Investigating a Mysteriously Malformed Authenticode Signature

Elastic Security Labs analyzed a puzzling Authenticode validation error (TRUST_E_MALFORMED_SIGNATURE) on a signed Windows binary and traced it to imagehlp.dll heuristics (from MS13-098) that scan signature blocks for “invalid markers” associated with legacy installer/archive formats. A coincidental match on the “EGGA” marker within the signature block—made more likely by page hashing—caused a false positive; re-signing with the relaxed marker check (/rmc) resolved the issue, and the research documents the underlying logic, registry key, and marker list to aid future troubleshooting.