ralphje/signify

PESignAnalyzer is a command-line tool for inspecting and verifying Authenticode signatures on PE files. It supports embedded signatures and catalog-signed files, including automatic discovery of installed system catalogs. An independent OpenSSL cross-platform version is available, with its own CMake build targeting Windows, Linux, and macOS.

A repository of code signing certificates known to have been leaked or stolen, then abused by threat actors

OpenSSL-based Authenticode signing for PE, CAB, CAT, MSI, APPX, and script file

Authenticode signature manipulation toolkit for Red Team operations and security research. Covers signature stealing, metadata cloning, SIP hijacking across 19 file types, WinVerifyTrust FinalPolicy bypass, PKCS#7 payload embedding, SIP execution surface implants, Smart App Control Bypass, and analyst-triggered persistence via OID handlers.

Java library to analyse Portable Executable files with a special focus on malware analysis and PE malformation robustness

A static analyzer for PE executables.

Paranoid's library contains implementations of checks for well known weaknesses on cryptographic artifacts.

Portable Executable (PE) library written in .Net

Java implementation of Microsoft Authenticode for signing Windows executables, installers & scripts