search

VirusTotal / yara

The pattern matching swiss knife
https://virustotal.github.io/yara/
BSD 3-Clause "New" or "Revised" License
8.13k stars 1.42k forks source link

fix: If any signature is valid, the file is properly signed #1936

Closed aliyunav closed 12 months ago

aliyunav commented 1 year ago

If any signature will be valid, pe file is correctly signed

plusvic commented 1 year ago

Do you have some test case for this? Some file that mixes invalid and valid signatures?

aliyunav commented 1 year ago

Yes,some file first signature timestamps are out of date,but the second one is valid.The last signature taken by the old code is not as expected. It also does not match the current comment of the variable ”signature_valid“

plusvic commented 1 year ago

It would be great if we can add a test case for this, that's why I was asking for file.