Issue with Signify v0.9.2

[Damag3dRoot]

When importing thrember with recent versions of signify, the following error occurs:

ImportError: cannot import name 'SignedPEFile' from 'signify.authenticode'

Root cause

thrember/features.py currently imports:

from signify.authenticode import SignedPEFile

However, in recent versions of signify, SignedPEFile is no longer exposed at this location.
According to the current Signify documentation, the class is now defined in:

from signify.authenticode.signed_file import SignedPEFile

Additionally, the Signify API has changed:

• iter_signed_datas() has been replaced by iter_embedded_signatures()

As a result, thrember fails to import with up-to-date Signify versions, even though the required class still exists.

Proposed fix

1. Update the import in thrember/features.py:

from signify.authenticode.signed_file import SignedPEFile

2. Replace calls to:

iter_signed_datas()

with:

iter_embedded_signatures()

This aligns thrember with the current Signify public API and restores compatibility without removing Authenticode features.

Environment

• Python: 3.10 / 3.11
• signify: recent (>= 0.7.x)
• thrember / EMBER2024: current main branch

[Damag3dRoot]

Also :
Issue: Authenticode feature crashes with recent Signify versions

While testing PEFeatureExtractor on a single PE file, extraction fails with:

AttributeError: 'SignedPEFile' object has no attribute 'iter_signed_datas'

Root cause:

• thrember/features.py still calls SignedPEFile.iter_signed_datas()
• In recent versions of signify, this method no longer exists
• According to the current Signify documentation, the correct API is:

SignedPEFile.iter_embedded_signatures()

Impact:

• PE feature extraction crashes during Authenticode processing
• This blocks single-file scanning and any runtime usage of PEFeatureExtractor

Suggested fix:

• Replace iter_signed_datas() with iter_embedded_signatures()
• Or guard Authenticode feature extraction behind a compatibility check / try-except

This issue is reproducible with up-to-date signify and Python 3.10/3.11.