Try to have some fun with this. For example, did you know that a file with a single null byte is "signed" by Microsoft? SHA256 Hash: 6E340B9CFFB37A989CA544E6BB780A2C78901D3FB33738768511A30617AFA01Dpic.twitter.com/nQPWTIZluZ
Show this thread
These are the hashes you implicitly trust on a stock Win10 build: https://gist.github.com/mattifestation/8a2058da8537014166e406c3b09d37ef … Here is the code I used to obtain the hashes:https://gist.github.com/mattifestation/d063255f5c9509cacf49b78dad037832 …
-
-
-
How many of these hashes are present in VT that would return a pos AV hit count > 1 (excluding Cylance because they flag everything)? If you want to try this, note that hashes for PEs in that list will be Authenticode hashes, not file hashes. VT refers to this as "Authentihash".
Show this thread -
Also, note that there's a bunch of SHA1 hashes in there...
Show this thread
End of conversation
New conversation -
-
-
I feel like you’re intentionally going against posh best practices to annoy... =P
-
Please point me to best practices for quick and dirty PoCs.
- End of conversation
New conversation -
-
-
Do they ever change on updates, or always the same?
-
They change on updates.
-
Figured as much
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.