8

Why would some executable on a Windows 7 system not have a "Digital Signatures" tab?

(With this question I am referring to those executables that are not part of Windows OS and to which the installation package creates a shortcut in the start menu.)

Is it because:

  1. The .exe file is actually some kind of a wrapper for e.g. Java Jar or Flash SWF files?
  2. The manufacturer never digitally certified the .exe?
  3. Some other reason?

I am asking because I thought that if the reason is #2 (that the binary was never certified by a CA) then I would have gotten some kind of warning message when installing the software.

Update: Below screen shot shows two executables on my machine. For one of them ("iClone.exe") Windows does not display the "Digital Signatures" tab. For the other one the tab is displayed.

an .exe without a Dig Sign tab

Improve this question
2
  • Are you sure you're looking at the properties for the binaries and not the shortcuts?
    – Neil Smithline
    Dec 22, 2015 at 19:19
  • Hi @NeilSmithline, yes the file is an .exe (or at least it is displayed as such). I have added a screen shot with more details. Thanks.
    – x457812
    Dec 22, 2015 at 20:31

3 Answers 3

Reset to default
8

Executable's are not required by Microsoft to be signed. However, drivers are.

Starting with 64-bit versions of Windows Vista and later versions of Windows, driver code signing policy requires that all driver code have a digital signature. In addition, certain configurations of 32-bit versions of Windows Vista and later versions of Windows also require driver code to be digitally-signed in order to access next generation premium content that is controlled by the content protection policy. Windows Vista and later versions of Windows rely on digital signatures of these components to increase the safety and stability of the Microsoft Windows platform and enable new customer experiences with next generation premium content.

Ref: https://msdn.microsoft.com/en-us/library/windows/hardware/ff548231(v=vs.85).aspx

Improve this answer
2
5

If you find this for Microsoft executables, the reason is the implementation of Windows Explorer: Windows Explorer will only show digital signatures if the signature is in the executable itself (e.g. signed with signtool). It will not show digital signature that are stored in the Windows digital signatures catalog (C:\Windows\System32\catroot\) (e.g. generated with makecat).

To check an exectuable's signature including the entries from the digital signature catalog, use SysInternals SigCheck. It'll also tell you where it found the signature when run with the -i command line switch, e.g.

C:\>sigcheck.exe -i c:\Windows\System32\cmd.exe

Sigcheck v2.1 - File version and signature viewer
Copyright (C) 2004-2014 Mark Russinovich
Sysinternals - www.sysinternals.com

c:\windows\system32\cmd.exe:
        Verified:       Signed
        Catalog:        C:\Windows\system32\CatRoot\{F750E6C3-38EE-11D1-85E5-00C04FC295EE}\Microsoft-Windows-Client-Features-Package-AutoMerged-base~31bf3856ad364e35~amd64~~10.0.10586.0.cat
[...]
Improve this answer
0
3
  1. The manufacturer never digitally certified the .exe?

Yes. It costs money and means extra effort in the deployment workflow.

I am asking because I thought that if the reason is #2 (that the binary was never certified by a CA) then I would have gotten some kind of warning message when installing the software.

No. While you can configure similar things with "AppLocker" (I guess by using a publisher allow-rule with condition "Any Publisher"), there is no such mechanism active by default on any Windows OS that I know of.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .