Collection Method

The certificate list below is one of the outputs of our Code Signing analysis infrastructure. We used 350K unlabeled samples from malware repositories, mainly VirusShare as input to our infrastructure. Then, it uses VirusTotal to discard any samples that are flagged by less than 4 AV engines. The list contains all the properly CA-issued certificates in our datasets. More details on our collection and analysis can be found in our paper.

Download

The certificate collection can be downloaded from here (password: infected). All certificates are in DER format. You can examine a certificate using the OpenSSL suite. For example:

 openssl x509 -inform DER -text -in 001926795f482a11cf7d39351111296a.der 

Certificates

Subject Issuer Pem Hash Serial Number Validity Period Revocation VirusTotal
CN: RealNetworks, Inc.
O: RealNetworks, Inc.
CN: Thawte Code Signing CA - G2
O: Thawte, Inc.
2a0766e09923c6a9b7cd2551af21b63e 85052720101489039981715689418689010103 2010-08-16 - 2011-08-16 -
CN: Click Yes To Enter Ltd
O: Click Yes To Enter Ltd
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
461988a7b6d29feabaf987e24f6a41ab 2051012 2003-11-25 - 2005-11-24 -
CN: Cougar Technologies B.V.
O: Cougar Technologies B.V.
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
d4f3d57a994eba80d7508761e58af2ee 48774538494184926230203512889691226631 2006-04-27 - 2008-04-25 2006-04-28 12:00:00
CN: E.C.S. International
O: E.C.S. International
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
2432abc3012fa169b96d3fbd60e192e2 4193680 2005-09-28 - 2006-09-28 -
CN: PeopleOnPage,Inc.
O: PeopleOnPage,Inc.
CN: VeriSign Class 3 Code Signing 2001 CA
O: VeriSign, Inc.
615c7c6cab2ebac53e99b34d1b4d20aa 41560126763265595051021238296103672962 2004-05-11 - 2005-05-11 -
CN: REALTIME GAMING
O: REALTIME GAMING
CN: VeriSign Class 3 Code Signing 2009-2 CA
O: VeriSign, Inc.
4c670d213573945d375944325454cd56 98457437496894829040873555841676414070 2009-10-21 - 2012-10-20 -
CN: CreativeToolbarSolutions.com
O: CreativeToolbarSolutions.com
CN: UTN-USERFirst-Object
O: The USERTRUST Network
135f852ac30ee6deb4593f3ad377870e 337080559763502679790828023157782065774 2010-08-18 - 2012-08-17 -
CN: cloudweb Inc
O: cloudweb Inc
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
adffb635ea31a1415c89fabfe56fd864 163525207161094714179781250620127579113 2010-03-25 - 2011-03-25 -
CN: CPM Media, Ltd.
O: CPM Media, Ltd.
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
3ec2db56fca1b0f4f65266ae3d5b1fee 86781228740289771489304662369422354253 2004-10-11 - 2005-10-12 -
CN: OI Software, Inc.
O: OI Software, Inc.
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
fe979680de6016f26d1326b49e698dcf 95550512404867711571273384952060664997 2010-11-30 - 2011-11-30 -
CN: Beijing Gigabit Times Technology Co., Ltd
O: Beijing Gigabit Times Technology Co., Ltd
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
89202ceb5cfbcff4630a15554970c920 159041499953943614649910890810771094985 2008-12-24 - 2011-12-24 -
CN: r.s. romanservice
O: r.s. romanservice
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
5831ee448d78c7bf7298521c02a8da23 52345062082274880105785884837998752865 2004-11-09 - 2005-11-09 -
CN: Solimba Aplicaciones S.L.
O: Solimba Aplicaciones S.L.
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
39bb4a4b249a8e5352ef35dd720d507e 91794078906698870065070158266329646525 2011-05-16 - 2013-05-15 -
CN: BOOM COMMUNICATION
O: BOOM COMMUNICATION
CN: Thawte Code Signing CA - G2
O: Thawte, Inc.
8704c4a9ef3466b8b42db55738692001 69547290129301536984949338816199473524 2010-10-22 - 2011-11-21 -
CN: Agence Exclusive
O: Agence Exclusive
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
68e25c4ae46c5de16e692021e5771eac 129167185953806814457476101105231409571 2011-01-19 - 2012-01-22 2011-10-31 00:00:00
CN: CARIMA ENTERPRISES LIMITED
O: CARIMA ENTERPRISES LIMITED
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
64d877f5ebb88fe6f8cb85c0ee39e6bb 117112801342810641285261153308877800711 2005-11-11 - 2006-11-22 -
CN: REALTIME GAMING
O: REALTIME GAMING
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
acb42ce945c9bc1246510c772f85ec86 101163860710766857434776461601490025003 2006-10-20 - 2009-10-21 -
CN: Browser Plugin
O: Browser Plugin
CN: Thawte Server CA
O: Thawte Consulting cc
7ec27930a2c1a10a7459ed772844f614 634380 2002-11-27 - 2004-11-26 -
CN: nbiz Ltd.
O: nbiz Ltd.
CN: Thawte Code Signing CA - G2
O: Thawte, Inc.
685566f5daa0300b37a707389f146205 139338687456705882560515919646782654672 2010-12-04 - 2012-02-02 -
CN: IncrediMail Ltd.
O: IncrediMail Ltd.
CN: VeriSign Class 3 Code Signing 2009-2 CA
O: VeriSign, Inc.
27b164ac8355c37ac8a6b2ef0af80443 60697203411307939196295289121946686749 2009-08-17 - 2012-09-05 -
CN: Baidu.com
O: Baidu.com
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
35bfec047b23587d2f33216ff9f61330 47234392151280369538696056814442873854 2006-07-28 - 2009-08-12 -
CN: Coulomb Limited
O: Coulomb Limited
CN: Thawte Server CA
O: Thawte Consulting cc
f12165a8fc5694f23b0427f2f4506291 594718 2002-04-26 - 2003-05-10 -
CN: SMS TELECOM LLC
O: SMS TELECOM LLC
CN: Go Daddy Secure Certification Authority
O: GoDaddy.com, Inc.
260ac518d548591f996f98720dda6fc2 21107672998424264 2011-05-19 - 2012-05-18 -
CN: Certificate Limited
O: Certificate Limited
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
59b60a8b4543a904a856b5a2890b2563 2160548 2005-03-13 - 2007-03-14 -
CN: Beijing Sohu New Era Information Technology Co.Ltd
O: Beijing Sohu New Era Information Technology Co.Ltd
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
503a11193d01911d9a5cc77b778d1e49 64197675009634634300609163035752855257 2005-07-06 - 2006-07-06 -
CN: Inbox.com, Inc
O: Inbox.com, Inc
CN: Thawte Code Signing CA - G2
O: Thawte, Inc.
c4dd9f7b8a90ab456cff2f1356985e3d 50815034621903118792355478498655307968 2011-08-29 - 2013-09-04 -
CN: TMRG, Inc.
O: TMRG, Inc.
CN: Thawte Code Signing CA - G2
O: Thawte, Inc.
063e4de35ec4e17daaf6e9d5c17deea8 82916031983777065343992100850011907476 2011-07-21 - 2013-01-11 -
CN: Everest Gaming Marketing Services
O: Everest Gaming Marketing Services
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
9d47d0e637fa8467730e678af5be0d34 33241378864123684455896438013944069422 2009-07-17 - 2011-07-17 -
CN: Certified Software
O: Certified Software
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
4a105b91a91855d8bf8c90d464065ebd 4134339 2005-03-11 - 2006-03-11 -
CN: Akorea
O: Akorea
CN: Thawte Code Signing CA - G2
O: Thawte, Inc.
d85ad1983fff81a8a07af9df9bbaa1e5 124122837917146198756781001750901559761 2011-05-19 - 2012-05-18 -
CN: SeekService.net
O: SeekService.net
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
52f0748762f418486dbfb6327ac2b1ef 79284577185928152406429594879375553741 2009-04-15 - 2011-04-15 -
CN: PPLive Corporation
O: PPLive Corporation
CN: VeriSign Class 3 Code Signing 2009-2 CA
O: VeriSign, Inc.
fc585a87e74cb48611ce162623c808d7 145314201888360177175578403070909470565 2009-11-19 - 2012-11-18 -
CN: Browser Plugin
O: Browser Plugin
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
cb6c4163247f166098680d506f54ec9b 4117872 2004-12-08 - 2006-11-26 -
CN: LogMeIn, Inc.
O: LogMeIn, Inc.
CN: VeriSign Class 3 Code Signing 2009-2 CA
O: VeriSign, Inc.
41dce3d6fc19cc40a2d437a99bb8f266 138463877573218094092972126029319250059 2009-10-06 - 2012-10-10 -
CN: Comforest SRL
O: Comforest SRL
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
cff331a9c7883fd93667576b8e3d245c 4143630 2005-04-22 - 2007-04-22 -
CN: Avenue Media N.V.
O: Avenue Media N.V.
CN: Thawte Server CA
O: Thawte Consulting cc
52f525dbb3b21c54137d19ddb3bd2e58 648312 2003-02-13 - 2005-02-12 -
CN: SJ Dream
O: SJ Dream
CN: VeriSign Class 3 Code Signing 2009-2 CA
O: VeriSign, Inc.
8e968eb6d2b4eab2cc38423d61cd4017 106617414480322905795594151132519634664 2010-03-17 - 2011-04-16 -
CN: Piscopo Michele
O: Piscopo Michele
CN: Thawte Server CA
O: Thawte Consulting cc
024a18b3e9a821dbeb28569ac40406f9 661097 2003-04-07 - 2004-04-06 -
CN: IMNetworks
O: IMNetworks
CN: VeriSign Class 3 Code Signing 2009-2 CA
O: VeriSign, Inc.
c04fcd0810925c1faad574169dfbe093 58145227121749555535600191239302267960 2009-08-10 - 2010-08-10 -
CN: Download Admin
O: Download Admin
CN: VeriSign Class 3 Code Signing 2009-2 CA
O: VeriSign, Inc.
df1449773efcdc25f49b537351b105f1 54927260980579202306984817666955991610 2010-04-03 - 2013-05-29 -
CN: WebDevAZ, Inc.
O: WebDevAZ, Inc.
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
3459ff146a6ebbf60dc0eef77dfdb76e 11561483082806740085106891567489695912 2006-08-21 - 2007-08-22 2006-08-21 00:00:00
CN: Softdeluxe
O: Softdeluxe
CN: Thawte Code Signing CA - G2
O: Thawte, Inc.
6a62986171b899b036a3c4715ef08479 4159235756949357885371392788636692749 2011-08-12 - 2013-08-11 -
CN: OOO Favorit
O: OOO Favorit
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
025909d31deed7ecb8f8778127d9593c 130821042448275071294786073016406364726 2006-02-28 - 2008-02-28 2007-09-12 23:38:50
CN: World Telecom International Inc.
O: World Telecom International Inc.
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
1ccc5e54192cfe4aac056ece9e419940 4069993 2004-04-26 - 2006-04-26 -
CN: Seekmo Technologies LLC
O: Seekmo Technologies LLC
CN: VeriSign Class 3 Code Signing 2009-2 CA
O: VeriSign, Inc.
f7f513814706b81762715d6bdfa4cc9d 58091710834263905113531382735713806003 2010-09-22 - 2012-10-02 2010-09-22 00:00:00
CN: CBIT Solutions Ltd
O: CBIT Solutions Ltd
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
9098ae53b37145e00c4aa552d55dbc8a 2129378 2004-10-04 - 2006-10-04 -
CN: Ultra Internet Media S A
O: Ultra Internet Media S A
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
9b584b247f5abadff44b26c29d16d370 167174262079563906540789975686139008315 2008-07-14 - 2009-07-17 -
CN: Free Connect Ltd
O: Free Connect Ltd
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
506177abca07bf6cac497ceafd581d78 2129298 2004-10-04 - 2006-10-02 -
CN: iCentric Corporation
O: iCentric Corporation
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
819c3f7d571e7606b0d84f1ff727d217 128912157592734936569168101924332106908 2010-11-09 - 2011-11-09 -
CN: Eorezo
O: Eorezo
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
b24f3f23e7f4c10d83147b27c834a0c7 108126443615415183728339885344379796585 2008-10-14 - 2009-10-14 -