» Li Mo
Digital Signature
Analysis
Files (11)
Downloads (4)
Distribution (1)
Related (18)

Li Mo

Publisher Information

Li Mo is a software developer located in Guilin, Guangxi in China*. The company is a primary distributor of unwanted software. Thre are 9 additional code signing certificates issued to this publisher.

Authority:

DigiCert Inc

Valid from:

8/4/2014 3:00:00 AM

Valid to:

8/12/2015 3:00:00 PM

Subject:

CN=Li Mo, O=Li Mo, L=Guilin, S=Guangxi, C=CN

Issuer:

CN=DigiCert Assured ID Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:

0bf14271d8a8ade8a541ce8c8e1d75a1

Scanner detections:

Detections (100% detected)

Scan engine

Details

Detections

Reason Heuristics

Threat.Liyan Liu.LiMo, PUP.Liyan Liu.LiMo, PUP.Liyan Liu.LiMo (M)

100.00%

Bkav FE

W32.HfsAdware

90.91%

G Data

Gen:Application.Elex, Win32.Application.Elex

90.91%

Malwarebytes

PUP.Optional.MyStartSearch.A, PUP.Optional.DoSearch.A

90.91%

Baidu Antivirus

PUA.Win32.LiMo

72.73%

MicroWorld eScan

Gen:Application.Elex.1

54.55%

Bitdefender

Gen:Application.Elex.1

54.55%

AhnLab V3 Security

PUP/Win32.OutBrowse

54.55%

Vba32 AntiVirus

suspected of Trojan.Downloader.gen.h

54.55%

Panda Antivirus

PUP/YAC, PUP/InstallManager

54.55%

1 / 68 (Adware)

may7_3660_corna_do-search.exe (3660_corna_do-search by Portmon/EE) (f7906f7c0a1278b2c19b603833d87987)

14 / 68 (Adware)

may6_3649_cor_do-search.exe (3649_cor_do-search by Spy union) (2d3c4e2f940d2f99ad0d960163cc7cc6)

17 / 68 (Adware)

may6_3648_cor_mystartsearch.exe (3648_cor_mystartsearch by Spy union) (657572625a5b71a5beb396c6da3b59b2)

18 / 68 (Adware)

may6_3647_corga_do-search.exe (3647_corga_do-search by Spy union) (fc5b8bb6bbcc56a57c8284506835e43d)

13 / 68 (Adware)

may6_3646_corfr_sweet-page.exe (3646_corfr_sweet-page by Spy union) (91d2640372b50b827227a8e0546c36ec)

17 / 68 (Adware)

may6_3645_corna_do-search.exe (3645_corna_do-search by Spy union) (674b8b37d27817dbe9f8b3837c32ee56)

8 / 68 (Adware)

may7_3659_corfr_sweet-page.exe (3659_corfr_sweet-page by Portmon/EE) (2e584ef9ce0c81cff29adbfa04c8907a)

9 / 68 (Adware)

may7_3657_cor_mystartsearch.exe (3657_cor_mystartsearch by Portmon/EE) (b8154644d38db41ecc5cfa4980530cb1)

10 / 68 (Adware)

may7_3656_cor_do-search.exe (3656_cor_do-search by Portmon/EE) (3d39a2535fa73556c10f05976a711104)

10 / 68 (Adware)

may7_3655_cor_sweet-page.exe (3655_cor_sweet-page by Portmon/EE) (195a09ca086d765237ca0cc0e7ef1f4a)

19 / 68 (Adware)

may6_3650_cor_sweet-page.exe (3650_cor_sweet-page by Spy union) (33ae51ccce74a8c77e66fa3dd3e2b141)

Downloads URLs for files signed by Li Mo.

10 / 68 (Adware)

https://mail.google.com/mail/u/.../?ui=2&ik=d485ffbdc3&view=att&th=14d2e6c69cc14725&attid=0.1&disp=safe&zw (may7_3655_cor_sweet-page.exe)

10 / 68 (Adware)

https://mail.google.com/mail/u/.../?ui=2&ik=d485ffbdc3&view=att&th=14d2e6c69cc14725&attid=0.2&disp=safe&zw (may7_3656_cor_do-search.exe)

9 / 68 (Adware)

https://mail.google.com/mail/u/.../?ui=2&ik=d485ffbdc3&view=att&th=14d2e6c69cc14725&attid=0.3&disp=safe&zw (may7_3657_cor_mystartsearch.exe)

8 / 68 (Adware)

https://mail.google.com/mail/u/.../?ui=2&ik=d485ffbdc3&view=att&th=14d2e6c69cc14725&attid=0.5&disp=safe&zw (may7_3659_corfr_sweet-page.exe)

Distribution

The following websites host and distribute files published by Li Mo.

mail.google.com

The certificates below are also signed by Li Mo.

09CE096F35659BC891BE9713130F3019 (Jul 16, 2015 to Sep 13, 2016)

043D25C59C374D87F947A9A448031E94 (Jul 16, 2015 to Sep 13, 2016)

0A661DB1DB132545D560DF1B8F8F72CE (Jul 15, 2015 to Sep 13, 2016)

06308C3CB3C78318D687BE76CBCCFDD8 (Aug 04, 2014 to Aug 12, 2015)

078E6AB78826A47B4AE05D93CF737658 (Aug 04, 2014 to Aug 12, 2015)

0381C5BAABACBA4D9D35F2C35CC5326B (Aug 04, 2014 to Aug 12, 2015)

0F53999A8B9372F6AAC4844D7A5BE2CE (Aug 04, 2014 to Aug 12, 2015)

0ACFC920404BD14F120697BDFEE3E5C9 (Aug 04, 2014 to Aug 12, 2015)

0226284B6EE43FB2E43A2888B7D5BA02 (Aug 03, 2014 to Aug 12, 2015)

The following publishers (by Authenticode signature organization name) are related.

BERNEX APLICACIONES SL

dobreprogramy sp. z o.o.

Webcellence Ltd.

WARP INSTALL

Web Bar Media

Softonic International

ComboApps

* Note, the details and description above are based on the code signing digital signature issued to Li Mo by DigiCert Inc on August 04, 2014 with the serial number '0bf14271d8a8ade8a541ce8c8e1d75a1'.

herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.