Signature validation bypass via whole-file hashing

Improper signature verification in Trail of Bits uthenticode 1.0.9 allows attackers to make modified PE files appear valid via crafted files. The calculate_checksum function hashes contiguous file bytes instead of PE sections ordered by their raw-data offsets, allowing a crafted layout to exclude modified code from the effective digest. Exploitation requires a consuming application to accept an attacker-supplied PE and trust uthenticode's result, allowing malicious code to retain an apparently valid signature.