Cert Graveyard Report

Certificate Signer: Amir Dow
Certificate Serial: 46 4C 3D B5 14 5E F8 3C 75 3F 87 57 F3 5F 34 FA

All Cert Graveyard entries are considered malware. Other files by the same certificate serial number should be considered suspect.

Malware Family:

Unknown, high risk

SHA256 Hash:

f4e255dfdf3d23774b0067797cac0f986f1690abbeec217eb60029dcaa7425f8

Certificate Serial:

46 4C 3D B5 14 5E F8 3C 75 3F 87 57 F3 5F 34 FA

Certificate Signer:

Amir Dow

Certificate Issuer:

Sectigo Public Code Signing CA R36

Valid From:

2025-11-26 00:00:00

Valid To:

2028-11-25 23:59:00

Reported:

2026-06-16 01:51:39 UTC

Notes:

This uses a signing certificate issued by an individual Amir Dow who offers OV certificates to anyone on Fiverr. If possible getting his ability revoked to do so may help prevent future infections: https://www.fiverr.com/amirdow Whilst previously being seen issued to fake QuickBook variants it seems he has issued some now for a "document viewer" which is giving all the same vibes as FakePDF readers have in the past. They are just changing which exe their website serves from day to day so this may become malicious in the future.