Author: billybobbaker
Subject: PESHA-1 and PESHA-256
Posted: 16 October 2014 at 6:53pm
So I am trying to figure out what these hashes are coming from autorunsc. At first I thought these where from the calculations of pehash which uses certain values in the PE properties, but the hash from autorunsc and hash from pehash does not match. Also found a reference to Authenticode was introduced in v11.70 . So I looked at the thumbprint from authenticode and that didnt match so I sha1 the thumbprint and that doesnt match either. Does anyone know what algorithm or the structure used to formulate the PESHA-1 and PESHA-256 hashes from autorunsc?
Thanks
Subject: PESHA-1 and PESHA-256
Posted: 16 October 2014 at 6:53pm
So I am trying to figure out what these hashes are coming from autorunsc. At first I thought these where from the calculations of pehash which uses certain values in the PE properties, but the hash from autorunsc and hash from pehash does not match. Also found a reference to Authenticode was introduced in v11.70 . So I looked at the thumbprint from authenticode and that didnt match so I sha1 the thumbprint and that doesnt match either. Does anyone know what algorithm or the structure used to formulate the PESHA-1 and PESHA-256 hashes from autorunsc?
Thanks