Collection Method

The certificate list below is one of the outputs of our Code Signing analysis infrastructure. We used 350K unlabeled samples from malware repositories, mainly VirusShare as input to our infrastructure. Then, it uses VirusTotal to discard any samples that are flagged by less than 4 AV engines. The list contains all the properly CA-issued certificates in our datasets. More details on our collection and analysis can be found in our paper.

Download

The certificate collection can be downloaded from here (password: infected). All certificates are in DER format. You can examine a certificate using the OpenSSL suite. For example:

 openssl x509 -inform DER -text -in 001926795f482a11cf7d39351111296a.der 

Certificates

Subject Issuer Pem Hash Serial Number Validity Period Revocation VirusTotal
CN: Free Software LLC
O: Free Software LLC
CN: Starfield Secure Certification Authority
O: Starfield Technologies, Inc.
2428685035e842dfc18449dd50738cb7 11220974343828710 2014-08-01 - 2015-07-22 -
CN: Vittalia Internet S.L.
O: Vittalia Internet S.L.
CN: Go Daddy Secure Certification Authority
O: GoDaddy.com, Inc.
1e3e3b2c5a6f0d0c6a4b3b643fb3bb88 11125284052312014 2014-07-31 - 2015-02-06 -
CN: Vittalia Limited
O: Vittalia Limited
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
7d8c1da72cd9ea10b98f80e8126b7c28 144599528638463423008457182698915729580 2013-05-18 - 2016-05-17 -
CN: Free Software LLC
O: Free Software LLC
CN: Go Daddy Secure Certification Authority
O: GoDaddy.com, Inc.
9518f265e91ad574efdb85a26f18735b 12127159616181619 2014-07-22 - 2015-07-22 2014-08-04 10:10:37
CN: Onekit Internet S,L
O: Onekit Internet S,L
CN: GlobalSign CodeSigning CA - G2
O: GlobalSign nv-sa
178e34c56d0980a0c6773f3a6afa6fcc 1492282293267802143186755051034590173705512 2013-04-15 - 2016-05-18 -
CN: Meta Installer LLC
O: Meta Installer LLC
CN: Starfield Secure Certification Authority
O: Starfield Technologies, Inc.
e50e7ef1b6eac2ec3bb187c25ec96f4b 11194387382776164 2014-07-22 - 2015-02-16 -
CN: Free Installer LLC
O: Free Installer LLC
CN: DigiCert Assured ID Code Signing CA-1
O: DigiCert Inc
f634984c9e9a1f4244b115ed7a9170ef 15348467009276672077198154454109014412 2013-08-29 - 2016-09-02 2014-07-17 13:30:43
CN: Microgaming Software Systems Limited
O: Microgaming Software Systems Limited
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
dcb24f7f225745d03b2efe7d17da74d1 98212442462870218283371684947319348427 2008-01-21 - 2009-02-07 -
CN: Vittalia Internet S.L.
O: Vittalia Internet S.L.
CN: Go Daddy Secure Certification Authority
O: GoDaddy.com, Inc.
faeedeb266cb65312b933268cbadcf25 12142599881232326 2014-02-06 - 2015-02-06 2014-07-25 11:20:35
CN: Vittalia Internet S.L.
O: Vittalia Internet S.L.
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
cdeb0d7d60b8d773e704b8a9e2cf1a33 161266571557645704633975025130967497312 2012-06-05 - 2013-05-08 2013-03-22 00:00:00
CN: Vittalia Internet S.L
O: Vittalia Internet S.L
CN: GlobalSign CodeSigning CA - G2
O: GlobalSign nv-sa
a51c93481332ca6aeda1f07c23c72a3b 1492193248378120731006725997877633896403247 2014-07-09 - 2015-08-09 -
CN: Vittalia Internet S.L.
O: Vittalia Internet S.L.
CN: Starfield Secure Certification Authority
O: Starfield Technologies, Inc.
598c05ff93c7751a4d0fa243930ae33a 1153324993130001 2014-07-22 - 2015-02-06 2014-08-03 11:10:35
CN: Formula EFT Europa S.L.
O: Formula EFT Europa S.L.
CN: DigiCert Assured ID Code Signing CA-1
O: DigiCert Inc
032da1d672b152a1fe994fe7b06a5ffb 16444105193229435658509626614163778533 2013-11-19 - 2014-11-26 2014-07-17 13:30:20
CN: Vittalia Internet S.L.
O: Vittalia Internet S.L.
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
3b419a0092dfc5f283125719dfc9ce1f 943405809743481458463615994958442010 2012-10-01 - 2015-10-01 -
CN: 100Blogs SL
O: 100Blogs SL
CN: Go Daddy Secure Certificate Authority - G2
O: GoDaddy.com, Inc.
6af465ac5769ddf9e8807808987b30cf 12265138875178129 2013-10-14 - 2016-10-14 2014-07-10 09:20:35
CN: Citrix Online
O: Citrix Online
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
d51561b0780a3241323753a4e6678655 142006457604472944633198825016627605105 2006-05-16 - 2009-06-26 -
CN: JANDER PINTO DA SILVA
O: No Organization Affiliation
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
1d719598ca92be358e10117cdacc7092 42237654546784922677767218874785253943 2013-09-13 - 2014-09-12 2013-09-13 00:00:00
CN: Winner Solutions LLC
O: Winner Solutions LLC
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
58589a428d054efff16e138a76b8af08 131286083146268640715230407808604674758 2013-12-09 - 2015-12-09 2013-12-09 00:00:00
CN: Microgaming Software Systems Limited
O: Microgaming Software Systems Limited
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
d857a607db90c1b258780d32ab5fe5f1 149515238010847218949757998699699524117 2009-02-12 - 2011-02-07 -
CN: Media Labs Limited
O: Media Labs Limited
CN: COMODO Code Signing CA
O: COMODO CA Limited
6e676ed6a291281766c5e1158d71207e 178928762916445914411213625977621769664 2011-06-08 - 2012-06-07 -
CN: Software Updater LLC
O: Software Updater LLC
CN: Go Daddy Secure Certificate Authority - G2
O: GoDaddy.com, Inc.
d85ae8dba90c109f2305fe4e3a97e3f2 12222918599886234 2014-01-13 - 2016-06-21 -
CN: Control-F1
O: Control-F1
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
76a74e04d2178bd9334328e080446f92 4126821 2005-02-04 - 2007-02-13 -
CN: Syncopate LLC
O: Syncopate LLC
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
7445abd36c26fb5227bed157cfa5aab6 160696463459887586697160927902227065120 2011-10-10 - 2013-10-09 -
CN: RBMF TECHNOLOGIES LLC
O: RBMF TECHNOLOGIES LLC
CN: Starfield Secure Certificate Authority - G2
O: Starfield Technologies, Inc.
497b7717e611cf1ab42917ec1ae280f9 1154523665860425 2014-04-02 - 2015-04-02 2014-06-09 16:10:37
CN: CJCS InvestService
O: CJCS InvestService
CN: Thawte Code Signing CA - G2
O: Thawte, Inc.
77f427a46bc38a02824dd47422d8fe39 137251235736741125642129583801220900969 2012-07-17 - 2013-07-17 -
CN: Quick Downloader
O: Quick Downloader
CN: COMODO Code Signing CA 2
O: COMODO CA Limited
019b4f07afd51a0d0b25859b9b9d0441 181348513317083051998536533740868361801 2013-08-08 - 2014-08-08 -
CN: PeopleOnPage, Inc.
O: PeopleOnPage, Inc.
CN: VeriSign Class 3 Code Signing 2001 CA
O: VeriSign, Inc.
60965b9ce07b21d9ffb857b6af10f481 127001149643471473849371354411238117332 2003-05-14 - 2004-05-13 -
CN: Artua Vladislav
O: Artua Vladislav
CN: UTN-USERFirst-Object
O: The USERTRUST Network
02f3ab9fc7522992dc96c8cae8bd0648 63980834597757907199422716136913024902 2011-03-15 - 2012-03-14 -
CN: uSky LLC
O: uSky LLC
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
60f4ce6936287786dbfa0b1a9c7687d0 65088723819439148916579590137344855269 2005-07-15 - 2006-07-15 -
CN: DialerPlatform Limited
O: DialerPlatform Limited
CN: Thawte Server CA
O: Thawte Consulting cc
ee8092fe03e41cc51d33e02f75c6a960 663208 2003-04-09 - 2005-04-08 -
CN: appbundler.com
O: appbundler.com
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
8089b56a8d7bfef89634ecbea68fa0c1 7842669457238823271169376357485979424 2010-12-22 - 2012-12-21 2010-12-22 00:00:00
CN:
O: VeriSign Trust Network
CN:
O: VeriSign Trust Network
9e0b45bf80b7ff9b22f2b54927f37684 98496942895826495485766746947989658787 1997-05-12 - 2004-01-07 -
CN: Softonic International
O: Softonic International
CN: VeriSign Class 3 Code Signing 2009-2 CA
O: VeriSign, Inc.
05bf8a56836988725be925d2b1e52858 149529892564832938315111389134863470632 2009-09-07 - 2011-09-07 -
CN: Tencent Technology(Shenzhen) Company Limited
O: Tencent Technology(Shenzhen) Company Limited
CN: VeriSign Class 3 Code Signing 2009-2 CA
O: VeriSign, Inc.
ee5c67e1758f2eda94d766754a48895b 123652135525917983623353396121704302000 2010-01-26 - 2013-01-25 -
CN: Pinball Corporation.
O: Pinball Corporation.
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
270818bc4c3e531f7130b696bdd1886b 106227687155951478833806843957606947866 2009-05-19 - 2011-05-19 2009-05-19 00:00:00
CN: CBS Interactive, Inc.
O: CBS Interactive, Inc.
CN: DigiCert High Assurance Code Signing CA-1
O: DigiCert Inc
e99d080e0860e04ee6ecf5477db8b472 2678311670760884116661167238539915968 2011-07-09 - 2013-07-12 -
CN: DigiCert Assured ID CA-1
O: DigiCert Inc
CN: DigiCert Assured ID Root CA
O: DigiCert Inc
63e40bfb33e553bf6c8f8abf81e760d4 13317574773167330998863222904285319401 2006-11-10 - 2021-11-10 -
CN: Pinball Corporation.
O: Pinball Corporation.
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
2e83353bba2d94f07269a07dd25c155c 46380766082159162510232718908405764405 2011-04-01 - 2013-05-19 2011-04-01 00:00:00
CN: Eorezo
O: Eorezo
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
7f56e826410fbbeb233236e32b719a03 37778166179159225454017428842981772915 2010-10-12 - 2012-10-13 2011-11-30 20:35:46
CN: DoubleD Advertising Limited
O: DoubleD Advertising Limited
CN: UTN-USERFirst-Object
O: The USERTRUST Network
2c90ad766cd50f0c9fb1b946901cd624 108493655090972581690695673067397616339 2009-01-21 - 2010-01-21 -
CN: Inffinity Internet
O: Inffinity Internet
CN: Thawte Code Signing CA - G2
O: Thawte, Inc.
8195065aac7b6223822988e29d1416bd 162305839323319667938678415814370118238 2011-05-15 - 2012-05-14 -
CN: Softonic International
O: Softonic International
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
e0da068c9818efad60e149a247864dd6 56278232838619597542426542178624282210 2011-09-02 - 2013-09-06 -
CN: Venisoft Corp.
O: Venisoft Corp.
CN: Thawte Code Signing CA - G2
O: Thawte, Inc.
fc2abb121ade6c359868f78466ba39f6 22768930934635994527359941159286832263 2010-11-03 - 2012-01-02 -
CN: USENET
O: USENET
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
441224fbb7e1071c106cbd225b22044e 25743497757407571706949248243973633124 2011-04-01 - 2012-03-31 2011-04-01 00:00:00
CN: SoGe Interactive LLC
O: SoGe Interactive LLC
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
2e65953ba72eead4409cad855d6bb606 73956473355713814343183678395282433677 2010-12-04 - 2012-12-03 -
CN: CARIMA ENTERPRISES LIMITED
O: CARIMA ENTERPRISES LIMITED
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
6368dbc7ddc72469fdfa28e3a774b602 121391582401922941890159573260002310357 2004-10-19 - 2005-11-19 -
CN: New Dial spa
O: New Dial spa
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
c3d2dbf41ab960caf118fa67e51c4835 2153552 2005-02-02 - 2006-03-05 -
CN: CBS Interactive
O: CBS Interactive
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
08eda28df1eec1009c9a04742eb85d98 9441989094762762358121366741086761141 2011-08-05 - 2013-08-04 -
CN: All trade s.r.l.
O: All trade s.r.l.
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
6ccea607a588eb9ec945466284a0f14a 2093816 2004-05-03 - 2005-05-03 -
CN: EpicPlay LLC
O: EpicPlay LLC
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
54d26e61744990970e55a70e0b8cdbdd 113206530904002966128606696416708919529 2011-08-15 - 2012-08-14 2011-08-15 00:00:00