home

ntstrustdel.exe

National Tax Service

Publisher:
NTS  (signed by National Tax Service)

Product:
NTS

Version:
1.0.0.1

MD5:
b58400d16578626a7a9a2e90080b736c

SHA-1:
1d40bbbcc5a9584c1cbda7e4bd367e9725b4c6c7

SHA-256:
0bca07de4005d2b2c304a5b5acb32444c19564fb5557afeb82cd4ddae9785f97

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/22/2024 9:47:07 PM UTC  (today)

File size:
389.6 KB (398,968 bytes)

Product version:
1.0.0.0

File type:
Executable application (Win32 EXE)

Common path:
C:\users\{user}\downloads\ntstrustdel.exe

Digital Signature
Signed by:
National Tax Service

Authority:
Thawte, Inc.

Valid from:
1/13/2014 9:00:00 AM

Valid to:
2/13/2016 8:59:59 AM

Subject:
CN=National Tax Service, OU=IT Team, O=National Tax Service, L=Jongno-gu, S=SEOUL, C=KR

Issuer:
CN=Thawte Code Signing CA - G2, O="Thawte, Inc.", C=US

Serial number:
2FE33AF777B6EDBC4992D2D438FCC7EC

File PE Metadata
Compilation timestamp:
6/20/1992 7:22:17 AM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
2.25

CTPH (ssdeep):
6144:2Pn92VhEDz0csHKj9tG7lfeQ5Qidjs+4rXRY6ociGGtUC9Fn4Jc1Tvo3KR1ORNc:24VWDz0BKRQ/s+UXRNtStUcFUcBvbuz

Entry address:
0x530B4

Entry point:
55, 8B, EC, 83, C4, F0, B8, 2C, 2F, 45, 00, E8, 44, 35, FB, FF, A1, 4C, 4E, 45, 00, 8B, 00, E8, E0, DC, FF, FF, B8, 28, 31, 45, 00, E8, 9A, 84, FD, FF, B8, 74, 31, 45, 00, E8, 44, F9, FF, FF, B8, 8C, 31, 45, 00, E8, 3A, F9, FF, FF, BA, 03, 00, 00, 00, B8, A8, 31, 45, 00, E8, 2B, FC, FF, FF, B8, B8, 31, 45, 00, E8, 6D, 84, FD, FF, A1, 4C, 4E, 45, 00, 8B, 00, E8, B5, DC, FF, FF, E8, 38, 10, FB, FF, E8, 33, 10, FB, FF, 00, 00, 00, FF, FF, FF, FF, 40, 00, 00, 00, BF, F8, C8, B0, C7, D1, 20, C8, A8, C5, C3, BD...
 
[+]

Entropy:
6.6202

Developed / compiled with:
Microsoft Visual C++

Code size:
328.5 KB (336,384 bytes)

The file ntstrustdel.exe has been seen being distributed by the following URL.

https://dl.sesw.hometax.go.kr.cdnetworks.net/dn_dir/.../ntsTrustDel.exe

Scan ntstrustdel.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.