False detection of Squirrel_installer

[itai-delphos]

In: dbs_min/db/PE/Squirrel_installer.1.sg
The SquirrelAwareVersion field in the version resource indicates that the executable supports receiving Squirrel life cycle notifications (even if it's not installed with Squirrel). See: https://github.com/Squirrel/Squirrel.Windows/blob/51f5e2cb/src/Squirrel/SquirrelAwareExecutableDetector.cs.
All Electron Windows executables have this value, resulting in a high number of false positives. See: https://github.com/electron/electron/blob/main/build/templates/electron_rc.tmpl#L77

[DosX-dev]

Hello, @itai-delphos! Thank you for the issue!

[Ansita20]

@itai-delphos Hi, Can you please assign me this issue I would love to work on this issue for Hacktoberfest.

Thanks

[BJNFNE]

@itai-delphos Can you provide samples?

[itai-delphos]

You can download Slack for windows https://downloads.slack-edge.com/desktop-releases/windows/x64/4.47.69/Slack.msix and use 7zip or extract Slack.exe 7zz x Slack.msix app/Slack.exe

diec app/Slack.exe
[!] Heuristic scan is disabled. Use '--heuristicscan' to enable
PE64
    Compiler: Rust
    Sign tool: Windows Authenticode(2.0)[PKCS #7]
    Installer: Squirrel Installer(1.0.0-1.9.1)

[BJNFNE]

@itai-delphos WIP commit: 9c2ca0f More coming soon :)

Could you contact me by any chance over Telegram (BJNFNE)