extractor out there.<p>Sure, there are ways of creating an installer with authenticode that cannot be faked, but much easier to just hash it and not worry about the terrible tech that is authenticode.<p>Edit: That&#x27;s a fake Firefox installer with authenticode that checks out according to the spec. As you can see, this is not some weird edge case.