Collection Method

The certificate list below is one of the outputs of our Code Signing analysis infrastructure. We used 350K unlabeled samples from malware repositories, mainly VirusShare as input to our infrastructure. Then, it uses VirusTotal to discard any samples that are flagged by less than 4 AV engines. The list contains all the properly CA-issued certificates in our datasets. More details on our collection and analysis can be found in our paper.

Download

The certificate collection can be downloaded from here (password: infected). All certificates are in DER format. You can examine a certificate using the OpenSSL suite. For example:

 openssl x509 -inform DER -text -in 001926795f482a11cf7d39351111296a.der 

Certificates

Subject Issuer Pem Hash Serial Number Validity Period Revocation VirusTotal
CN: Open Source Developer, Go Safer LLC
O: GO SAFER LLC
CN: Certum Level III CA
O: Unizeto Technologies S.A.
d2e7e74c42a759fce1ea63efb33bf817 115507971335376088680578972047309739840 2014-11-23 - 2015-11-23 -
CN: DataMystic
O: DataMystic
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
f689d7c23dd081585a64943519672d69 105337896571615685446845479864389938169 2008-03-07 - 2011-03-28 -
CN: LG Telecom
O: LG Telecom
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
5348ae5a621c1e288f4cefa5d0bd6393 104528337116659066469343438479024878711 2009-06-22 - 2011-07-21 -
CN: Win4NET Co., Ltd.
O: Win4NET Co., Ltd.
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
6b7439a8a300a1d60bf793bd276dc691 116632080759835289687972172203839611087 2008-07-17 - 2009-08-05 -
CN: Wuhan Aopu Information Technology Co.,Ltd
O: Wuhan Aopu Information Technology Co.,Ltd
CN: GlobalSign CodeSigning CA - G2
O: GlobalSign nv-sa
8aa36811be1d54a34c8897d5e76130a5 1492424545165055281860082158951775924480532 2013-02-19 - 2014-02-20 -
CN: Xiamen Hanyang Technology Co., Ltd.
O: Xiamen Hanyang Technology Co., Ltd.
CN: WoSign Class 3 Code Signing CA
O: WoSign eCommerce Services Limited
5bd09d548a0f7cbdb2fea71108798842 9542020377448355 2011-11-23 - 2012-11-24 -
CN: Inpa Insaat Malzemeleri Pazarlama Ve Ticaret Limited Sirketi
O: Inpa Insaat Malzemeleri Pazarlama Ve Ticaret Limited Sirketi
CN: Thawte Server CA
O: Thawte Consulting cc
363b04d7e77c542bd8281238a03a6225 657449 2003-03-18 - 2005-03-17 -
CN: G-NET INTEGRATED SERVICES CO., LTD.
O: G-NET INTEGRATED SERVICES CO., LTD.
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
3ee14c7eb90370d55e18835a12116e22 14108782848547027662186509311426657779 2012-12-12 - 2014-02-10 -
CN: Yalei Cui
O: No Organization Affiliation
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
a89a456d52bf83257a0262f5b79485bd 122279902576136472991892447661465510718 2013-04-01 - 2014-04-01 2013-07-10 00:00:00
CN: Planon B.V.
O: Planon B.V.
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
6e3b9998eb9536b7c044520f71319dfc 25485301523149696926699268564689614443 2008-04-10 - 2011-04-10 -
CN: Fujian identical insurance agent co.,Ltd
O: Fujian identical insurance agent co.,Ltd
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
38d9acd8d1fc38ea5aa77f8194129e1f 141544299176438695829340662707088338135 2011-05-22 - 2012-05-21 -
CN: Hemant Mehta
O: Brass Copper And Alloy India Ltd
CN: SafeScrypt sub-CA for RCAI Class 3 2012
O: Sify Technologies Limited
d770148f0628111d07fd73279a4fd136 1769038570439311988 2013-06-19 - 2015-06-19 -
CN: Source Medical Solutions Inc.
O: Source Medical Solutions Inc.
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
d3762f9236cd66660fb49f8ac5c7be55 130766117457520813757310368513865607990 2013-01-25 - 2014-03-26 2013-07-20 00:00:00
CN: Eyedentitygames
O: Eyedentitygames
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
bf8c0363b22bc5ed749c176212aa24de 110903159392937618675046097014290067701 2010-10-15 - 2013-10-14 -
CN: cd ingegneri associati srl
O: cd ingegneri associati srl
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
9bbf3d25dbd3d057f75628ba93612465 34838624547541670148780723488185008508 2006-12-11 - 2007-12-11 2012-02-01 00:00:00
CN: JoongangEBizCenter Co. Ltd.
O: JoongangEBizCenter Co. Ltd.
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
4151f0d5b868a3225587e5167bc921cc 164007576353607070954249520161376764405 2008-11-20 - 2010-11-20 -
CN: Aksis Biliim Teknolojileri Bilgi lem ve letiim Tic. Ltd. ti.
O: Aksis Biliim Teknolojileri Bilgi lem ve letiim Tic. Ltd. ti.
CN: DigiCert High Assurance Code Signing CA-1
O: DigiCert Inc
274640dba126ed871331ca583a7b4cec 5223139121402121320309936426296236668 2014-04-07 - 2017-06-14 2014-04-09 18:38:28
CN: The Motivo Group, Inc.
O: The Motivo Group, Inc.
CN: DigiCert Assured ID Code Signing CA-1
O: DigiCert Inc
4719f381beb01722fc01fec15c47d65f 20767842108751215036699889301168971191 2012-03-02 - 2013-03-07 2012-03-02 00:00:01
CN: Idigm
O: Idigm
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
3040bd0637757b03055d3ba7e7c745ef 78401187101493130378146067176328464209 2010-03-17 - 2011-03-17 -
CN: Blueone Technology Co., Ltd
O: Blueone Technology Co., Ltd
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
cd467782217d4ca8d72b9a4001ad67df 158456751420816219720713584153243015456 2012-12-06 - 2013-12-06 -