» Xiaoqing Liu
Digital Signature
Analysis
Files (87)
Downloads (6)
Distribution (2)
Related (28)

Xiaoqing Liu

Publisher Information

Xiaoqing Liu is a software publisher located in Zaozhuang, Shandong in China*. The company is a primary distributor of unwanted software. Thre are 4 additional code signing certificates issued to this publisher.

Authority:

DigiCert Inc

Valid from:

8/13/2014 2:00:00 AM

Valid to:

8/17/2015 2:00:00 PM

Subject:

CN=Xiaoqing Liu, O=Xiaoqing Liu, L=Zaozhuang, S=Shandong, C=CN

Issuer:

CN=DigiCert Assured ID Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:

0889ced821c1220a4f950101c71e977b

Scanner detections:

Detections (100% detected)

Scan engine

Details

Detections

Reason Heuristics

PUP.XiaoqingLiu.W, PUP.XiaoqingLiu.S, PUP.XiaoqingLiu.O, PUP.XiaoqingLiu.G, PUP.XiaoqingLiu.I, PUP.XiaoqingLiu.R, PUP.Installer.XiaoqingLiu.L, PUP.XiaoqingLiu.K, PUP.Li Mo, PUP.Li Mo.XiaoqingLiu, PUP.ELEX.XiaoqingLiu (M), PUP.ELEX.Xiaoqing (M), PUP.ELEX.Xiaoqing.Installer (M), PUP.ELEX (M)

100.00%

Bitdefender

Adware.Agent.PAO, Gen:Application.Elex.1

48.00%

G Data

Adware.Agent.PAO, Gen:Application.Elex

48.00%

MicroWorld eScan

Adware.Agent.PAO, Gen:Application.Elex.1

46.00%

AhnLab V3 Security

PUP/Win32.Amonetize, PUP/Win32.SearchHijacker

42.00%

AVG

Generic

42.00%

F-Secure

Adware.Agent.PAO, Gen:Application.Elex.1

40.00%

Agnitum Outpost

Riskware.Agent

38.00%

Lavasoft Ad-Aware

Gen:Application.Elex.1, Adware.Agent.PAO

34.00%

Baidu Antivirus

PUA.Win32.LiMo, PUA.Win32.ELEX

32.00%

1 / 68 (Adware)

797f2c6f-c9a1-4791-b515-6580c63ea95e (1927_profr_omiga-plus by One Syn) (a1b68cf9d42a71d1db2722cc0ffbf792)

1 / 68 (Adware)

vtt_mystartsearch.exe (1908_vtt_mystartsearch by One Syn) (9031fe5538eb867c1ecc44353487f069)

1 / 68 (Adware)

v9_pariente_soft_partner.exe (1990_brd_v9 by One Syn) (e7a1c1c0b3f3d7690d9fda408dca2945)

1 / 68 (Adware)

lly_mystartsearch.exe (1860_tugs_mystartsearch by JWTab) (4d3d5449545017e8c92a9c1e65f47188)

1 / 68 (Adware)

e35dssu1.nae.exe (1888_irs2_webssearches by JWTab) (4b03925d1d83e89460fc588bc1c5075a)

1 / 68 (Adware)

red_webssearches.exe (1900_red_webssearches by JWTab) (d37cde8554b97b2b620a3286a995d45a)

1 / 68 (Adware)

w3i_webssearches.exe (1924_w3i_webssearches by JWTab) (135f1e2e91e0099e627bbdfa177300e7)

1 / 68 (Adware)

cvs5_webssearches.exe (1858_cvs5_webssearches by JWTab) (8bd4dd4ef8c18daf06e74c64779f5179)

1 / 68 (Adware)

smt_omiga-plus.exe (1952_smt_omiga-plus by One Syn) (9ae61426ce076da6deb0b97fb4327353)

1 / 68 (Adware)

unt38b3.tmp.exe (1896_epom2_mystartsearch by JWTab) (3321e10cf698a955d4b28d71c006d2b7)

1 / 68 (Adware)

sfpsnew4_mystartsearch.exe (1918_sfpsnew4_mystartsearch by JWTab) (1bf9ad295e9f4b3ca5d591524eddbabc)

1 / 68 (Adware)

scl_webssearches.exe (1996_scl_webssearches by One Syn) (ef5ec774361b85df3abfbfd633f90203)

1 / 68 (Adware)

0053713962da41dc429beb3c3cee8544f39071e7ccb740b5b06c6fea039ca6e0.exe (1904_uni_webssearches by JWTab) (2c68873dd5263fb25097d0a5c7f94204)

1 / 68 (Adware)

alp_webssearches.exe (1873_alp_webssearches by JWTab) (a8828f7e905b6107175fb7b57a35156d)

1 / 68 (Adware)

ca616a45-f818-4e93-a8ee-28e70e6b3683 (1853_profr_sweet-page by One Syn) (59a6826bdf892a3ddcb6f2ce7627af61)

1 / 68 (Adware)

sfpsnew1_mystartsearch.exe (1981_sfpsnew1_mystartsearch by JWTab) (8d96174e34403be3bc0036a6793fc030)

1 / 68 (Adware)

setup.exe (1869_smt_mystartsearch by JWTab) (ef5bc6f702f01a08360ed999a39ee85c)

1 / 68 (Adware)

mp3_mystartsearch.exe (1907_mp3_mystartsearch by JWTab) (2c6eadac9726539427a3ce643d893f43)

1 / 68 (Adware)

lly_mystartsearch.exe (1835_tugs_mystartsearch by One Syn) (f9a70aa0bc79037c7f948022d1634ef4)

1 / 68 (Adware)

nsbes_webssearches.exe (1902_nsbes_webssearches by JWTab) (ef0a9f6937763ead929a6d174ff27366)

1 / 68 (Adware)

airfb55.exe (1862_air_omiga-plus by JWTab) (5f396511d4f26bd7a8c88ca8e90ceec4)

1 / 68 (Adware)

lly_mystartsearch.exe (1898_tugs_mystartsearch by JWTab) (4d65ce4dd1ba37a4bf774c9a5a6d6f2c)

1 / 68 (Adware)

lly_mystartsearch.exe (1950_tugs_mystartsearch by One Syn) (571cc806fe5b29d3aecd94bbe9982ac5)

1 / 68 (Adware)

untee3a.tmp.exe (1895_epom1_mystartsearch by JWTab) (7df64de3560e207d330f1a482ec87350)

1 / 68 (Adware)

adv_48.exe (1910_step_mystartsearch by JWTab) (c2206e5fc095f8fb6f131409a4645c70)

1 / 68 (Adware)

e8d60989-bcf2-48b4-bc47-acf65c6a1f92 (1853_profr_sweet-page by One Syn) (45b9e16653f488469d1c64c07f5598a5)

20 / 68 (Adware)

scl_webssearches.exe (1893_scl_webssearches by One Syn) (86e5756e28c91eb32a74928ce6385d3a)

17 / 68 (Adware)

mystartsearch_soft_partner.exe (1906_tt4u_mystartsearch by JWTab) (9f60b967f48141f5a682d5bf53331cf4)

15 / 68 (Adware)

nov10_cor_sweet-page.exe (1833_cor_sweet-page by One Syn) (b9f52e0ad6ef596eaa996180d57bb903)

15 / 68 (Adware)

elextech_ium4_setup.exe (1993_ium4_mystartsearch by One Syn) (d93beabe0cd68efd6709f56605e80611)

Latest 30 of 87 files

Downloads URLs for files signed by Xiaoqing Liu.

12 / 68 (Adware)

http://www.girlliuxiaoqing.com/.../pjr_webssearches.exe (0761b91221b3b4f3ab2020b0d9347a8f)

1 / 68 (Adware)

http://ny.offers.multiinstall.com/3c4972fab9a209a3aed32ee81d2726d3f39071e7ccb740b5b06c6fea039ca6e0.exe (2c68873dd5263fb25097d0a5c7f94204)

1 / 68 (Adware)

http://www.girlliuxiaoqing.com/.../scl_webssearches.exe (ef5ec774361b85df3abfbfd633f90203)

1 / 68 (Adware)

http://www.girlliuxiaoqing.com/.../sfpsnew1_mystartsearch.exe (8d96174e34403be3bc0036a6793fc030)

20 / 68 (Adware)

http://www.girlliuxiaoqing.com/.../scl_webssearches.exe (86e5756e28c91eb32a74928ce6385d3a)

19 / 68 (Adware)

http://dm930xmxv1gqs.cloudfront.net/bundles/.../adks_sweet-page_20141114.exe (3946a63761043a3b8f76286fa194ffbd)

Distribution

The following websites host and distribute files published by Xiaoqing Liu.

www.girlliuxiaoqing.com

dm930xmxv1gqs.cloudfront.net

The certificates below are also signed by Xiaoqing Liu.

01D9E1C9DEA81DDCA65062CC18203480 (Aug 13, 2014 to Aug 17, 2015)

01FE476BB35D5C01EABE81B9438B7B75 (Aug 13, 2014 to Aug 17, 2015)

04EED95FE18B1B4413D68A12F53663C0 (Aug 13, 2014 to Aug 17, 2015)

0EBAB4AC38B70A33EE517D238BDE49D7 (Aug 12, 2014 to Aug 17, 2015)

The following publishers (by Authenticode signature organization name) are related.

PC Backup Software Limited

Linkury Ltd

Klip Pal

Weather Notifications LLC

JH Software Private Limited

Boxore OU

PayByAds ltd.

Olacatala OU

1NSTALL (383 MEDIA, INC.)

Montiera Technologies LTD

MicroSmarts LLC

* Note, the details and description above are based on the code signing digital signature issued to Xiaoqing Liu by DigiCert Inc on August 13, 2014 with the serial number '0889ced821c1220a4f950101c71e977b'.

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.