home

Ma Lin

Publisher Information

Ma Lin is a software publisher located in 北京市, China*. The company is a primary distributor of unwanted software. Thre are 3 additional code signing certificates issued to this publisher.
Authority:
WoSign CA Limited

Valid from:
1/5/2015 10:50:44 AM

Valid to:
8/5/2015 11:50:44 AM

Subject:
CN=Ma Lin, L=北京市, S=北京市, C=CN

Issuer:
CN=WoSign Class 2 Code Signing CA, O=WoSign CA Limited, C=CN

Serial number:
1972daa9b51fe3ddd85baf2096319cf6

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.MaLin.T, PUP.MaLin.Q, PUP.ELEX.MaLin (M)
100.00%

Dr.Web
Adware.Mutabaha.288, Adware.Mutabaha.122
91.67%

ESET NOD32
Win32/LiMo.C potentially unwanted application, Win32/ELEX.CF potentially unwanted application, Win32/ELEX.EC potentially unwanted application
66.67%

Malwarebytes
PUP.Optional.KeyFind.A, PUP.Optional.OmigaPlus.A
58.33%

VIPRE Antivirus
Trojan.Win32.Generic
58.33%

AVG
Generic, Potentially harmful program Downloader.EVX
50.00%

F-Secure
Gen:Application.Elex.1
41.67%

G Data
Win32.Application.Limo, Gen:Application.Elex
41.67%

Baidu Antivirus
PUA.Win32.LiMo
33.33%

K7 AntiVirus
Unwanted-Program , Adware
33.33%

1 / 68      (Adware)
0e234f69_stp  (f002533cd6a99e08222e3cf1fab1802e)

17 / 68    (Adware)
jan7_corfr_sweet-page.exe (2463_corfr_sweet-page by Spy File union)  (bca9f06a890b12b2c73b16e95794b1cd)

17 / 68    (Adware)
jan25_corna_omiga-plus.exe (2565_corna_omiga-plus by Spy File union)  (7206e195aeed6a83bc73128afdacc8b9)

4 / 68      (Adware)
jan14_cor_vi-view.exe (2513_cor_vi-view by TabMain)  (fa864e1eca3dfdbbcd32c8b86ba4ebd7)

4 / 68      (Adware)
jan14_cor_sweet-page.exe (2512_cor_sweet-page by TabMain)  (3b4c35e3454974a582a6d82c61db0be2)

4 / 68      (Adware)
jan14_cor_omiga-plus.exe (2514_cor_omiga-plus by TabMain)  (3a7622bcb109d7b47373bae159a17cb6)

18 / 68    (Adware)
feb5_corna_key-find.exe (2634_corna_key-find by Spy File union)  (cda8fa3aa5c70053ded67c455853e96e)

8 / 68      (Adware)
feb1_cor_key-find.exe (2612_cor_key-find by Spy File union)  (22e4f407afda23232416e4f97a42ed85)

4 / 68      (Adware)
jan14_corfr_sweet-page.exe (2516_corfr_sweet-page by TabMain)  (f56cb849b04be775e2ecdfe08d1fa1eb)

9 / 68      (Adware)
jan7_cor_omiga-plus.exe (2460_cor_omiga-plus by Spy File union)  (61e82622333ceb6b92ca31fdd10a109a)

7 / 68      (Adware)
jan7_cor_vi-view.exe (2461_cor_vi-view by Spy File union)  (3414f63b7363dd4a317094a2977a5109)

7 / 68      (Adware)
jan7_cor_sweet-page.exe (2462_cor_sweet-page by Spy File union)  (3e7cb8bc7c0f6e1020e5b4b3a6198d32)

The certificates below are also signed by Ma Lin.

26954AE19A551B1D622A23C25DBE2503  (Nov 24, 2014 to Jul 24, 2015)

760E23ABF26CF75AE5C944881CCA6DA7  (Aug 20, 2014 to Jul 20, 2015)

0FC83FBFE11653F06215DCA7EACE7E7D  (Jun 26, 2014 to Jun 26, 2015)

The following publishers (by Authenticode signature organization name) are related.

Liyan Liu

Beijing ELEX Technology Co., Ltd.

Li Mo

Hefei Zhimingxingtong Software&Technology Co., Ltd.

* Note, the details and description above are based on the code signing digital signature issued to Ma Lin by WoSign CA Limited on January 05, 2015 with the serial number '1972daa9b51fe3ddd85baf2096319cf6'.
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.