home

北京天创奇迹广告有限公司

Publisher Information

北京天创奇迹广告有限公司 is a software publisher located in beijing, China*. Thre are 2 additional code signing certificates issued to this publisher.
Authority:
Thawte, Inc.

Valid from:
7/14/2012 8:00:00 AM

Valid to:
9/13/2013 7:59:59 AM

Subject:
CN=北京天创奇迹广告有限公司, OU=北京天创奇迹广告有限公司, O=北京天创奇迹广告有限公司, L=beijing, S=beijing, C=CN

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
20d82bac683325fbe0b262b28e439c49

Status:
Inconclusive detections from multiple engines

Scan engine
Details
Detections

Comodo Security
Heur.Suspicious, UnclassifiedMalware
40.00%

ESET NOD32
Win32/Meinhudong.C potentially unwanted application
35.00%

F-Prot
W32/Agent.AP.gen
30.00%

VIPRE Antivirus
Win32.Malware!Drop, Trojan.Win32.Generic
25.00%

K7 AntiVirus
Riskware , Trojan
25.00%

Dr.Web
Trojan.DownLoader7.53473, DLOADER.Trojan, Trojan.Siggen4.22601, Trojan.StartPage.46800
20.00%

McAfee
Trojan.Artemis!35EB95911D8F, Artemis!00934BA92494, Artemis!2164938CC771
15.00%

Qihoo 360 Security
Trojan.Generic
15.00%

Sophos
Troj/StartP-HW
10.00%

MicroWorld eScan
Trojan.Generic.8602405, Dropped:Trojan.Generic.10258097
10.00%

1 / 68      (inconclusive)
lf_tgy.exe  (964aa66478c5ae85572f8e2a0e307fea)

1 / 68      (inconclusive)
lf_tg.exe  (8baa89a9508a1f3fd780d94970f16cd3)

0 / 68
ttkbd2.dll  (c9ae53b510ab9aed1be4e43ae788523e)

0 / 68
ttkansvr.exe  (174b12c054b7a5c5ba2ef06148fa9c77)

1 / 68
ttkan.exe  (eef0e5b81191fe57c990940ade43553b)

0 / 68
kantt.exe  (a247070e1254b593400128bee7513567)

0 / 68
21999_lfylstp.exe  (b8e55de625c610864921387c3c9873cd)

1 / 68
21999_lfylstp.exe  (3dfae2b864f430abd4394a26c18699fa)

1 / 68
21999_lfylstp.exe  (6a95414f3708248f7d627d5e8d0e926b)

1 / 68      (inconclusive)
lfbyy2013072013.exe  (ac64e90bf3aa95e246f078981db265c9)

25 / 68    (Malware)
czsetupnew.exe (chengzi)  (2164938cc7718959fb2717a1c3aa8690)

0 / 68
dhilfdyk.exe  (6f17aa18fd3c5593ade89ac25cf8254a)

0 / 68
cy_setup.exe (chuangye)  (224930bb592e32f3baa64bda9d665d7f)

25 / 68    (Malware)
cz_setupnew.exe (chengzi)  (00934ba9249494830d7817f87ac07791)

0 / 68
lnfayy201309041.exe  (e574298c3e524640f800d6cc7f4fa5f3)

0 / 68
klacnr2013082917d.exe  (0fefc59465c21fd7d566b45893891702)

0 / 68
klacnr2013082917.exe  (0ea907c66968c4ec32a014680a65997a)

0 / 68
liufen.exe  (e763d2b213ee5ee22368f919ebac612c)

2 / 68
chuangye2013052116.exe  (829940c0548a2229767fb7b7b0ce9e67)

5 / 68      (inconclusive)
gs_setup.exe (guangsu)  (ffb4e033a8e5b137c158e3dc55c8d1ef)

3 / 68      (inconclusive)
zicheng-1655700000.exe  (e14cf4a3023516c6bdf7fe0ad0743889)

0 / 68
30222_lf.exe  (6c736ca4a548f43961317afe69bfebd0)

0 / 68
lfyldesk.exe  (98eff47980e7fa7cb5ec5958c4be198d)

0 / 68
lufenyl2013071317.exe  (087306581c08578339d73b7d5c677982)

1 / 68
lfeyy2013080111.exe  (a57f5e298f61084d83163c16a4fac89b)

0 / 68
chengziisvr-1665500000.exe  (54b116a2fd0d9a98ef86047261d29c2a)

0 / 68
update.exe  (ea2df32763e81009c7be125f0eacb0fd)

0 / 68
liu1fensvr-1657314781.exe  (9d0d2f87d3a34cd354299352f9839024)

0 / 68
30222_liufen.exe  (a161f8dbbcd63af0610d9cafdf419b3c)

0 / 68
lufenyl201606306.exe  (50627f9f54cc95d769016945ad2eece8)

 
Latest 30 of 57 files

Downloads URLs for files signed by 北京天创奇迹广告有限公司.

2 / 68
http://jump1.sanboke.com/ndl.aspx?uid=7328&sid=6650&tid=3  (lf_tgy.exe)

3 / 68      (inconclusive)
http://download.nbhscl.com/nfdl.aspx?uid=1014&sid=260&tid=3  (lf_some_1.exe)

The following websites host and distribute files published by 北京天创奇迹广告有限公司.

jump1.sanboke.com

download.nbhscl.com

The certificates below are also signed by 北京天创奇迹广告有限公司.

440EFB0AEFBBFCFEA50B0E8F992848BC  (Jul 31, 2014 to Oct 31, 2015)

3BC0DD5FCB734879BFDDCCA0C7B71A17  (Aug 11, 2011 to Aug 11, 2012)

The following publishers (by Authenticode signature organization name) are related.

同创无限（北京）科技有限公司

* Note, the details and description above are based on the code signing digital signature issued to 北京天创奇迹广告有限公司 by Thawte, Inc. on July 14, 2012 with the serial number '20d82bac683325fbe0b262b28e439c49'.
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.