Collection Method

The certificate list below is one of the outputs of our Code Signing analysis infrastructure. We used 350K unlabeled samples from malware repositories, mainly VirusShare as input to our infrastructure. Then, it uses VirusTotal to discard any samples that are flagged by less than 4 AV engines. The list contains all the properly CA-issued certificates in our datasets. More details on our collection and analysis can be found in our paper.

Download

The certificate collection can be downloaded from here (password: infected). All certificates are in DER format. You can examine a certificate using the OpenSSL suite. For example:

 openssl x509 -inform DER -text -in 001926795f482a11cf7d39351111296a.der 

Certificates

Subject Issuer Pem Hash Serial Number Validity Period Revocation VirusTotal
CN: Interfun GmbH
O: Interfun GmbH
CN: Thawte Server CA
O: Thawte Consulting cc
7ebe3f0592d33b74dd81e6048fc72186 594285 2002-06-24 - 2003-06-20 -
CN: SearchLink Co., Ltd.
O: SearchLink Co., Ltd.
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
5eb8c96f86029ee8ef3e0f82dbbadb05 69520836721544544337126740995089343280 2007-04-16 - 2009-04-15 -
CN: NKsolution Corp.
O: NKsolution Corp.
CN: VeriSign Class 3 Code Signing 2009-2 CA
O: VeriSign, Inc.
d6bb1d269ad5bb38edb8e788dc6f9997 124924996891893146949137423475093128323 2010-04-07 - 2011-05-07 -
CN: IP Tower bv
O: IP Tower bv
CN: VeriSign Class 3 Code Signing 2001 CA
O: VeriSign, Inc.
94d5945217ad7919e749970eb6b47036 62614735809379771805933725028822296168 2004-04-08 - 2005-04-08 -
CN: uvnc bvba
O: uvnc bvba
CN: GlobalSign ObjectSign CA
O: GlobalSign nv-sa
1ac5676c7160fe34a4a181ef2b5be9b9 1208925819615866977777293 2009-03-23 - 2011-04-10 -
CN: Infotel Servizi s.r.l.
O: Infotel Servizi s.r.l.
CN: Thawte Server CA
O: Thawte Consulting cc
5f824e7a82290c191ab77b4c3518789f 667073 2003-04-29 - 2004-04-28 -
CN: WEB PICK - INTERNET HOLDINGS LTD
O: WEB PICK - INTERNET HOLDINGS LTD
CN: Thawte Code Signing CA - G2
O: Thawte, Inc.
9be7ca06555c13d231132c5973c565ae 125842735497711874902374515681978943178 2011-03-23 - 2012-03-22 -
CN: IronSource Group LLC
O: IronSource Group LLC
CN: UTN-USERFirst-Object
O: The USERTRUST Network
3267e867aa9844483e2dd2641fcba3fd 231419540838225265153231211944033116287 2010-04-13 - 2011-04-13 -
CN: World Telecom International Inc.
O: World Telecom International Inc.
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
e9a5fb83b35fd00e7a5b890f66116af1 148547794500042881989631757245475564909 2006-05-08 - 2008-06-03 -
CN: Yancheng Peoples Information Technology Service Co., Ltd
O: Yancheng Peoples Information Technology Service Co., Ltd
CN: WoSign Code Signing Authority
O: WoSign, Inc.
710cfea246e053384452efd5dca4cc7f 226074795664985378951241713290378045283 2010-11-23 - 2011-11-23 -
CN: NicTech Networks
O: NicTech Networks
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
334fe7b69fd9b1e15d813b9075cabfa8 4100807 2004-09-07 - 2006-10-09 -
CN: InfoSpace, Inc.
O: InfoSpace, Inc.
CN: VeriSign Class 3 Code Signing 2001 CA
O: VeriSign, Inc.
6ffac11f1bc8668a74adf1166cd24809 124744974503386097732856807072255054795 2004-05-20 - 2005-06-05 -
CN: Volonet Ltd
O: Volonet Ltd
CN: UTN-USERFirst-Object
O: The USERTRUST Network
6d2796f44ee223e1bc34200d3de90b21 52019026296412498489982767416322454988 2010-11-24 - 2012-11-23 -
CN: IncrediMail Ltd.
O: IncrediMail Ltd.
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
c37d19f5361d0ecfdd07962246fbe756 104126898745761287045296449777715018952 2006-07-20 - 2009-08-10 -
CN: Interdev International SrL
O: Interdev International SrL
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
995e9ba145916d7ef8d6f880780130a9 90504867031229199792084216800907302062 2005-12-14 - 2007-01-13 -
CN: Cyber Media Inc.
O: Cyber Media Inc.
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
792d93ab7aa7e3d610a2693b50b383d5 169335618541566002491068807913697920594 2006-01-27 - 2007-02-13 -
CN: Design and Marketing D.M. SOCIEDAD ANONIMA
O: Design and Marketing D.M. SOCIEDAD ANONIMA
CN: VeriSign Class 3 Code Signing 2009-2 CA
O: VeriSign, Inc.
6f90a1e45c3d236d34efaaa62351771d 76703546127519822606844318161038815909 2010-07-07 - 2011-07-07 -
CN: Game Play Labs
O: Game Play Labs
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
d0f9a71d5096282912e2fde178811898 141961984688154795447909607404985367321 2010-11-04 - 2011-11-04 -
CN: Web Nexus d.o.o.
O: Web Nexus d.o.o.
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
5a7ad1ee433791ac7f18aafbbbb5b4b4 2210193 2005-08-31 - 2006-08-31 -
CN: TGSM Inc.
O: TGSM Inc.
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
924a08b5183b72ac202bcddc8b646461 81013054454321170622657282821310885800 2009-01-09 - 2010-01-09 -
CN: cloudweb Inc
O: cloudweb Inc
CN: Thawte Code Signing CA - G2
O: Thawte, Inc.
03df3defb3fbf21d2a8aa4ea538eae2e 145450136592106403263085270008038483883 2011-03-14 - 2012-04-12 -
CN: TMRG, Inc.
O: TMRG, Inc.
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
b41f316bcf21d770a87cd5f1925c7fb7 16131667068471791102246226869547145448 2009-09-02 - 2011-09-27 -
CN: Mediaclick
O: Mediaclick
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
cc9d27ebbc5f41e557bdca6decae44a9 97809416700843711815023150072993037474 2010-03-03 - 2011-03-03 -
CN: Interprovider Ltd.
O: Interprovider Ltd.
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
dd184ad712c22b386aa9eebcd918505f 2140876 2004-11-25 - 2005-11-24 -
CN: Digital River, Inc.
O: Digital River, Inc.
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
da96bf7655a327662992af5a09099f6b 16071705667203729575797606349794635875 2006-09-06 - 2009-11-03 -
CN: Netflow Developments LTD
O: Netflow Developments LTD
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
5fcddce4fe68c31e05f2748070b0faed 2063761 2004-01-21 - 2005-01-20 -
CN: Lad LLC
O: Lad LLC
CN: UTN-USERFirst-Object
O: The USERTRUST Network
d0abe6c930825b443c10e334b6910794 218901520447812800477647471057186759940 2005-05-27 - 2006-05-27 -
CN: DGnetworks
O: DGnetworks
CN: Thawte Code Signing CA - G2
O: Thawte, Inc.
4874905397177541a97de9531a3fc233 82646432146237014221334587255728202359 2011-01-21 - 2012-01-21 -
CN: Infoware Technologies Inc.
O: Infoware Technologies Inc.
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
c9cd13a9c9a4c5e0ba14f7881f80e720 4097811 2004-08-19 - 2005-06-25 -
CN: Zango
O: Zango
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
bfc325b28088f916e4c9330d3a056253 37203692913547224920711800801153279537 2007-03-20 - 2008-05-12 -
CN: MONTORGUEIL
O: MONTORGUEIL
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
fea1606c731f93630cb31c7b2941d8b6 2058707 2003-12-31 - 2005-01-08 -
CN: Changsha Hongfu Environmental Protection Technology Co., Ltd.
O: Changsha Hongfu Environmental Protection Technology Co., Ltd.
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
fd8d5516983d83e9278e40c10d123bc6 120543548809219705262322494065542355260 2011-06-20 - 2012-06-19 2011-12-02 23:02:06
CN: HOW SOFT
O: HOW SOFT
CN: Thawte Code Signing CA - G2
O: Thawte, Inc.
2dd07310587d15c0d2c6bf9e6115bda0 79214167325233514451400369594921583783 2010-12-16 - 2011-12-16 -
CN: Funbit
O: Funbit
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
357842fdb374e6aee4728edb16266d6c 143918642374337114406253641347396576797 2006-08-15 - 2007-08-24 -
CN: WorldToStart BV
O: WorldToStart BV
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
e91fc1b9eaa578cd03bd35653d6f0848 2199005 2005-07-26 - 2006-07-26 -
CN: WooJung ITS
O: WooJung ITS
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
130548a2321c3574c0c76ab6aba1c314 102572102254949252345275029574124707753 2010-03-26 - 2011-03-26 -
CN: Logics Software GmbH
O: Logics Software GmbH
CN: Thawte Code Signing CA
O: Thawte Consulting (Pty) Ltd.
d5f010b4d9e629578dec78c024044ce2 2080025 2004-03-18 - 2005-04-11 -
CN: Freeze.com, LLC
O: Freeze.com, LLC
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
c0d598f610fef25fd09e44eb992ceeb8 156931190038822787149511557616455832540 2005-11-14 - 2007-01-07 -
CN: InterLogic Ltd.
O: InterLogic Ltd.
CN: VeriSign Class 3 Code Signing 2004 CA
O: VeriSign, Inc.
14ee8576bfc12d00633a60a1be3aed70 127964402662021851610992609034520958926 2006-10-27 - 2009-11-23 -
CN: ZinkWink.com
O: ZinkWink.com
CN: UTN-USERFirst-Object
O: The USERTRUST Network
0f84837178594e623d252851890f4820 164896771894455510773067451438303832651 2009-09-08 - 2011-09-08 -
CN: TopRebates, LLC.
O: TopRebates, LLC.
CN: VeriSign Class 3 Code Signing 2001 CA
O: VeriSign, Inc.
495773ccc4f1b4b67b290482f032a36a 54802674554102985823423094080510040115 2004-02-19 - 2005-02-18 -
CN: Lunacom Interactive Ltd
O: Lunacom Interactive Ltd
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
4e4860f7f7c0d87afa99cfc867bd9118 73477365476932044006696694036590282759 2012-10-19 - 2013-10-17 2012-12-19 00:00:00
CN: Pinball Corporation.
O: Pinball Corporation.
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
929811613622e53aef5806497047513d 17434486764146799000620712850234777312 2013-03-22 - 2014-06-21 -
CN: ClickRunSoftware
O: ClickRunSoftware
CN: COMODO Code Signing CA 2
O: COMODO CA Limited
b1b4533db22acc0b8db0a9887c32c802 86695085663409814743681734351051827809 2013-04-22 - 2014-04-22 -
CN: Secure Labs Payments, S.L.
O: Secure Labs Payments, S.L.
CN: Go Daddy Secure Certificate Authority - G2
O: GoDaddy.com, Inc.
bb9ee2c6fafd05ad0d18033b2009a4f8 1190050269808139 2013-07-25 - 2014-07-25 -
CN: Premium Installer
O: Premium Installer
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
56b9997f309ea7c49e26419fb319a53c 149398625240458899834258575745672538647 2012-07-12 - 2013-07-12 -
CN: Optimum Installer
O: Optimum Installer
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
33a9646844836082d979282929c95fd8 165318345228347921184983677244803420351 2012-10-11 - 2013-11-07 -
CN: DDLR LTD
O: DDLR LTD
CN: COMODO Code Signing CA 2
O: COMODO CA Limited
0a9cc1210bbff0e0e58926ebff1d095c 39383674235492728530886811761423901082 2012-06-14 - 2014-06-14 2012-06-14 00:00:00
CN: I.T.N.T. SRL
O: I.T.N.T. SRL
CN: VeriSign Class 3 Code Signing 2010 CA
O: VeriSign, Inc.
db03af86e8a7548395dd21d20b78a15c 58909255158335471496539658167353351383 2012-01-26 - 2015-03-22 -
CN: New IT Limited
O: New IT Limited
CN: Go Daddy Secure Certification Authority
O: GoDaddy.com, Inc.
803fbc7a169ead4f75afc9db002f175e 12149699428531114 2012-11-16 - 2013-11-16 -