» ZHANG YUAN YUAN
Digital Signature
Analysis
Files (9)
Downloads (4)
Distribution (2)
Related (20)

ZHANG YUAN YUAN

Publisher Information

ZHANG YUAN YUAN is a software developer located in JIANPING, Liaoning in China*. Thre are 3 additional code signing certificates issued to this publisher.

Authority:

COMODO CA Limited

Valid from:

12/4/2015 1:00:00 AM

Valid to:

9/24/2016 1:59:59 AM

Subject:

CN=ZHANG YUAN YUAN, O=ZHANG YUAN YUAN, STREET=NO. 202 UNIT 7 DUZHEN VILLAGE SHAHAI COUNTY, L=JIANPING, S=LIAONING, PostalCode=122400, C=CN

Issuer:

CN=COMODO RSA Code Signing CA, O=COMODO CA Limited, L=Salford, S=Greater Manchester, C=GB

Serial number:

00e63e56465167101694d5e55f64f90a10

Scanner detections:

Malware distribution (100% detected)

Scan engine

Details

Detections

Reason Heuristics

Threat.Win.Reputation.IMP, (M)

100.00%

1 / 68 (Malware)

llys_yoursearching.exe (5375_tugss_yoursearching) (b0a63fd88139818f91e597d2425e33c6)

1 / 68 (Malware)

cvs_istartpageing.exe (5432_cvs_istartpageing) (62739a7f99e7f4566c7f5e0523ea12c4)

1 / 68 (Malware)

smt_mysites123.exe (5374_smt_mysites123) (20703bafb804ef54b4620b4b4bd5628a)

1 / 68 (Malware)

awhbd3f.tmp (5371_amt_omniboxes) (3c9c01f1e244937a6cad63196b25cedf)

1 / 68 (Malware)

smt_yoursearching.exe (5373_smt_yoursearching) (c15befd84c23ea43ed59ca9882c9a57c)

1 / 68 (Malware)

llys_istartpageing.exe (5376_tugss_istartpageing) (a9906f57231146136029426d8a709995)

1 / 68 (Malware)

ws0f73a4c8.dat (5375_tugss_yoursearching) (e8aa204baddf176d30ca4f9c6500e7f3)

1 / 68 (Malware)

0qvdfl1btsq==1.exe (5372_obw_yoursearching) (26bbbfa76408fa2d25bd0f83791de2c7)

1 / 68 (Malware)

amt_mysites123.exe (5370_amt_mysites123) (18eb8ba6ac1ca446ccbcf74f8b3a2835)

Downloads URLs for files signed by ZHANG YUAN YUAN.

1 / 68 (Malware)

https://d3kj6o4rxau601.cloudfront.net/.../llys_istartpageing.exe (a9906f57231146136029426d8a709995)

1 / 68 (Malware)

http://d2drfrdurj6mvo.cloudfront.net/.../obw_yoursearching.exe (26bbbfa76408fa2d25bd0f83791de2c7)

1 / 68 (Malware)

http://d3kj6o4rxau601.cloudfront.net/.../llys_istartpageing.exe (a9906f57231146136029426d8a709995)

1 / 68 (Malware)

http://d3kj6o4rxau601.cloudfront.net/.../llys_yoursearching.exe (e8aa204baddf176d30ca4f9c6500e7f3)

Distribution

The following websites host and distribute files published by ZHANG YUAN YUAN.

d3kj6o4rxau601.cloudfront.net

d2drfrdurj6mvo.cloudfront.net

The certificates below are also signed by ZHANG YUAN YUAN.

00D06CD323AFB97B24B32D03A6BD7333B0 (Oct 14, 2015 to Sep 24, 2016)

009E8AA1F4262E894AF0828EA3010B4DE5 (Nov 16, 2015 to Sep 24, 2016)

00B87B078BE84D131E1E0AD44200A7F755 (Sep 29, 2015 to Sep 24, 2016)

The following publishers (by Authenticode signature organization name) are related.

Thinknice Co., Limited

Giner Tech Inc

CHAODONG XIAO

Yuxin WANG

Skytouch Technology Co., Limited

Minidigital Technology Co., Limited

刘晋岐

Peng Zhang

Thinknice Co. Limited

Banyan Tree Technology Limited

EasyVpn

Zealot Games Limited

Off To Up LLC

* Note, the details and description above are based on the code signing digital signature issued to ZHANG YUAN YUAN by COMODO CA Limited on December 04, 2015 with the serial number '00e63e56465167101694d5e55f64f90a10'.

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.