home

setup.exe

Nexon Game Manager

NEXON Korea Corporation.

Publisher:
Nexon  (signed by NEXON Korea Corporation.)

Product:
Nexon Game Manager

Version:
1, 0, 1, 26853

MD5:
c009c6985399bf26ec9f3e2b221cca65

SHA-1:
71f76ce2260520f1ac7dc3420a3c1f2271177d44

SHA-256:
479eb8509400b4f8c8a29651e016f40cb26247a172ed04e777f43846d5eafcf0

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
4/20/2024 3:29:55 PM UTC  (today)

File size:
11.8 MB (12,407,056 bytes)

Product version:
1, 0, 1, 26853

Copyright:
(c)Nexon Corporation. All rights reserverd.

Original file name:
NGMSetup.exe

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\appdata\local\microsoft\windows\temporary internet files\content.ie5\{random}\setup.exe

Digital Signature
Signed by:
NEXON Korea Corporation.

Authority:
Symantec Corporation

Valid from:
1/19/2016 9:00:00 AM

Valid to:
2/18/2019 8:59:59 AM

Subject:
CN=NEXON Korea Corporation., O=NEXON Korea Corporation., L=Gangnam-gu, S=Seoul, C=KR

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
3C9F5BA47A07D8DD185FCA39CF5CFBF4

File PE Metadata
Compilation timestamp:
3/28/2016 12:23:56 PM

OS version:
5.1

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
14.0

CTPH (ssdeep):
196608:D3T2N9+amL5Hk+7+l5Hdm6xXh2dBvGN9T64ZmD3T2N9+c:bL15Hi5HrhIoNoVLc

Entry address:
0x68BA

Entry point:
E8, 6F, 04, 00, 00, E9, 80, FE, FF, FF, 55, 8B, EC, 81, EC, 24, 03, 00, 00, 53, 56, 6A, 17, E8, 9E, 02, 01, 00, 85, C0, 74, 05, 8B, 4D, 08, CD, 29, 33, F6, 8D, 85, DC, FC, FF, FF, 68, CC, 02, 00, 00, 56, 50, 89, 35, 0C, 3F, 42, 00, E8, F7, 12, 00, 00, 83, C4, 0C, 89, 85, 8C, FD, FF, FF, 89, 8D, 88, FD, FF, FF, 89, 95, 84, FD, FF, FF, 89, 9D, 80, FD, FF, FF, 89, B5, 7C, FD, FF, FF, 89, BD, 78, FD, FF, FF, 66, 8C, 95, A4, FD, FF, FF, 66, 8C, 8D, 98, FD, FF, FF, 66, 8C, 9D, 74, FD, FF, FF, 66, 8C, 85, 70, FD...
 
[+]

Entropy:
6.8409

Code size:
90.5 KB (92,672 bytes)

The file setup.exe has been seen being distributed by the following URL.

http://platform.nexon.com/NGM/.../Setup.exe

Scan setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.