VirusTotal Blog
CVE-2020-1599 is a vulnerability that can be abused by adding data (that will be later executed) to the signature section of a file, for instance appending a VB script. Unfortunately, Microsoft signature chain certification will not detect that the signature was modified and accept the file as legitimately signed, which can be used to avoid security checks. This is all described in this blog post by our colleagues at Checkpoint, also explaining how ZLoader is using this technique for persistence in recent campaigns.
A non-malicious file abusing this technique can be found here. The file is not malicious per se, as it simply opens the calc.exe utility.
Monitoring malware abusing CVE-2020-1599