{"id":5418,"date":"2023-07-18T07:39:14","date_gmt":"2023-07-18T07:39:14","guid":{"rendered":"\/cybersecurity-blog\/?p=5418"},"modified":"2023-07-18T08:29:53","modified_gmt":"2023-07-18T08:29:53","slug":"digital-signatures","status":"publish","type":"post","link":"https:\/\/any.run\/cybersecurity-blog\/digital-signatures\/","title":{"rendered":"Identify Suspicious or Tampered Files Faster with Digital Signatures\u00a0\u00a0"},"content":{"rendered":"\n

<\/p>\n\n\n\n

Speed is one of the biggest advantages of the ANY.RUN sandbox<\/a>. You can often recognize that a file is potentially malicious in under 20 seconds \u2014 whether it\u2019s through the process tree, network stream analysis, or config extraction. Today, we’re adding a new feature to enhance your threat detection: digital signatures. Now, you can easily identify files that have been counterfeited or tampered with.<\/strong>\u00a0<\/p>\n\n\n\n

Digital signatures act like official seals, validating the code’s issuer and signaling to analysts that a file can be trusted. Most large companies use them, signing every file. Kept up to date in public databases, signatures provide robust authenticity checks.\u00a0<\/p>\n\n\n\n

\"Signature<\/figure>\n\n\n\n

In ANY.RUN, you’ll find new digital signature icons next to processes in the process tree<\/strong>. Semi-transparent icons at the bottom indicate that a process or module has a certificate. Bigger icons at the top mark processes that require further investigation. Here\u2019s when we display them: <\/p>\n\n\n\n