Tag Archives: Certum

Semen Korzuba – VirusTotal: 33% Detection – MultiPlug, Trj/Genetic.gen

August 11, 2015digital signatureCertum, UkraineRoger Karlsson

Hello! Just a short post before I call it a day. I found yet another file that bundled a bunch of unwanted programs, and the file was signed by Semen Korzuba.

Windows will display Semen Korzuba as the publisher when running the file. The certificate is issued by Certum Code Signing CA.

The VirusTotal report shows that the Semen Korzuba file should be avoided, since Download Uc Browser V Handler Zip.exe is detected as TR/Dropper.Gen by Avira, a variant of Win32/Adware.MultiPlug.NU by ESET-NOD32, PUP.Optional.Multiplug by Malwarebytes, Trj/Genetic.gen by Panda and MultiPlug (v) by VIPRE.

Did you also find a file digitally signed by Semen Korzuba? Where did you find it and are the anti-virus programs detecting it? Please share in the comments below.

Thanks for reading.

Vladimir Suvorov – 46% Detection – InstalleRex / MPlug / MultiPlug

August 10, 2015digital signatureCertum, PolandRoger Karlsson

Hi there! Just a note on a publisher called Vladimir Suvorov. The Vladimir Suvorov download – Download Uc Browser V Handler Zip.exe – was detected when I uploaded it to VirusTotal. Did you also find a download by Vladimir Suvorov? Was it also detected when you uploaded it to VirusTotal?

Here how Vladimir Suvorov appears in the UAC dialog when double-clicking on the Download Uc Browser V Handler Zip.exe file:

The certificate is issued by Certum Code Signing CA and mr. Suvorov is located in Poland:

The problem with the Vladimir Suvorov file is that it is detected by many of the anti-viruses. Here are some of the detection names: Generic6.BRAN, W32/S-a2e0b166!Eldorado, Gen:Variant.Adware.MPlug, SoftwareBundler:Win32/InstalleRex and MultiPlug (v).

Did you also find a Vladimir Suvorov file?

Thank you for reading.

Taras Lapin – 16% Detection Rate According to VirusTotal

August 4, 2015digital signatureCertum, RussiaRoger Karlsson

Hi there! If you’ve been following me for the last year you know that I’ve been examining many software publishers that put a digital signature on their downloads. Today I found another publisher called Taras Lapin.

If you have a Taras Lapin file on your machine you may have noticed that Taras Lapin is displayed as the publisher in the UAC dialog when double-clicking on the file.

The certificate is issued by Certum Code Signing CA.

9 of the scanners detected the file. Some of the detection names for the Download Uc Browser V Handler Zip.exe file are Trojan.Crossrider1.45643, PUA.Multiplug, Multiplug-FAJ and MultiPlug (v).

Did you also find an Taras Lapin? Do you remember the download link? Please post it in the comments below and I’ll upload it to VirusTotal to see if that one is also detected.

Thanks for reading.

MICHAIL SUDAREV – 16% Anti-Virus Detection Rate

August 4, 2015digital signatureCertumRoger Karlsson

Hello readers! Did you just find a file that’s digitally signed by MICHAIL SUDAREV and came here to find more about it?

Windows will display MICHAIL SUDAREV as the publisher when running the file. The certificate is issued by Certum Code Signing CA.

The cert mentions SPD CGISOFT ltd. Certum Trusted Network CA is the root in the certificate chain:

So, what does the anti-virus programs say about the MICHAIL SUDAREV file? No problem, I just uploaded the file to VirusTotal and it turned out that some of the anti-virus programs detects the MICHAIL SUDAREV file, with names such as Win32:Evo-gen [Susp], TR/Crypt.XPACK.Gen, SoftwareBundler:Win32/InstalleRex and MultiPlug (v).

Did you also find a MICHAIL SUDAREV download? What kind of download was it?

Hope this blog post helped you avoid some unwanted software on your machine.

Thank you for reading.

Simon Leshchuk – 39% Detection – MPlug / MultiPlug says VirusTotal

August 2, 2015UncategorizedCertum, UkraineRoger Karlsson

Hello readers! Just a short note on a publisher called Simon Leshchuk.

It is also possible to check a digital signature by looking at a file’s properties. Here’s a screenshot of the Simon Leshchuk certificate. Simon is located in Ukraine.

The Certum CA has issued the certificate to mr Leshchuk as you can see in the certification path below:

The reason for posting about Simon Leshchuk is that the file is detected by many of the anti-virus programs. Arcabit detects Download.exe as Trojan.Adware.MPlug.65, Avira detects it as TR/Crypt.XPACK.Gen, F-Secure calls it Gen:Variant.Adware.MPlug, K7AntiVirus calls it Unwanted-Program ( 004c5f5e1 ) and Malwarebytes detects it as PUP.Optional.Multiplug.

Did you also find a Simon Leshchuk file? What kind of download was it? If you remember the download link, please post it in the comments below.

Thanks for reading.