home

setup.exe

Between

VCNC Co., Ltd.

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from software.naver.com and multiple other hosts.
Publisher:
VCNC  (signed by VCNC Co., Ltd.)

Product:
Between

Description:
Between for PC Installer

Version:
0.4.0.0

MD5:
8a6a8ef315a29b7b2c290349140db682

SHA-1:
40181bce4c3f02757d364783eab4fdbc72a118f2

SHA-256:
a93ce725458df02cd7ae64c36502037f7912ebd6f049079bae2bdc1f0b9e2af6

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
11/15/2024 7:45:45 AM UTC  (today)

File size:
26.8 MB (28,050,688 bytes)

Product version:
0.4.0.0

Copyright:
(C) 2014-2015 VCNC Inc.

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Language:
English (United States)

Common path:
C:\users\{user}\downloads\setup.exe

Digital Signature
Signed by:
VCNC Co., Ltd.

Authority:
DigiCert Inc

Valid from:
10/21/2015 8:00:00 AM

Valid to:
10/17/2016 8:00:00 PM

Subject:
CN="VCNC Co., Ltd.", O="VCNC Co., Ltd.", L=Seoul, S=Seoul-t'ukpyolsi, C=KR

Issuer:
CN=DigiCert SHA2 Assured ID Code Signing CA, OU=www.digicert.com, O=DigiCert Inc, C=US

Serial number:
0713ED52602EFD31B27C7E743FDAECED

File PE Metadata
Compilation timestamp:
10/7/2014 12:40:17 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
6.0

CTPH (ssdeep):
786432:+UWEgXxDsE2E/JVwC7iXmsUieMG23/qzsNBkTz41Bu:+dbxwEhXomIG23/qzsNBk/0c

Entry address:
0x3217

Entry point:
81, EC, 84, 01, 00, 00, 53, 55, 56, 33, DB, 57, 89, 5C, 24, 18, C7, 44, 24, 10, 30, 91, 40, 00, 89, 5C, 24, 20, C6, 44, 24, 14, 20, FF, 15, 34, 70, 40, 00, 68, 01, 80, 00, 00, FF, 15, B4, 70, 40, 00, 53, FF, 15, 8C, 72, 40, 00, 6A, 09, A3, B8, 37, 42, 00, E8, C0, 2D, 00, 00, A3, 04, 37, 42, 00, 53, 8D, 44, 24, 38, 68, 60, 01, 00, 00, 50, 53, 68, B8, EC, 41, 00, FF, 15, 64, 71, 40, 00, 68, E4, 91, 40, 00, 68, 00, 2F, 42, 00, E8, 6A, 2A, 00, 00, FF, 15, B0, 70, 40, 00, BD, 00, 90, 42, 00, 50, 55, E8, 58, 2A...
 
[+]

Entropy:
7.9980

Packer / compiler:
Nullsoft install system v2.x

Code size:
23 KB (23,552 bytes)

The file setup.exe has been seen being distributed by the following 8 URLs.

http://software.naver.com/api/.../httpDown.nhn?softwareId=GWS_000734|all|GWV_007604&key=7d6800ad77eee1727d9c743f101da231a25fa41f8735f4cc5e13481e2901198e1a285d661115e31b6a7248e29bfec02fd61176d1a29454e52292fb811aa0fe0fdc48ae8db1d121e4cfa048a58de1ad615986a38948eac6ef8641f689de00ff86e4eaa9ea742ef580750e785e3cd9c41831a0b9aa8af9dcda70c38c64021806bb6c6e6297423f7278827265b56e0cc454dc5a71aa4f4973cf9e3c423756bb979b7d707e06ab7b47764336d7907d590a2ecc1163ef17c24a11305401a0e6ebbffb7c61d532af3ea5e4f16fd0040f418e04bb6ea0c745a5228f671b91c9d08f42d1b96f3ad19a7ad0d7912d3c2f3817f49abb714e97a60a9b5c862040142662ba98

http://platform.nexon.com/NGM/.../Setup.exe

http://software.naver.com/api/.../httpDown.nhn?softwareId=GWS_000734|all|GWV_007604&key=a3c073eb9ba09f5b36c1fcc25e14cbb1a3dd8facb8bd3feb13b5298e72f4c06ef707503b5c3a6281b3ea04bebae848c932eb2cd7d387e20ab273f40d7ff4b27cda77f8aaa9ccc864bf67aeedc5a7c8f665506f1461baff0e96e1213f438dc22cc487d2798c77a78013017c3257cd8356f3100e133a353d92be940d435a44d032669b00c15f2a4e90481c65050367cf29a3c6fdf1d336e4e6eff78937538d7cb2e7adb567ecc204093ff3f83bcd310090f48c9f17c4a7ed6ef1af213cb751bafa590013d18c864fbd725fa60c828303145dd832861aa9f86776592921973a35f3a78f91fc4b9bf22b7a3a9a33831f66fc49b4bbb23a9c9f8d01ca381706ea153b

http://high.software.dn.naver.com/f4b6ad4977ab8009690176bd4ebbf8c8/.../setup.exe

http://low.software.dn.naver.com/f4b6ad4977ab8009690176bd4ebbf8c8/.../setup.exe

http://www.flvplayerapp.com/default/ga/.../?dl=1

http://ads.adtrace.org/www/delivery/ck.php?oaparams=2__bannerid=163__zoneid=36__cb=da06695b3d__oadest=http://ttb.downloadsetup.com/download/request/.../wkObJ47b?ClickID=&PubID=800440

http://assets-pc.between.us/.../setup.exe

Scan setup.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.