Here's how the Flame malicious update module signature looks like.