Collection Method

The certificate list below is one of the outputs of our Code Signing analysis infrastructure. We used 350K unlabeled samples from malware repositories, mainly VirusShare as input to our infrastructure. Then, it uses VirusTotal to discard any samples that are flagged by less than 4 AV engines. The list contains all the properly CA-issued certificates in our datasets. More details on our collection and analysis can be found in our paper.

Download

The certificate collection can be downloaded from here (password: infected). All certificates are in DER format. You can examine a certificate using the OpenSSL suite. For example:

 openssl x509 -inform DER -text -in 001926795f482a11cf7d39351111296a.der 

Certificates

Subject Issuer Pem Hash Serial Number Validity Period Revocation VirusTotal
CN: Media Get LLC
O: Media Get LLC
CN: UTN-USERFirst-Object
O: The USERTRUST Network
68c0e1429b2084c4b39f45a7d53c577b 151295363587433662828629031462504405649 2011-03-09 - 2014-03-08 -
CN: NetZone Info-Tech Co., Ltd., Shanghai
O: NetZone Info-Tech Co., Ltd., Shanghai
CN: VeriSign Class 3 Code Signing 2009-2 CA
O: VeriSign, Inc.
cc696a96947270914b6ac018dbb9e120 63458753668888617842197241328100431650 2010-08-05 - 2011-08-05 -
CN: Zango
O: Zango
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
aa39b9d4ec8226d6668cf8a2738b1f88 38049408603578348999081604595972344536 2008-02-14 - 2010-05-12 -
CN: ResultTool.com
O: ResultTool.com
CN: UTN-USERFirst-Object
O: The USERTRUST Network
a575d9511d82682ecf7bd9c33423aa4f 221140577304869579858737850913929874380 2010-08-18 - 2012-08-17 -
CN: E2GIVE LLC
O: E2GIVE LLC
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
2f589a8d2ab857eeedf0a2b422fed248 2131962 2004-10-15 - 2006-10-13 -
CN: Big Fish Games
O: Big Fish Games
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
c4c07043808d01e69d4435d96a5a3232 1515068868922070186479301870285871627 2007-10-11 - 2010-10-29 -
CN: Media Labs Limited
O: Media Labs Limited
CN: UTN-USERFirst-Object
O: The USERTRUST Network
b8cf1b3f54ac609b149cc4117ebd634a 190625093918498313584627826024666140393 2010-06-03 - 2011-06-03 -
CN: SweetIM Technologies Ltd
O: SweetIM Technologies Ltd
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
84990e6851dfd8a0c9edcb0b799d1a84 114121769696096131086733805047404919862 2008-02-06 - 2011-02-05 -
CN: eXact Advertising
O: eXact Advertising
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
962f839fae3d09cde09db893156ef987 4065698 2004-04-09 - 2006-04-09 -
CN: Realtek Semiconductor Corp
O: Realtek Semiconductor Corp
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
ceef50c4ac30436b53a5c877c92c984c 125517864804396137012349637530029140517 2007-03-15 - 2010-06-11 2010-01-20 00:00:00
CN: Beijing Junjingtong Technology Co., Ltd.
O: Beijing Junjingtong Technology Co., Ltd.
CN: GlobalSign ObjectSign CA
O: GlobalSign nv-sa
cd0129bb3cc6d7b86e4205efa4ca7734 1208925819615894183370863 2010-02-01 - 2011-02-01 -
CN: MONTORGUEIL
O: MONTORGUEIL
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
4467f7c1129291cb2081256310aaa057 2147192 2004-12-29 - 2006-01-08 -
CN: AntiSpyware LLC
O: AntiSpyware LLC
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
c8ce26e2fc80a2a95ab8cc8a3f36f17c 57699000552596154865204817751828258607 2008-01-30 - 2011-04-05 2008-01-30 00:00:00
CN: ()
O: yessign
CN: yessignCA General Class 2
O: yessign
04e55beb57accaa64f17459e11ccebf1 1026 2010-07-27 - 2011-07-28 -
CN: ()
O: ()
CN: Thawte Code Signing CA - G2
O: Thawte, Inc.
f6ae5d030f17d8f43f0596419d68a804 55161356595323355211499697432017167717 2011-10-05 - 2012-10-04 -
CN: Seekapp.com
O: Seekapp.com
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
12080bae5c7aa047975e2e60a0db917c 9957489338652789109421509872485676503 2008-11-19 - 2010-11-19 -
CN: Banco do Brasil S.A.
O: Banco do Brasil S.A.
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
f31fd1d4b3560399305f2174a8893062 122902096058137193255957914205660453434 2008-10-02 - 2011-10-02 -
CN: electronic-group
O: electronic-group
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
439359e86bdd315b42d799d4ef0809aa 127574821708773624683568259988524126335 2007-07-25 - 2009-09-15 2009-03-18 22:38:36
CN: Akorea
O: Akorea
CN: VeriSign Class 3 Code Signing 2009-2 CA
O: VeriSign, Inc.
793c87cc1f6f09e8a44c95e582d2fd61 42311517728418005355075144283879480739 2010-05-28 - 2011-05-28 2010-05-28 00:00:00
CN: south beach telecom inc.
O: south beach telecom inc.
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
62cd4653c1921876cfeceebfb5286a91 2123489 2004-09-01 - 2005-09-01 -
CN: Lions Pride Enterprises Inc.
O: Lions Pride Enterprises Inc.
CN: VeriSign Class 3 Code Signing 2001-4 CA
O: VeriSign, Inc.
01aa0682a283f6654738020a4e867574 168540845361758090425620417847413639717 2002-04-15 - 2003-04-15 -
CN: Infotel di Zolesi Luca
O: Infotel di Zolesi Luca
CN: Thawte Server CA
O: Thawte Consulting cc
e5a591aeb9ffb3c506628c4e2702d726 648896 2003-02-17 - 2003-07-02 -
CN: MOLDCONECTA
O: MOLDCONECTA
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
c6c7c38da3229695ece2efdd6acad075 2041885 2003-10-22 - 2005-10-21 -
CN: Sogou.com
O: Sogou.com
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
228711884bfda940761edd4fd542dce7 9636812286302450256149480196981085905 2007-07-03 - 2008-07-02 -
CN: EARNY LIMITED
O: EARNY LIMITED
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
a5ea6ee0f2ec907ca1499c5c1db8bfe6 123270520851963881199856435555208426995 2006-06-05 - 2008-04-12 -
CN: Keywords, Inc.
O: Keywords, Inc.
CN: VeriSign Class 3 Code Signing 2001 CA
O: VeriSign, Inc.
227b3ffa9519d4479c4822188b16f91a 89027723600514473230864705718127608296 2004-03-16 - 2005-03-16 -
CN: SoftWindow
O: SoftWindow
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
f86315f5af0b8409afebd573348ed90a 152450571398095849308753998268194121175 2008-10-27 - 2010-10-25 -
CN: C2 Media Ltd.
O: C2 Media Ltd.
CN: Thawte Server CA
O: Thawte Consulting cc
56d721b9495070d409acf5b00805c62f 536570 2001-08-14 - 2002-08-14 -
CN: Gamevance LLC
O: Gamevance LLC
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
71c8d47197adb56a8c5ded8747654c55 103348903551236225178739695242415203417 2009-05-04 - 2010-05-07 2009-05-04 00:00:00
CN: Integrated Search Technologies
O: Integrated Search Technologies
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
6f4239d00f31c434be0ee2e0a17a460e 2061848 2004-01-14 - 2005-02-10 -
CN: VoiceFive Networks, Inc.
O: VoiceFive Networks, Inc.
CN: VeriSign Class 3 Code Signing 2009-2 CA
O: VeriSign, Inc.
2bd199574bd3cdb329619cf80c3de55c 170018671352671214879542244187880389131 2009-08-10 - 2012-10-05 -
CN: jynetworks
O: jynetworks
CN: eBiz Networks Certificate Services
O: eBiz Networks Ltd
6f85f9deb92db7ceaacf9663b768096b 164629975468035642408036725545448059314 2010-06-29 - 2011-06-29 -
CN: BEIJING KUWO TECHNOLOGY CO.,LTD.
O: BEIJING KUWO TECHNOLOGY CO.,LTD.
CN: VeriSign Class 3 Code Signing 2009-2 CA
O: VeriSign, Inc.
fe9f527c34d240ebb3f5208e9a8afd9a 52196876621603213704395755034713376514 2009-12-02 - 2011-12-02 -
CN: GAIN Publishing
O: GAIN Publishing
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
b709e3b42dc96cdc32d471f2261ad3b0 2129433 2004-10-04 - 2005-10-27 2009-06-10 13:42:44
CN: 360.cn
O: 360.cn
CN: VeriSign Class 3 Code Signing 2009-2 CA
O: VeriSign, Inc.
da6d8d95e9e31c0ee5b143f37bdf93ef 155450016616434046243011311424488100471 2010-03-16 - 2013-03-15 -
CN: SINA.COM TECHNOLOGY (CHINA) CO. LTD
O: SINA.COM TECHNOLOGY (CHINA) CO. LTD
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
0c55a76b617b5c4a6f25f8f6703c99b8 167846020632603820441861503447782111928 2009-04-16 - 2012-04-18 -
CN: OmniRealityBroadband Co. Ltd.
O: OmniRealityBroadband Co. Ltd.
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
81a9e42fa1c9eb1ed522ce8127e6eac2 91442210243909136834170039834834527448 2009-07-28 - 2011-07-28 -
CN: ()
O: ()
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
a5ef5e297521c0b2035c1f37b058f1a6 97878855655600589093138412748719902379 2010-02-25 - 2011-02-25 -
CN: Cassava Enterprises (Gibraltar) Limited
O: Cassava Enterprises (Gibraltar) Limited
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
52ee1eca5ceef96380367f398d98ed3b 90202012398761608826543751313339955623 2010-03-10 - 2012-05-18 -
CN: i-Technologies s.r.o.
O: i-Technologies s.r.o.
CN: VeriSign Class 3 Code Signing 2001 CA
O: VeriSign, Inc.
fda3905f4b9faf381fec55804be52ef2 56396198215451893732594612660932803211 2004-09-28 - 2005-10-12 -
CN: Media Code, Inc
O: Media Code, Inc
CN: UTN-USERFirst-Object
O: The USERTRUST Network
897fcbf534baeeca367a16f66f57c031 149449325672249312152870432931778680101 2008-05-28 - 2009-05-28 -
CN: FAVORIT NETWORK S.L.
O: FAVORIT NETWORK S.L.
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
2f46bc9218050b6c770a35c630a95ff7 47524756895971124199152301885898973314 2009-02-11 - 2011-02-11 2010-09-30 19:59:42
CN: Software Plugin Ltd.
O: Software Plugin Ltd.
CN: Thawte Server CA
O: Thawte Consulting cc
cabda1f770ac46a6ddc038697e2eeee8 2031205 2003-09-10 - 2005-09-09 -
CN: Microgaming Software Systems Limited
O: Microgaming Software Systems Limited
CN: Thawte Code Signing CA - G2
O: Thawte, Inc.
c5c7557a3378bf0e6116bd315de40cab 156429907537242151736864088556229479541 2011-01-03 - 2011-12-14 -
CN: Free Connect Ltd
O: Free Connect Ltd
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
98988c099cec61221a8f3b8723d2bf9c 2037520 2003-10-03 - 2004-10-02 -
CN:
O:
CN: WoSign Code Signing Authority
O: WoSign, Inc.
e4abdda54a1a136833937fa80a092c80 120022346212153327284156725736600153985 2010-03-05 - 2011-03-05 -
CN: Install Core
O: Install Core
CN: UTN-USERFirst-Object
O: The USERTRUST Network
b08448398029db223e4b635bc8b8e505 58207838099802793037692359392433851509 2011-02-02 - 2012-02-02 -
CN: Zwunzi.com
O: Zwunzi.com
CN: UTN-USERFirst-Object
O: The USERTRUST Network
e5f7900101b5e6df20e1037ff4bf827f 303761459302126784647836230974200579213 2009-09-17 - 2011-09-17 -
CN: Reklosoft LLC
O: Reklosoft LLC
CN: UTN-USERFirst-Object
O: The USERTRUST Network
5300ee13f37c52b65a45527830f482bd 314831779597398605426132525179731596673 2010-10-05 - 2011-10-05 -
CN: QuestUrl.com
O: QuestUrl.com
CN: UTN-USERFirst-Object
O: The USERTRUST Network
74209248edb35de6d9c560b0f9d1989d 272304068629984527456596565084061990739 2010-07-07 - 2012-07-06 -