Detection of undesired computer files using digital certificates

A non-transitory program storage device readable by an network security device protecting a private network embodying a program of instructions executable by one or more processors of the network security device to perform a method comprising:

• intercepting a download of a file containing signed code by a host system of a plurality of host systems within the private network;
• processing the file by an antivirus detection module running on the network security device, including:
• identifying a type and structure of the file by examining relevant locations in the file for one or more primary identification bytes that are indicative of the file being of a particular executable file format;
• determining a location of a certificate chain with respect to the file based on the identified type and structure;
• forming a signature of the file by extracting a targeted subset of information from an end entity certificate of the certificate chain based on the type and structure of the file;
• evaluating the file by comparing the signature with a set signatures having a known desirable or undesirable status;
• classifying the file as into a category of a plurality of categories based on a result of said evaluating;
• and
• when the category of the file is indicative of the signed code contained therein being associated with an identified problematic software distributor or the file otherwise being considered undesirable, a policy associated with the category causes the network security device to quarantine, block or otherwise attempt to prevent the file from being delivered to the host system.