home

nexonlaunchersetup.exe

Nexon America

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from emails.icarus.nexon.net and multiple other hosts.
Publisher:
Nexon America  (signed and verified)

MD5:
8c39bec4f2bfab3c1b4baabd77d046c1

SHA-1:
55499c03e13707f28ff777ecf5b330ded44acffa

SHA-256:
190f6aa5a8e8a43371e872d6581e1a0a3445e40e4f4139ddc8abd544167dc013

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
12/26/2024 7:50:40 PM UTC  (today)

File size:
9.8 MB (10,274,904 bytes)

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Common path:
C:\users\{user}\downloads\nexonlaunchersetup.exe

Digital Signature
Signed by:
Nexon America

Authority:
Symantec Corporation

Valid from:
5/27/2015 7:00:00 AM

Valid to:
7/26/2018 6:59:59 AM

Subject:
CN=Nexon America, O=Nexon America, L=El Segundo, S=California, C=US

Issuer:
CN=Symantec Class 3 SHA256 Code Signing CA, OU=Symantec Trust Network, O=Symantec Corporation, C=US

Serial number:
04EAD2DBE06A257FF5202EA26AE5C868

File PE Metadata
Compilation timestamp:
12/6/2009 5:50:52 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
196608:vJy2sFrdkEJaymqDsA2wJ73n/BPc2pZdUjO4WaD7QelebhFSYyOb6cVG9ny2L/N:vJy2sFr2EYyqwNtc2pjUx5Ddleb5yS6N

Entry address:
0x30FA

Entry point:
81, EC, 80, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 60, 91, 40, 00, 33, F6, C6, 44, 24, 14, 20, FF, 15, 30, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B0, 70, 40, 00, 53, FF, 15, 7C, 72, 40, 00, 6A, 08, A3, 18, EC, 42, 00, E8, F1, 2B, 00, 00, A3, 64, EB, 42, 00, 53, 8D, 44, 24, 34, 68, 60, 01, 00, 00, 50, 53, 68, 98, 8F, 42, 00, FF, 15, 58, 71, 40, 00, 68, 54, 91, 40, 00, 68, 60, E3, 42, 00, E8, A4, 28, 00, 00, FF, 15, AC, 70, 40, 00, BF, 00, 40, 43, 00, 50, 57, E8, 92, 28, 00, 00...
 
[+]

Entropy:
7.9980

Packer / compiler:
Nullsoft install system v2.x

Code size:
23.5 KB (24,064 bytes)

The file nexonlaunchersetup.exe has been discovered within the following program.

Devilian Beta-US  by Trion Worlds, Inc.
About 3% of users remove it
 
Powered by Should I Remove It?

The file nexonlaunchersetup.exe has been seen being distributed by the following 20 URLs.

http://emails.icarus.nexon.net/.../35665968:s6XQDuYNw:m:1:1284273793:C351515A68C0FCA577A68511C1AB209E:r

http://emails.icarus.nexon.net/.../35751195:WkFOU2YNp:m:1:1356196889:E2CF6F9BA97309C8713635E13F8F9F42:r

http://echo3.bluehornet.com/.../30723508:sYS2eBmNK:m:1:1086387518:32EF01891B9C09C047C195ACE1175BDC:r

https://www.google.com/url?hl=en&q=http://emails.icarus.nexon.net/.../35665942:spJRhuYoN:m:1:1355022388:01069FCB8B6ABB98EE341E3E516FE680:r&source=gmail&ust=1464928511502000&usg=AFQjCNGe0YVoh-Nm7_V24_D-Py_Wo8S6jw

http://emails.icarus.nexon.net/.../35665942:WInRhuYNV:m:1:1355023247:4EBD23B95B5F4ECB20AA3B797CFE7F6E:r

http://emails.icarus.nexon.net/.../35678377:WP31FuYNk:m:1:1287630458:0DF7E5741A8CE6FE7E98D36E25A82564:r

https://www.google.com/url?hl=en&q=http://emails.icarus.nexon.net/.../35751144:s_N0U2YN6:m:1:1356198987:E98B5C92BD0E45F0A7CE3B0C40336DC8:r&source=gmail&ust=1465350150020000&usg=AFQjCNFYxrVuqt54Hfj_IRTYfD_I8Yh7Xg

https://dl.dropboxusercontent.com/u/.../NexonLauncherSetup.exe

http://emails.icarus.nexon.net/.../34907557:WPlBn4CRN:m:1:1334538789:4792AA33E2E05DBF15D46F32798E929F:r

https://www.google.com/url?hl=pt-BR&q=http://emails.icarus.nexon.net/.../35678377:WPfmFuYHN:m:1:1289891797:0A24A274F432491DFE7DB294099E0656:r&source=gmail&ust=1465318317572000&usg=AFQjCNGetV1oRRImWnl0AsQi2PoIyqcrsA

http://emails.icarus.nexon.net/.../35751195:sDN0U2YHN:m:1:1356198527:DE12292A1D2EFF79112F97A97E2BC2AB:r

https://www.google.com/url?hl=en&q=http://emails.icarus.nexon.net/.../35665942:suEOhuYNg:m:1:1284500867:6A7FD3F4D2EED0721952E16E83E85374:r&source=gmail&ust=1465375420480000&usg=AFQjCNHbD9yXSrW81Dtf0I_mEzzXLV4CGA

http://emails.icarus.nexon.net/.../35751195:WBtOU2YNF:m:1:1356196391:AD5949F80C1C4836E49C26A7910C4770:r

https://www.google.com/url?hl=es&q=http://emails.icarus.nexon.net/.../35665942:sxBRhuYNH:m:1:1355023527:3CEA4CAD14FF00BB3CBDE11DFB89AB57:r&source=gmail&ust=1465056944212000&usg=AFQjCNFv5McCM1AEfM--uTQWow1fRIUanQ

http://emails.icarus.nexon.net/.../34935893:s-4VP5C8N:m:1:1284456900:362E685E1B7054F68F0DAE8C4A481777:r

https://www.google.com/url?hl=en&q=http://emails.icarus.nexon.net/.../35751195:sfj0U2YNA:m:1:1356198292:61011472D481D2756F5CCDF60F5B4399:r&source=gmail&ust=1465340607102000&usg=AFQjCNGFEyk9ceIL6kCj92y3wWQVS_jDug

http://emails.icarus.nexon.net/.../35665942:s6yOhuYNr:m:1:1284307991:071E6F0EF1CE003FDAB5E10C92ECA88F:r

http://emails.icarus.nexon.net/.../35665968:sAzsDuYNR:m:1:1287630096:5C1DE4B98B11E3E0987B3A948F57526E:r

http://emails.icarus.nexon.net/.../34907557:WaUMn4CN4:m:1:1284372791:8FEDDFDA22104D991D556CBF7280F42B:r

http://download2.nexon.net/Game/.../NexonLauncherSetup.exe

Scan nexonlaunchersetup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.