Xiaoqing Liu

Publisher Information

Xiaoqing Liu is a software publisher located in Zaozhuang, Shandong in China*. The company is a primary distributor of unwanted software. Thre are 4 additional code signing certificates issued to this publisher.
Authority:
DigiCert Inc

Valid from:
8/12/2014 9:00:00 PM

Valid to:
8/17/2015 9:00:00 AM

Subject:
CN=Xiaoqing Liu, O=Xiaoqing Liu, L=Zaozhuang, S=Shandong, C=CN

Issuer:
CN=DigiCert Assured ID Code Signing CA-1, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
01fe476bb35d5c01eabe81b9438b7b75

Scanner detections:
Detections  (100% detected)

Scan engine
Details
Detections

Reason Heuristics
PUP.Li Mo, Threat.Li Mo.XiaoqingLiu, PUP.ELEX.XiaoqingLiu (M), PUP.ELEX (M)
100.00%

Malwarebytes
PUP.Optional.Omniboxes.A, PUP.Optional.IStartSurf.A, PUP.Optional.LuckySearches.A, PUP.Optional.MyStartSearch.A
76.92%

Baidu Antivirus
Adware.Win32.ELEX
76.92%

Dr.Web
Adware.Mutabaha.219, Adware.Mutabaha.219, Adware.Mutabaha.87, Adware.Mutabaha.220
69.23%

K7 AntiVirus
Unwanted-Program , Adware
61.54%

herdProtect (fuzzy)
a variant of 62ecbbea77590d693d2c6276a0a386047f1fe63a, a variant of e075a3a56b71ece32e2f190d85e708599400b3c4, a variant of 8e3e44ac943e7e537cceae2ba74d7495d9b486b7
61.54%

Trend Micro House Call
Suspicious_GEN.F47V0324, Suspicious_GEN.F47V0325, Suspicious_GEN.F47V0401, Suspicious_GEN.F47V0327
46.15%

ESET NOD32
Win32/ELEX.CE potentially unwanted (variant), Win32/ELEX.CF potentially unwanted (variant)
46.15%

Sophos
nbsp;
38.46%

VIPRE Antivirus
BehavesLike.Win32.Malware.sfd (mx-v), Trojan.Win32.Generic
38.46%

1 / 68      (Adware)

1 / 68      (Adware)
istartsurf.exe (3291_pcs_istartsurf by HYS)  (29a60dfc70f3fc86655fd48f74526735)

1 / 68      (Adware)

8 / 68      (Adware)
rbm_istartsurf.exe (3343_rbm_istartsurf by HTabp.com)  (81167a7fb78ed2e0268765e2fc06f95c)

10 / 68    (Adware)
air_istartsurf.exe (3377_air_istartsurf by HTabp.com)  (7d1b62e1ee7450b608708f1ce5a6d422)

11 / 68    (Adware)
nsa5b9a.tmp (3290_cmi_luckysearches by HYS)  (99dc4c88902f5e53091d79d5d35653ac)

10 / 68    (Adware)
Istart.exe (3339_ill_istartsurf by HTabp.com)  (5600e8edf7c6a4655ee335cdd7b21562)

10 / 68    (Adware)

9 / 68      (Adware)

7 / 68      (Adware)
HTabp.exe (3354_cmi_mystartsearch by HTabp.com)  (bcae3f477aaf01bcfbe9e58793a157fb)

7 / 68      (Adware)
vk1zei8t6j.exe (3360_exp_luckysearches by LIY)  (0ff62cfc4d810bcb3b1eae6fd860691c)

11 / 68    (Adware)
mavtkcn4oj.exe (3334_exp_luckysearches by HTabp.com)  (383935d9c151b032e17e74b4379ab1c9)

14 / 68    (Adware)
nsmb37a.tmp (3326_face_istartsurf by HYS)  (875a538b6f8d73f574a47749287fb040)

Downloads URLs for files signed by Xiaoqing Liu.

11 / 68    (Adware)

14 / 68    (Adware)

10 / 68    (Adware)

10 / 68    (Adware)

7 / 68      (Adware)

The following websites host and distribute files published by Xiaoqing Liu.

The certificates below are also signed by Xiaoqing Liu.

01D9E1C9DEA81DDCA65062CC18203480  (Aug 13, 2014 to Aug 17, 2015)

0889CED821C1220A4F950101C71E977B  (Aug 13, 2014 to Aug 17, 2015)

04EED95FE18B1B4413D68A12F53663C0  (Aug 13, 2014 to Aug 17, 2015)

0EBAB4AC38B70A33EE517D238BDE49D7  (Aug 12, 2014 to Aug 17, 2015)

The following publishers (by Authenticode signature organization name) are related.

* Note, the details and description above are based on the code signing digital signature issued to Xiaoqing Liu by DigiCert Inc on August 12, 2014 with the serial number '01fe476bb35d5c01eabe81b9438b7b75'.