Collection Method

The certificate list below is one of the outputs of our Code Signing analysis infrastructure. We used 350K unlabeled samples from malware repositories, mainly VirusShare as input to our infrastructure. Then, it uses VirusTotal to discard any samples that are flagged by less than 4 AV engines. The list contains all the properly CA-issued certificates in our datasets. More details on our collection and analysis can be found in our paper.

Download

The certificate collection can be downloaded from here (password: infected). All certificates are in DER format. You can examine a certificate using the OpenSSL suite. For example:

 openssl x509 -inform DER -text -in 001926795f482a11cf7d39351111296a.der 

Certificates

Subject Issuer Pem Hash Serial Number Validity Period Revocation VirusTotal
CN: Digital Media Developers Inc.
O: Digital Media Developers Inc.
CN: GlobalSign ObjectSign CA
O: GlobalSign nv-sa
ee6a0cec830707b4b99804676106891c 1208925819615783252105608 2006-07-28 - 2007-07-28 -
CN: ezeSoftware Ltd
O: ezeSoftware Ltd
CN: UTN-USERFirst-Object
O: The USERTRUST Network
05695df2ccba57267096b6e6b3d6e54e 119623273871319986655896922168899243002 2005-09-29 - 2007-09-29 -
CN: Exent Technologies Ltd.
O: Exent Technologies Ltd.
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
cdb1154214f429ac2d3adbd3dfd37013 6668902650302096381437273381621015012 2011-03-30 - 2014-04-19 -
CN: MicroNames Ltd.
O: MicroNames Ltd.
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
88f7af2e2420897e9fbec0429b89bb12 133722774138340405643347766503002400218 2009-09-25 - 2011-11-24 -
CN: EliteCom LLC
O: EliteCom LLC
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
fa01f1b45cd1446fa6d1455a43d3f3c7 17648243442273880170737973474485601225 2011-05-24 - 2012-05-23 -
CN: WhiteSmoke Inc
O: WhiteSmoke Inc
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
cadc226d4b3ab5830d46440841dd8c65 88233674940893840313072753578898542177 2008-06-10 - 2011-07-08 2010-09-17 00:00:00
CN: ShopAtHome.com
O: ShopAtHome.com
CN: VeriSign Class 3 Code Signing 2009-2 CA
O: VeriSign, Inc.
0a09964612aa70ba83138e6271537b7a 34960938066778902776064751399913241592 2009-05-28 - 2010-06-22 -
CN: 180solutions
O: 180solutions
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
0457a1892fd48fddb842d7a09ec2aa16 105205465552985193846491811469315290602 2005-02-03 - 2006-02-03 -
CN: IBIS LLC
O: IBIS LLC
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
a24c9eb43851814954f912483fb3741f 142258845473865932742313065228964829729 2005-06-27 - 2006-07-18 -
CN: Zero-Knowledge Systems Inc.
O: VeriSign, Inc.
CN:
O: VeriSign, Inc.
659ace500c3faa7150bcb4dac55869d0 57802875942598435135768753651312254755 1999-02-04 - 2000-02-04 -
CN: Alot.com
O: Alot.com
CN: VeriSign Class 3 Code Signing 2009-2 CA
O: VeriSign, Inc.
b26d5205dceeddd8127ce38fc023fcdb 19595733491878044299686421103151305624 2010-06-14 - 2013-06-20 -
CN: DialerPlatform Limited
O: DialerPlatform Limited
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
10ef235f6095455dafb8aea552d82d96 4132798 2005-03-07 - 2007-04-08 -
CN: DoubleD Advertising Limited
O: DoubleD Advertising Limited
CN: UTN-USERFirst-Object
O: The USERTRUST Network
6e2cdc2b92e9a6da13152c9a17843c54 268180849400325023686305827067492191639 2008-01-10 - 2009-01-09 -
CN: EDIPOLE
O: EDIPOLE
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
97b24f956361df07da1cacff42c4ee6d 2074296 2004-02-26 - 2005-02-20 -
CN: IBIS LLC
O: IBIS LLC
CN: VeriSign Class 3 Code Signing 2001 CA
O: VeriSign, Inc.
a11f03404dc840353092f434c290d872 104970460904250146419914961217078155153 2004-07-07 - 2005-07-07 -
CN: Crazywinnings Inc.
O: Crazywinnings Inc.
CN: VeriSign Class 3 Code Signing 2001 CA
O: VeriSign, Inc.
7839b9340cbdea27f062e4bc4122188e 3104521496520992978214637091843161645 2004-06-23 - 2005-06-23 -
CN: Bullet Media Inc
O: Bullet Media Inc
CN: GlobalSign CodeSigning CA - G2
O: GlobalSign nv-sa
ca980246d7226c2b2a5613db9729ed7e 1492405293614184606784574614150520440775844 2011-10-27 - 2012-10-27 -
CN: Saristar Ltd.
O: Saristar Ltd.
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
cd7f5a39ca923822fa53409a5eaa4bb3 2115586 2004-07-21 - 2005-07-21 2009-06-10 13:43:11
CN: CARIMA ENTERPRISES LIMITED
O: CARIMA ENTERPRISES LIMITED
CN: VeriSign Class 3 Code Signing 2001 CA
O: VeriSign, Inc.
7ff4d2a771b813e9ed93e046e129a23b 72423268034084107092410173930612760333 2003-11-19 - 2004-11-18 -
CN: Play Turtle LLC
O: Play Turtle LLC
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
be109e763053bc82c5ea2b90bdab5670 125458043131981046541940005029551956560 2011-07-13 - 2013-07-12 -
CN: one2bill GmbH
O: one2bill GmbH
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
fa51054352618391e31d6e096fd79bce 4108152 2004-10-12 - 2006-10-12 -
CN: WhiteSmoke Inc
O: WhiteSmoke Inc
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
24a3638b48a5177d504df3ba9f46f8fd 132946437695061540631541936865262534883 2011-06-29 - 2013-07-07 -
CN: Macrovision
O: Macrovision
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
920e30b8c69ef4540171790bc0b1a981 43054427736359396885111274551486446540 2006-09-21 - 2009-09-20 -
CN: DREAMGROUP
O: DREAMGROUP
CN: UTN-USERFirst-Object
O: The USERTRUST Network
c5ade6319cc0352ff788c2257ef940c7 174079301707248875523219805388911475570 2006-11-03 - 2008-11-02 -
CN: Coulomb Limited
O: Coulomb Limited
CN: Thawte Server CA
O: Thawte Consulting cc
94ca47d037b619756597e0f37529ad55 1021252 2001-04-12 - 2002-05-10 -
CN: iBryte
O: iBryte
CN: VeriSign Class 3 Code Signing 2009-2 CA
O: VeriSign, Inc.
969b4a5f8dfe44e3e377feae56fdca11 121184277486732048921768119593368402675 2010-06-17 - 2012-06-16 -
CN: FAST TRACK Sp. zo. o.
O: FAST TRACK Sp. zo. o.
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
8299c11d3de6051a86fc53fdd40095ca 79146119044942240973265780463452009508 2006-01-13 - 2008-01-13 -
CN: IPO Communications
O: IPO Communications
CN: COMODO Code Signing CA
O: COMODO CA Limited
9dea0ab2f94ca8d60261596f59051e9d 182053836743587696593517919782619318772 2011-07-07 - 2012-07-06 -
CN: Mindspark Interactive Network
O: Mindspark Interactive Network
CN: VeriSign Class 3 Code Signing 2009-2 CA
O: VeriSign, Inc.
eaeccf9fe5af5f75d1fbd61473f5182b 86997231834086179368747303956159331126 2010-05-31 - 2012-05-06 -
CN: nbiz Ltd.
O: nbiz Ltd.
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
396c051aad0e511ed7877b005d44e9d8 68835818859164549758201731777532892170 2009-11-17 - 2010-12-17 -
CN:
O:
CN: WoSign Code Signing Authority
O: WoSign, Inc.
e3fbcb48b4709f544cb8179c5781f803 192146584398235629377999757467847725335 2009-12-10 - 2010-12-10 -
CN: OPEN.co., ltd
O: OPEN.co., ltd
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
043135a29fc2b82a46da5b3fc8e23045 139054659036014238841380107369374836856 2009-11-20 - 2010-11-20 -
CN: BetterInternet
O: BetterInternet
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
7d4bc48a08564ef7c495c99f552ba5e8 4081344 2004-06-01 - 2006-05-29 -
CN: ShopAtHome.com
O: ShopAtHome.com
CN: VeriSign Class 3 Code Signing 2009-2 CA
O: VeriSign, Inc.
9b71fd350c4dcb99214b68fbb1dba14c 8231905050867701258063656996160477380 2010-05-26 - 2013-06-21 -
CN: Gemius S.A.
O: Gemius S.A.
CN: Thawte Code Signing CA - G2
O: Thawte, Inc.
76c50ec7c49dd64e3b001304b6dc4df9 126638671470392583825332203532801404494 2011-03-18 - 2013-04-16 -
CN: RealNetworks, Inc.
O: RealNetworks, Inc.
CN: Thawte Code Signing CA - G2
O: Thawte, Inc.
0a068ca3b934974ac808896db216dc29 91847346262652014402022139004735117371 2011-08-03 - 2013-08-15 -
CN: UCF
O: UCF
CN: Thawte Code Signing CA - G2
O: Thawte, Inc.
88336e10658fa6f613fad7675fd61eef 19843497665085365968631816446361233837 2011-05-18 - 2012-05-17 2011-11-29 19:22:02
CN: Shanghai Zhongyuan Networks limited
O: Shanghai Zhongyuan Networks limited
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
3d9a9d3c2770f16ce5a56e37e17d5b6a 112882578749804884295956885976298251507 2006-07-10 - 2007-07-10 -
CN: Inter Technologies Ltd.
O: Inter Technologies Ltd.
CN: UTN-USERFirst-Object
O: The USERTRUST Network
b32e6a8903639303002244459f8dfdd2 718434157054860241044803256734123496 2006-02-10 - 2007-02-10 -
CN: JE communication
O: JE communication
CN: Thawte Code Signing CA - G2
O: Thawte, Inc.
efda930a6fd008866a4e5f7acb9e9934 142090173230647014322154950584774363987 2011-08-15 - 2012-10-13 2011-11-29 19:22:04
CN: CPM Media, Ltd.
O: CPM Media, Ltd.
CN: VeriSign Class 3 Code Signing 2001 CA
O: VeriSign, Inc.
4238c8504d1cfe216a98a1a2df0d8bb0 80005892645623972542535242750315426072 2003-09-26 - 2004-10-07 2013-06-03 19:27:46
CN: Odysseus Marketing Inc
O: Odysseus Marketing Inc
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
a6ec5dd7bce2ad64e694a0ad969f29ae 110864494586148617669576287100056854802 2004-11-09 - 2005-06-29 -
CN: ResultUrl.com
O: ResultUrl.com
CN: UTN-USERFirst-Object
O: The USERTRUST Network
da845e0e6deb0e1bb0d609c714052c47 159761416841259972033100317584970892003 2010-08-18 - 2012-08-17 -
CN: KAS NET
O: KAS NET
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
291d84b2804d44793d820af1431fbf1c 4157064 2005-06-03 - 2007-06-03 2006-02-23 14:13:39
CN: WorldToStart B.V.
O: WorldToStart B.V.
CN: GlobalSign ObjectSign CA
O: GlobalSign nv-sa
648002a6e2970b957ff1ac2083d92d20 1208925819615756306050266 2005-09-19 - 2006-09-19 -
CN: Qool Aid, LLC
O: Qool Aid, LLC
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
b5323557d6c9c5a3d13922cbd2fc92b0 46130494923032993205914571622631087920 2005-06-27 - 2006-06-27 -
CN: LogMeIn, Inc.
O: LogMeIn, Inc.
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
e7fed4ed2d5f2ca2f25414d64f975639 20961545911633517738101835062837973233 2006-10-12 - 2009-10-11 -
CN: NN Group Global Services Inc
O: NN Group Global Services Inc
CN: UTN-USERFirst-Object
O: The USERTRUST Network
88807c379a29a0328a4473d7e6cb3a36 52741453348185540872021917327754246763 2011-02-25 - 2012-02-25 -
CN: Mainpean - GmbH
O: Mainpean - GmbH
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
7aa4048c2ddd2b8785a082ebe5107ae5 2137827 2004-11-12 - 2005-12-06 -
CN: PlaySushi.com
O: PlaySushi.com
CN: VeriSign Class 3 Code Signing 2009-2 CA
O: VeriSign, Inc.
bdf77bc687d4f26f4d8d0fb79d9fdabf 34629554726980657474530253910279456751 2010-03-16 - 2011-03-17 -