When EXE is infected, it is easy to destroy the digital signature information of the file. If an attacker intentionally does not destroy the part about digital signature in the EXE file when infecting or destroying the file, it may appear that the digital signature looks normal after infection. But if you carefully look at the file properties or the hash value of mcrc, you will find that the EXE program is not the original version.

2. The digital signature file of the software publisher is stolen, and the attacker can also use the digital signature to package the bundled Trojan horse or infected EXE program, which is even more serious. If an enterprise applies for a digital signature certificate, it must be properly kept, otherwise it will cause endless troubles.