Collection Method

The certificate list below is one of the outputs of our Code Signing analysis infrastructure. We used 350K unlabeled samples from malware repositories, mainly VirusShare as input to our infrastructure. Then, it uses VirusTotal to discard any samples that are flagged by less than 4 AV engines. The list contains all the properly CA-issued certificates in our datasets. More details on our collection and analysis can be found in our paper.

Download

The certificate collection can be downloaded from here (password: infected). All certificates are in DER format. You can examine a certificate using the OpenSSL suite. For example:

 openssl x509 -inform DER -text -in 001926795f482a11cf7d39351111296a.der 

Certificates

Subject Issuer Pem Hash Serial Number Validity Period Revocation VirusTotal
CN: Gamevance LLC
O: Gamevance LLC
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
8f57a2809f278cfa593d1b78b4db00e6 142410686467962611121030925465826201269 2008-05-07 - 2009-05-07 -
CN: rhinostore nv
O: rhinostore nv
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
c5d5e18d995e6a7a89b3ea97656f8180 2140461 2004-11-24 - 2005-11-24 -
CN: ANGROD TRADING S.A.
O: ANGROD TRADING S.A.
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
1a1a59b64beb10e1ec6da9b0f8fd049a 2080013 2004-03-18 - 2006-03-18 -
CN: Weather Studio
O: Weather Studio
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
e51679a335108925936d457b9942939d 63071825910453560120870591780380349375 2005-07-27 - 2006-07-27 -
CN: Open Software Trust Group Co.
O: Open Software Trust Group Co.
CN: UTN-USERFirst-Object
O: The USERTRUST Network
cabffb1a2953d18e48825a326df7e81f 228860172511251550966799708907403442796 2011-03-18 - 2012-03-17 -
CN: Blinkx
O: Blinkx
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
8f643c748691c6398ae3716a2aa45703 120254485698899632130288099016059404431 2008-05-14 - 2011-05-14 -
CN: Ctlh China Co.,Ltd
O: Ctlh China Co.,Ltd
CN: VeriSign Class 3 Code Signing 2009-2 CA
O: VeriSign, Inc.
593a76af136ab00adf6298733a456b7a 20618005411498761920595793144795068339 2009-07-22 - 2010-07-22 -
CN: Athena IT Limited
O: Athena IT Limited
CN: COMODO Code Signing CA 2
O: COMODO CA Limited
b9528d819f8c883d079a94a2fdcbb73e 64278320751591933492403449141584320255 2011-10-05 - 2012-10-04 2011-12-11 19:38:35
CN: Sogou.com
O: Sogou.com
CN: VeriSign Class 3 Code Signing 2009-2 CA
O: VeriSign, Inc.
caf8dc540cf470dde9a2e36da72e3075 152631744564332690602852416893087000742 2009-07-10 - 2012-07-14 -
CN: Coulomb Limited
O: Coulomb Limited
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
41d3420c1157ea4ca57b5b1e6089f324 4074033 2004-05-10 - 2006-05-09 -
CN: Avenue Media N.V.
O: Avenue Media N.V.
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
f087a9c151f208e612bcdc0216305991 4133740 2005-03-10 - 2007-02-12 -
CN: ZinkSeek.com
O: ZinkSeek.com
CN: UTN-USERFirst-Object
O: The USERTRUST Network
a3e69645b3d753905f36b9f16f28d0d5 312761255840499820343480856101969386812 2010-05-26 - 2012-05-25 -
CN: Ammyy Group
O: Ammyy Group
CN: UTN-USERFirst-Object
O: The USERTRUST Network
b622dee34b6b9d0b61487e40c3affcb9 195309528493485511015803768638856277355 2009-06-05 - 2010-06-05 -
CN: Arcadeweb LLC
O: Arcadeweb LLC
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
f47c7c60d65be0873f32edc40bcdf845 8348881408821590389062969502056125961 2010-10-26 - 2011-10-26 -
CN: TGSM Inc.
O: TGSM Inc.
CN: Thawte Code Signing CA - G2
O: Thawte, Inc.
318b35170aa190e2e8dfa4937e284260 107753919003775911517096927719611083382 2011-02-11 - 2012-03-12 -
CN: NetEase Youdao Information Technology (Beijing) Co.,Ltd.
O: NetEase Youdao Information Technology (Beijing) Co.,Ltd.
CN: VeriSign Class 3 Code Signing 2009-2 CA
O: VeriSign, Inc.
fec995d31f04579ddf5ec80c4d529650 69886398088442865193345714955690731959 2010-07-30 - 2012-08-28 -
CN: Info Products Corp.
O: Info Products Corp.
CN: VeriSign Class 3 Code Signing 2001 CA
O: VeriSign, Inc.
7249ab3df01d312ad75ad3d1295772ec 145477231489758126949068958595892341098 2004-08-26 - 2005-08-27 -
CN: Inet-Traffic Inc.
O: Inet-Traffic Inc.
CN: Thawte Server CA
O: Thawte Consulting cc
4d3f960b7620cac2d5f16f1164b74f63 2010648 2003-07-22 - 2004-06-18 -
CN: Yes Limited
O: Yes Limited
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
3c3503e91f6834a640f8acc67dd928c3 2167114 2005-04-14 - 2007-04-14 -
CN: Qizhi Software (beijing) Co. Ltd
O: Qizhi Software (beijing) Co. Ltd
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
9afd3cd799eb2df1123556b8da230e96 129246501703431098414123298094276048219 2006-11-24 - 2008-11-23 -
CN: Ultra Internet Media S A
O: Ultra Internet Media S A
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
f5f94f2eeec40b212044c61dae936940 113611464469698700946212126314353519837 2007-06-28 - 2008-07-17 -
CN: sovinsky llc
O: sovinsky llc
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
b52444cfe59c72e4ad33ede3ccdc72de 95076931428546427047577481411871165530 2008-11-24 - 2009-11-24 2009-03-24 15:41:11
CN: Great-PC-Software
O: Great-PC-Software
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
d54a35d77331b674609b520024aa94b0 2090873 2004-04-22 - 2005-04-22 -
CN: Alibaba Software(Shanghai)Co,. Ltd
O: Alibaba Software(Shanghai)Co,. Ltd
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
ea9810d02044565497c59793783e0848 88361198082782153690633587496890849793 2008-04-24 - 2009-05-09 -
CN: PhonCom s.r.l.
O: PhonCom s.r.l.
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
0fc36f6676cdfab9dc157814a60a7f59 2072552 2004-02-20 - 2005-02-19 -
CN: The Good Download Corp.
O: The Good Download Corp.
CN: Thawte Server CA
O: Thawte Consulting cc
9c78c75b904610e31420abf9698468b1 671487 2003-05-22 - 2004-05-02 -
CN: ROCKETMEDIA s.r.l.
O: ROCKETMEDIA s.r.l.
CN: VeriSign Class 3 Code Signing 2001-4 CA
O: VeriSign, Inc.
e02e0b861f24f3105997857aa15a0b15 43787217012655451599318685890168684120 2002-03-25 - 2003-03-25 -
CN: simbondCo., LTD
O: simbondCo., LTD
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
88a112005daf055723720ae116bba2ee 40396984545792323731886414578303743638 2011-05-13 - 2012-05-12 -
CN: Beijing BeiXinYuan Automatic Technology Corporation Limited
O: Beijing BeiXinYuan Automatic Technology Corporation Limited
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
6269be83bf0a404185e887b5388571e0 125282594397412769963927481297222201579 2008-12-18 - 2011-12-18 -
CN: CyberLink
O: CyberLink
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
04a0905804563f5b84d22623acd2760d 74205468407821000774598859179735084383 2009-02-17 - 2012-04-12 -
CN: Petro-Line Ltd.
O: Petro-Line Ltd.
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
c595cf233351e156093e2a73257337e9 2146435 2004-12-22 - 2005-12-22 -
CN: Microdotkr
O: Microdotkr
CN: Thawte Code Signing CA - G2
O: Thawte, Inc.
6230993be4ea55f920921ef140a203c6 115962067281593686026042515606515859193 2011-07-08 - 2012-07-07 -
CN: QueryExplorer.com
O: QueryExplorer.com
CN: UTN-USERFirst-Object
O: The USERTRUST Network
e75016a47c7b95aff0cd7c1562e1202c 272513895243217544099068584632644051661 2010-06-23 - 2012-06-22 -
CN: YNK JAPAN Inc
O: YNK JAPAN Inc
CN: VeriSign Class 3 Code Signing 2009-2 CA
O: VeriSign, Inc.
0f69c80c8a7038f6590fb0aebeaee1a3 137098462036037060268755225091955343437 2009-11-27 - 2011-11-27 2010-04-12 00:00:00
CN: E-ventures N.V.
O: E-ventures N.V.
CN: Thawte Server CA
O: Thawte Consulting cc
783e7d040b1be2b5a9a30c0816a7bb67 654844 2003-03-10 - 2004-03-17 -
CN: The Search Co.,Ltd
O: The Search Co.,Ltd
CN: Thawte Code Signing CA - G2
O: Thawte, Inc.
c11f1f24cd7dce20378e9ed3caf18a5c 140555124869464424423237305020680779472 2011-04-28 - 2012-05-27 -
CN: Bandoo Media Inc
O: Bandoo Media Inc
CN: Thawte Code Signing CA - G2
O: Thawte, Inc.
a291688558ebbb7e6ba446d1fade6ea6 118414492353422223036990820278132930805 2010-10-06 - 2012-10-05 -
CN: New Dial spa
O: New Dial spa
CN: Thawte Server CA
O: Thawte Consulting cc
616391765db74838dd15dd27c95aa249 654120 2003-03-06 - 2004-03-05 -
CN: Xiamen Huayu Network Technology Co., Ltd.
O: Xiamen Huayu Network Technology Co., Ltd.
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
3effbd68d903378dca85988ac8063569 153906617101438866116317677149797307663 2008-05-14 - 2009-05-14 -
CN: OPEN.co., ltd
O: OPEN.co., ltd
CN: Thawte Code Signing CA - G2
O: Thawte, Inc.
a6a6bc250b779a0e84844cd8c1dd4c2a 144195402202530361253928345012804410242 2010-11-11 - 2011-12-11 -
CN: 888 Holdings PLC
O: 888 Holdings PLC
CN: Thawte Code Signing CA - G2
O: Thawte, Inc.
df47bae36154ced32659d8b0dfb29024 18147593280847197622236129991058595195 2011-05-31 - 2013-07-29 -
CN: Zwangie.com
O: Zwangie.com
CN: UTN-USERFirst-Object
O: The USERTRUST Network
1beaf016341844cbeae3b9af43adcec3 241768466466251710998077117090844437004 2009-09-17 - 2011-09-17 -
CN: DGnetworks
O: DGnetworks
CN: VeriSign Class 3 Code Signing 2009-2 CA
O: VeriSign, Inc.
4f2116a631633e2aeb0007e5a9e31409 557752385918078891147137523645401325 2010-01-26 - 2011-01-26 -
CN: OF.PL sp. z o.o.
O: OF.PL sp. z o.o.
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
bf6db9ce881c4874e9b5c2f83111355f 4021873 2003-10-24 - 2004-10-23 -
CN: Integrated Search Technologies
O: Integrated Search Technologies
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
cdbe29973b06cff7fd7c65a70c8671db 2149107 2005-01-11 - 2007-02-10 -
CN: Zugo Ltd
O: Zugo Ltd
CN: UTN-USERFirst-Object
O: The USERTRUST Network
e5cf514e5a1a8a1e01e6a031c2759de6 93233467916594042088849949357578449577 2011-01-28 - 2013-01-27 -
CN: PeopleOnPage, Inc.
O: PeopleOnPage, Inc.
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
b4f96373d71ea61efbcd2f45499d5065 103394708147018693022783591273762709716 2005-04-29 - 2006-04-30 -
CN: BrowserDiscover.com
O: BrowserDiscover.com
CN: UTN-USERFirst-Object
O: The USERTRUST Network
7d34b76e9f8add6eaf0320ae605bc7e4 108591869364154071921734904423844083538 2009-12-30 - 2011-12-30 -
CN:
O:
CN: WoSign Code Signing Authority
O: WoSign, Inc.
fab01a9118b08f96bc9b37be26e1e76a 151977737807594104211415720157242076012 2011-03-02 - 2014-03-01 -
CN: Webtronix Holdings Ltd
O: Webtronix Holdings Ltd
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
b2fb1d73a89eb1e5ebe3f4f01beaab1b 2065465 2004-01-28 - 2005-01-27 -