secretsquirrel/SigThief

Health v2 · maintenance only

Flags: no_releases

Adoption not part of the score

2416 stars · 483 forks observed · 2026-08-28

What it is AI-extracted, prompt v1, taxonomy v1, 2026-08-30, confidence not recorded

SigThief is a Python CLI tool that rips the Authenticode signature off a signed PE file and appends it to another binary, patching the certificate table. The resulting signature is intentionally invalid, making it useful for testing how antivirus engines prioritize PE signatures.

Use cases

• test how antivirus engines treat PE signatures
• copy a code-signing certificate table from one exe to another
• check whether a PE file is signed
• remove or truncate a signature from a Windows binary
• evaluate AV trust in certificate authorities without signature validation

When to choose

• you are a security professional testing antivirus signature handling
• you need to quickly append or strip Authenticode signatures on PE files
• you want a lightweight Python script for red-team AV evasion research

When to avoid

• you need to create genuinely valid code signatures
• you are signing binaries for production software distribution
• you need cross-platform signing formats beyond Windows PE

Facets

cli-tool · maturity maintenance

security penetration-testing cli security penetration-testing developer-tools python cli windows cross-platform pe-files code-signing antivirus-testing signature-forgery red-team

Member repositories

For agents

markdown · JSON · MCP: product_card(name="secretsquirrel/SigThief")