Zhang Ling

Publisher Information

Zhang Ling is a software publisher located in 北京市, China*. The company is a primary distributor of unwanted software. Thre are 4 additional code signing certificates issued to this publisher.
Authority:
WoSign CA Limited

Valid from:
11/24/2014 4:03:49 AM

Valid to:
6/24/2015 5:03:49 AM

Subject:
CN=Zhang Ling, L=北京市, S=北京市, C=CN

Issuer:
CN=WoSign Class 2 Code Signing CA, O=WoSign CA Limited, C=CN

Serial number:
64aa90e4d11751f466378dd4391c2cab

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.ZhangLing.O, PUP.ZhangLing.J, PUP.ZhangLing.K, PUP.ZhangLing.H, PUP.ZhangLing.R, PUP.ZhangLing.I, PUP.ZhangLing.Q, PUP.ZhangLing.M, PUP.ELEX.ZhangLing (M), PUP.ELEX.ZhangLin (M), PUP.ELEX (M)
100.00%

MicroWorld eScan
Gen:Application.Elex.1
69.77%

Bitdefender
Gen:Application.Elex.1
69.77%

G Data
Gen:Application.Elex
69.77%

F-Secure
Gen:Application.Elex.1
62.79%

Qihoo 360 Security
HEUR/QVM10.1.Malware.Gen, Win32/Application.33e, HEUR/QVM41.1.Malware.Gen
58.14%

Lavasoft Ad-Aware
Gen:Application.Elex.1
55.81%

AhnLab V3 Security
PUP/Win32.SearchHijacker, PUP/Win32.Amonetize
53.49%

IKARUS anti.virus
PUA.LiMo, Gen.Application.Elex
41.86%

Baidu Antivirus
PUA.Win32.LiMo, Adware.Win32.ELEX
37.21%

1 / 68      (Adware)
omiga-plus.exe (2157_free_omiga-plus by One Syn)  (5bfad1c9791d353f154c904ed8b6e003)

1 / 68      (Adware)
squadm_omiga-plus.exe (2168_squadm_omiga-plus by JWTab)  (1db297db40ca0dbeb6db8d520a3b2101)

1 / 68      (Adware)
adv_69.exe (2139_ima_omiga-plus by One Syn)  (29b29377067dd5abc4ff642c0bab3c2f)

1 / 68      (Adware)
amt_mystartsearch.exe (2166_amt_mystartsearch by One Syn)  (0e25bd665597e29f565dbb3e6a9f86d9)

1 / 68      (Adware)
squadm_omiga-plus.exe (1868_squadm_omiga-plus by JWTab)  (a012b744ff0adff0da31404d616fd1cd)

1 / 68      (Adware)
lly_omiga-plus.exe (2143_tugs_omiga-plus by JWTab)  (db49487ffedf26af8f091d6ee9d53cd7)

1 / 68      (Adware)
vtt_mystartsearch.exe (2142_vtt_mystartsearch by One Syn)  (5f99098db1d6e3a7679db2e73b8cf93c)

1 / 68      (Adware)
websearch.exe (2074_ill_webssearches by JWTab)  (c9cf505704bb8e48b06ca7cf6ae813dc)

1 / 68      (Adware)
squadm_omiga-plus.exe (2130_squadm_omiga-plus by One Syn)  (4deea1e714f5b990355c839590cd591c)

1 / 68      (Adware)
amt_mystartsearch.exe (2174_amt_mystartsearch by JWTab)  (5b8cba088f9818d95a3cf99520a5e744)

1 / 68      (Adware)
smt_mystartsearch.exe (1940_smt_mystartsearch by JWTab)  (8edc11d2c1563bdc90a2c13669f58875)

1 / 68      (Adware)
nsbuk_v9.exe (2156_nsbuk_v9 by One Syn)  (7683b70cc4071e2d9764913ad29a605b)

1 / 68      (Adware)
stic_webssearches.exe (2119_stic_webssearches by One Syn)  (601147072f34658ce919eaab320f817d)

10 / 68    (Adware)
nov30_cor_sweet-page.exe (1804_cor_sweet-page by One Syn)  (603c9b69247189d9befba12468c02acf)

15 / 68    (Adware)
dec4_cor_v9.exe (2155_cor_v9 by JWTab)  (af6b9103b710d6776c3159082a0e1847)

18 / 68    (Adware)
dec4_cor_sweet-page.exe (2152_cor_sweet-page by JWTab)  (2b5009a110f7e5e48958787f6be9a6e8)

13 / 68    (Adware)

13 / 68    (Adware)
z6nitmdni2.exe (2182_exp_webssearches by JWTab)  (6fb9574eaf28418fd5083412bd47e16c)

14 / 68    (Adware)
afouluvkz8.exe (2153_exp_webssearches by JWTab)  (29d581b0ca40f5ae288184d5fcbba424)

15 / 68    (Adware)
dec4_cor_vi-view.exe (2154_cor_vi-view by JWTab)  (b84f403b376725604a89bc9a1e6cfc04)

10 / 68    (Adware)
smt_mystartsearch.exe (2173_smt_mystartsearch by JWTab)  (a9addec70efc4554176a535b3dc2170e)

10 / 68    (Adware)
cvs_webssearches.exe (2171_cvs_webssearches by JWTab)  (5d2dc0cca653f0cb1f57a441fc2e46fe)

19 / 68    (Adware)
air_v9.exe (2073_air_v9 by JWTab)  (200670eacadb33fd307e888089b26a3a)

15 / 68    (Adware)

11 / 68    (Adware)
nsegqmnwbe.exe (2129_exp_webssearches by One Syn)  (6dc70518a987e7615e3c673b7feee68e)

10 / 68    (Adware)
nsbuk_v9.exe (2120_nsbuk_v9 by One Syn)  (7c213e4a8a86efd625cd1561d2b5579e)

13 / 68    (Adware)

12 / 68    (Adware)
amt_mystartsearch.exe (2133_amt_mystartsearch by One Syn)  (8033b01c6a634a9f25dab3f8ec454ffc)

14 / 68    (Adware)
lly_omiga-plus.exe (1871_tugs_omiga-plus by JWTab)  (78391ebac9cbe16e1a1f71a0248a4683)

20 / 68    (Adware)
smt_omiga-plus.exe (2031_smt_omiga-plus by JWTab)  (1d4eb41fbda3f6c677d77a0e8e2832d6)

 
Latest 30 of 43 files

Downloads URLs for files signed by Zhang Ling.

1 / 68      (Adware)
http://www.girlliuxiaoqing.com/.../lly_omiga-plus.exe  (db49487ffedf26af8f091d6ee9d53cd7)

7 / 68      (Adware)
http://www.girlliuxiaoqing.com/.../obw_webssearches.exe  (9fc217623c3db7e4e512c708137bba2f)

14 / 68    (Adware)
http://113.171.224.214/.../obw_omiga-plus.exe  (31312828ec3159b658f2435d7d4e2783)

1 / 68      (Adware)
http://www.girlliuxiaoqing.com/.../nsbuk_v9.exe  (7683b70cc4071e2d9764913ad29a605b)

21 / 68    (Adware)
http://www.girlliuxiaoqing.com/.../lly_mystartsearch.exe  (e0973b75d4b561e519e152ad6ff2febc)

14 / 68    (Adware)
http://www.girlliuxiaoqing.com/.../obw_omiga-plus.exe  (31312828ec3159b658f2435d7d4e2783)

14 / 68    (Adware)
http://www.girlliuxiaoqing.com/.../lly_omiga-plus.exe  (78391ebac9cbe16e1a1f71a0248a4683)

14 / 68    (Adware)
http://www.girlliuxiaoqing.com/.../lly_omiga-plus.exe  (d1dfba58b0fd773a402f3794a4d8c9b5)

21 / 68    (Adware)
http://www.girlliuxiaoqing.com/.../obw_webssearches.exe  (c6342e2f4e3a790722e305a46b52b1bd)

22 / 68    (Adware)
http://www.girlliuxiaoqing.com/.../lly_omiga-plus.exe  (4143406fda20bbd38629fda86a15482e)

19 / 68    (Adware)
http://www.girlliuxiaoqing.com/.../pjr_webssearches.exe  (d5bc4e9106ad673569ae33e838cd7be0)

The following websites host and distribute files published by Zhang Ling.

The certificates below are also signed by Zhang Ling.

44C9FA07E0C36E90C219294D56307B89  (Sep 15, 2014 to Jul 15, 2015)

4BD6CD01962107D32D308240DA61E020  (Sep 23, 2014 to Jun 23, 2015)

33D813964B450F4902EA98231C8EF97E  (Aug 20, 2014 to Jun 20, 2015)

07DAC38DB37E09DF8C8634065592DFE3  (Jun 06, 2014 to Jun 06, 2015)

The following publishers (by Authenticode signature organization name) are related.

* Note, the details and description above are based on the code signing digital signature issued to Zhang Ling by WoSign CA Limited on November 24, 2014 with the serial number '64aa90e4d11751f466378dd4391c2cab'.