Looks bad.
This seems to be a bad CA cert. Best to nuke and rebuild your computer.
Edit 1: Just for fun: some digging around.
Some in depth analysis of the contents of that P12 file. Read this only if you like this sort of thing.
Splitting apart the P12 file
Let's have a look at that p12 file and unwrap it:
$ sha256sum.exe cert.p12
c33d12dc723dfb5af945e69dd2af8a475234d3fae779b444bea924dcb816620a *cert.p12
$ openssl pkcs12 -in cert.p12 -out pembundle.pem -password pass:"" -nodes -info
MAC Iteration 2048
MAC verified OK
PKCS7 Encrypted data: pbeWithSHA1And40BitRC2-CBC, Iteration 2048
Certificate bag
Certificate bag
PKCS7 Data
Shrouded Keybag: pbeWithSHA1And3-KeyTripleDES-CBC, Iteration 2048
$ csplit -f individual- pembundle.pem '/^Bag Attributes/' '{*}' --elide-empty-files
2036
1969
3396
Now let's look inside and give these objects some nicer names:
$ head individual-0*
==> individual-00 <==
Bag Attributes
localKeyID: 70 04 3C 28 93 39 60 37 92 DA 92 8F 73 F5 50 86 60 3F BF 27
subject=/C=US/L=Silicon Valley/O=Authenticode/CN=PortableWares
issuer=/C=US/L=Silicon Valley/O=Authenticode/CN=Google
-----BEGIN CERTIFICATE-----
MIIFFzCCAv8CAQEwDQYJKoZIhvcNAQEFBQAwTjELMAkGA1UEBhMCVVMxFzAVBgNV
BAcMDlNpbGljb24gVmFsbGV5MRUwEwYDVQQKDAxBdXRoZW50aWNvZGUxDzANBgNV
BAMMBkdvb2dsZTAeFw0xNTA3MjEyMTA1MTJaFw0xNzA3MjAyMTA1MTJaMFUxCzAJ
BgNVBAYTAlVTMRcwFQYDVQQHDA5TaWxpY29uIFZhbGxleTEVMBMGA1UECgwMQXV0
aGVudGljb2RlMRYwFAYDVQQDDA1Qb3J0YWJsZVdhcmVzMIICIjANBgkqhkiG9w0B
==> individual-01 <==
Bag Attributes: <No Attributes>
subject=/C=US/L=Silicon Valley/O=Authenticode/CN=Google
issuer=/C=US/L=Silicon Valley/O=Authenticode/CN=Google
-----BEGIN CERTIFICATE-----
MIIFGDCCAwACCQDNCzLvtPTNEzANBgkqhkiG9w0BAQUFADBOMQswCQYDVQQGEwJV
UzEXMBUGA1UEBwwOU2lsaWNvbiBWYWxsZXkxFTATBgNVBAoMDEF1dGhlbnRpY29k
ZTEPMA0GA1UEAwwGR29vZ2xlMB4XDTE1MDcyMTIxMDUwOFoXDTIwMDcyMDIxMDUw
OFowTjELMAkGA1UEBhMCVVMxFzAVBgNVBAcMDlNpbGljb24gVmFsbGV5MRUwEwYD
VQQKDAxBdXRoZW50aWNvZGUxDzANBgNVBAMMBkdvb2dsZTCCAiIwDQYJKoZIhvcN
AQEBBQADggIPADCCAgoCggIBAOI8i0Hzr4lZFc2FsvopuCyNwZuYNqwiBqgJHKGj
==> individual-02 <==
Bag Attributes
localKeyID: 70 04 3C 28 93 39 60 37 92 DA 92 8F 73 F5 50 86 60 3F BF 27
Key Attributes: <No Attributes>
-----BEGIN PRIVATE KEY-----
MIIJRAIBADANBgkqhkiG9w0BAQEFAASCCS4wggkqAgEAAoICAQDbVi3zesndOgos
+Kesf017VXMWZwvttim67t15uUy6O6I5kzLElxuehgnHm/yQcNCXh/oLMyoxIPTw
pK0dmC09SRKwcX36ZPteBhhgdRHAY/5/7KaXHgKzWvK02XJ+mC2t81H15lemx/bA
+56zFUgYlxa2A+Zge3n5nrkT3uDPm8kmGfKycKZye4ODoKv/uU4JxGcUvrLKZSet
72gIwIlncK3puU7eRIQ95yBJengOWTdTYEdDl+Bimz+8GH7xGB5gdzB8q9F1QVTe
SHSvMURZLfatbHupbCWEmgqPvZzDV1ohP4Ab5dt1M1H5lnE3DNuOBqfbJ8gE3O26
Now that we have an idea what's inside, we can give them proper names. Let's also pump them through openssl to get the full parse out (via the -text
parameter) along with the Base64 encoding.
$ cat individual-00 | openssl x509 -text > portablewares.cer
$ cat individual-01 | openssl x509 -text > fakegoogle.cer
$ cat individual-02 | openssl rsa -text > someprivkey.key
What about that privkey?
Now let's see if any of these certs belongs to the privkey:
$ openssl x509 -in portablewares.cer -pubkey | openssl pkey -pubin -pubout -outform der | sha256sum
041b989566cd1174449d4f74dbdeb82b58365a8942936676cbff662998f58fb0 *-
$ openssl pkey -in someprivkey.key -pubout -outform der | sha256sum
041b989566cd1174449d4f74dbdeb82b58365a8942936676cbff662998f58fb0 *-
$ openssl x509 -in fakegoogle.cer -pubkey | openssl pkey -pubin -pubout -outform der | sha256sum
1a0873fe3d24bf8e77775694eaab0940c37ac3d03b3d3b42acb4f600bb4f112f *-
It seems that the privatekey might belong to the "portablewares.cer".
Let's make sure and try to actually sign something with this. (I'm using the method recommended by journalist Hanno Böck to do this.)
$ ./TryAndSignWithThis.sh portablewares.cer someprivkey.key
4a96b377cd177bcece1af794cdcb5144cc9e3f7285e5652b0bc36c4f0551f439 *SignThisBlob.bin
4a96b377cd177bcece1af794cdcb5144cc9e3f7285e5652b0bc36c4f0551f439 *BlobAfterVerify.bin
Files SignThisBlob.bin and BlobAfterVerify.bin are identical
Yup. This privkey belongs to that certificate.
Let's give it a nicer name:
$ mv someprivkey.key portablewares.key
Script Listing
$ cat TryAndSignWithThis.sh
# Usage: TryAndSignWithThis.sh somecert.cert somekey.key
# Adapted from the script by Hanno Böck ( https://blog.hboeck.de/archives/888-How-I-tricked-Symantec-with-a-Fake-Private-Key.html , https://archive.is/RZgXp )
openssl x509 -in $1 -noout -pubkey > TryThisPubkey.pem
dd if=/dev/urandom of=SignThisBlob.bin bs=32 count=1 status=none
openssl rsautl -pkcs -sign -inkey $2 -in SignThisBlob.bin -out BlobWithSignature.bin
openssl rsautl -pkcs -verify -pubin -inkey TryThisPubkey.pem -in BlobWithSignature.bin -out BlobAfterVerify.bin
sha256sum -- SignThisBlob.bin BlobAfterVerify.bin
diff --report-identical-files -- SignThisBlob.bin BlobAfterVerify.bin
rm -- TryThisPubkey.pem SignThisBlob.bin BlobWithSignature.bin BlobAfterVerify.bin
Re. Hexatomium post
Also: This fake google cert is in fact the certificate that was mentioned in the HexAtomium blog post above. He has this available for download. And the pubkey is the same as for our cert.
$ curl -s https://www.trustprobe.com/TI/fake_google.cer | openssl x509 -inform der -pubkey | openssl pkey -pubin -pubout -outform der | sha256sum
1a0873fe3d24bf8e77775694eaab0940c37ac3d03b3d3b42acb4f600bb4f112f *-
Some googling
Let's do some further websearch for these certs/keys
$ openssl x509 -in fakegoogle.cer -outform der | sha1sum
33fcd70343bbe07972d73cdefdeb3c9f4dcefe28 *-
Googling for this turns up nothing too interesting.
$ openssl x509 -in portablewares.cer -outform der | sha1sum
70043c289339603792da928f73f55086603fbf27 *-
Googling for this turns up some VirusTotal scans of a files that are signed with that cert/key. Nice! ->
Now what about that key?
$ openssl rsa -in portablewares.key -outform der | sha1sum
writing RSA key
a8ab813368f9f9ef13d70ea6e2489d0d2f7eb36c *-
Googling for this results in nothing.
Now what if we search for the serial numbers?
$ openssl x509 -in fakegoogle.cer -noout -serial
serial=CD0B32EFB4F4CD13
Googling for this only turns up the Hybrid-Analysis scan again.
$ openssl x509 -in portablewares.cer -noout -serial
serial=01
This serial number is just bizarre and waves all sorts of red flags.
Full cert/key listing
Full parse outs of the certs/key:
Edit 2.
I actually found a sample EXE file that is signed with that cert/key.
Edit 3.
I don't know what to make of this signtool output. The main signature is obviously fake. (As we found out above.) But what about the signed timestamps? Are they for real? Maybe somebody else can explain this.
C:\> signtool verify /all /pa /v /debug RadioSurePortable_x.x.x_online.paf.exe
Verifying: RadioSurePortable_x.x.x_online.paf.exe
Signature Index: 0 (Primary Signature)
Hash of file (sha1): 148528EE2FDB92441711B3E10760E1D191AD108D
Signing Certificate Chain:
Issued to: PortableWares
Issued by: Google
Expires: Thu Jul 20 23:05:12 2017
SHA1 hash: 70043C289339603792DA928F73F55086603FBF27
The signature is timestamped: Sun Oct 04 23:04:08 2015
Timestamp Verified by:
Issued to: Thawte Timestamping CA
Issued by: Thawte Timestamping CA
Expires: Fri Jan 01 01:59:59 2021
SHA1 hash: BE36A4562FB2EE05DBB3D32323ADF445084ED656
Issued to: Symantec Time Stamping Services CA - G2
Issued by: Thawte Timestamping CA
Expires: Thu Dec 31 01:59:59 2020
SHA1 hash: 6C07453FFDDA08B83707C09B82FB3D15F35336B1
Issued to: Symantec Time Stamping Services Signer - G4
Issued by: Symantec Time Stamping Services CA - G2
Expires: Wed Dec 30 01:59:59 2020
SHA1 hash: 65439929B67973EB192D6FF243E6767ADF0834E4
Number of signatures successfully Verified: 0
Number of warnings: 0
Number of errors: 1
SignTool Error: WinVerifyTrust returned error: 0x800B010A
A certificate chain could not be built to a trusted root authority.