home

toolbox-ndrive_x64.exe

네이버 툴박스

NHN corp.

The program is a setup application that uses the NSIS (Nullsoft Scriptable Install System) installer. The file has been seen being downloaded from software.naver.com and multiple other hosts.
Publisher:
NAVER Corp.  (signed by NHN corp.)

Product:
네이버 툴박스

Version:
1.1.0.150

MD5:
86fb2e1fbc84697171b13709bf18c20f

SHA-1:
2c90e1121487fda5b928d67c5b3381b258e673e1

SHA-256:
d051aed778d5c9e62c06020366ec4c4706e9cd675fe05fa77f43533087e0e169

Scanner detections:
0 / 68

Status:
Clean (as of last analysis)

Analysis date:
12/25/2024 5:10:32 PM UTC  (today)

File size:
3.3 MB (3,473,496 bytes)

Product version:
1.1.0.150

File type:
Executable application (Win32 EXE)

Installer:
NSIS (Nullsoft Scriptable Install System)

Digital Signature
Signed by:
NHN corp.

Authority:
VeriSign, Inc.

Valid from:
11/30/2012 9:00:00 AM

Valid to:
1/30/2015 8:59:59 AM

Subject:
CN=NHN corp., OU=Digital ID Class 3 - Microsoft Software Validation v2, O=NHN corp., L=Seongnam-si, S=Gyeonggi-do, C=KR

Issuer:
CN=VeriSign Class 3 Code Signing 2010 CA, OU=Terms of use at https://www.verisign.com/rpa (c)10, OU=VeriSign Trust Network, O="VeriSign, Inc.", C=US

Serial number:
3462054A5EFE7545487F4F1548708CB4

File PE Metadata
Compilation timestamp:
4/10/2010 9:19:31 PM

OS version:
5.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
9.0

CTPH (ssdeep):
98304:c/88u3NoDx4MLvUEInfpPf5/GYgSC75DAfwbvYU85BIBe:c/j6ob01RGYgn57088

Entry address:
0x354B

Entry point:
81, EC, D4, 02, 00, 00, 53, 55, 56, 57, 6A, 20, 33, ED, 5E, 89, 6C, 24, 18, C7, 44, 24, 10, D8, 84, 40, 00, 89, 6C, 24, 14, FF, 15, 30, 80, 40, 00, 68, 01, 80, 00, 00, FF, 15, B8, 80, 40, 00, 55, FF, 15, B0, 82, 40, 00, 6A, 08, A3, 98, 06, 47, 00, E8, 67, 27, 00, 00, 55, 68, B4, 02, 00, 00, A3, B0, 05, 47, 00, 8D, 44, 24, 38, 50, 55, 68, 1C, 86, 40, 00, FF, 15, 80, 81, 40, 00, 68, 04, 86, 40, 00, 68, A0, 85, 46, 00, E8, 35, 26, 00, 00, FF, 15, B4, 80, 40, 00, 50, BF, A0, 10, 4C, 00, 57, E8, 23, 26, 00, 00...
 
[+]

Entropy:
7.9971

Packer / compiler:
Nullsoft install system v2.x

Code size:
25 KB (25,600 bytes)

The file toolbox-ndrive_x64.exe has been seen being distributed by the following 9 URLs.

http://software.naver.com/api/.../httpDown.nhn?softwareId=MFS_105031|64|GWV_007315&key=aa7e5b5af3405135cf440343aa2a2df25560c1b6722e67aedb6b4740344ad3e869c46f9843062dcf8f823900a8c3fcc35b438e330f9b44a3526596e3c8bd0f57f07de8932e0d0a82a612577cbbc063ac4955d438d6d498532c1d13b0fdb828fa307e1e5b9fb5811ff7acd27d5e1977be46e7b238ad9d3bdb263407cdb535e54028612b476dda906a321f1da38191933e1cdcc2eca0ed175617fec65f5837c430bc434a571bc83634d89078959bcbf50f829adf7cffca300691cea334d4955c61d64c42bc8f7663ebf2376b324a8b056c5066c8cb99e1ddb54713de88224586d6870d67ae543481e8b1f9cd22a2826c6f99cebdc31716d127863db6c454a824aee7c1798cbfc97e83426e29f92c0f9b7c

http://software.naver.com/api/.../httpDown.nhn?softwareId=MFS_105031|64|GWV_007315&key=aa7e5b5af3405135cf440343aa2a2df25560c1b6722e67aedb6b4740344ad3e869c46f9843062dcf8f823900a8c3fcc35b438e330f9b44a3526596e3c8bd0f57f07de8932e0d0a82a612577cbbc063ac4955d438d6d498532c1d13b0fdb828fa307e1e5b9fb5811ff7acd27d5e1977be46e7b238ad9d3bdb263407cdb535e540b7213c58025415b496b263111de526a4317d4b068f208c7bdddd2b09744d963144642d2b6210fc4fed2a6c4afa8e41bdb57c20ad200f17c71abf0683b543503c743076ecec870938ac2ab79329b79ae0834e2c64c36486766790e4a5a37a16915743f892b1f8559d9c431b665b7e3bc1f7d9928741726b3464a5cb2b007736adb66ab93a46fba959bd493d67a8e9579e

http://software.naver.com/api/.../httpDown.nhn?softwareId=MFS_105031|64|GWV_007315&key=aa7e5b5af3405135cf440343aa2a2df25560c1b6722e67aedb6b4740344ad3e869c46f9843062dcf8f823900a8c3fcc35b438e330f9b44a3526596e3c8bd0f57f07de8932e0d0a82a612577cbbc063ac4955d438d6d498532c1d13b0fdb828fa307e1e5b9fb5811ff7acd27d5e1977be46e7b238ad9d3bdb263407cdb535e540e9c5e5fb0b741c6790fa31d2c3760d7e2c75dffd9b591e0002698fcc9e4df79078b60d47c007e7cdf0b405e21552db92d37c7b9b743faf24d135bd290d5465ecd2bbae96afd44151daf6f8405e6d15ae2430db8d90a4f2aa9827772ebe8a7f457e94c5c26d48bcf946d8e9a051d8dd21e70cf9d9294b768fe96eebf579d207369494de25984b8e2d06b1eb9791056829

http://software.naver.com/api/.../httpDown.nhn?softwareId=MFS_105031|64|GWV_007007&key=b96701c0c21651bdb7b701134d20de7353300644880b5ecfa77d878370483f1062a4b77181a8ec02f4e241a7516bb7d4236e0dca6a6724b1fa85a846d1d188e4f5ffcd826ffe4bb5629d232c31a4ba00f8f898bf3e6b5a9287445877096fd6b3facc3d47d87817e1132401545ae3b23c3ca57243f7362c24f2bcec1186259000014cdb156ea63824affba8dfd9eca1c9663e75ba9f9499a77f0b5023872a66861c5529757f0ae2e243857a927ec863b2aedb3553ee6ddc67dad150984f440695ce1361dfa352297a3adb40f748c0dec45efd2062f777b201b464220317c51e395176bf0afc234e67292c6195abb03693169dc8987af04fb970ba895ed7ece7e603e4dbd9482a58cbd9ed5c18a8372c16

http://software.naver.com/api/.../httpDown.nhn?softwareId=MFS_105031|64|GWV_007315&key=aa7e5b5af3405135cf440343aa2a2df25560c1b6722e67aedb6b4740344ad3e869c46f9843062dcf8f823900a8c3fcc35b438e330f9b44a3526596e3c8bd0f57f07de8932e0d0a82a612577cbbc063ac4955d438d6d498532c1d13b0fdb828fa307e1e5b9fb5811ff7acd27d5e1977be46e7b238ad9d3bdb263407cdb535e5400858293473d347fb506eec186f4c6448ef83948bbd5e7e32c31fbac0e053e71de7f73b46ce0a7e706cf6d4a0a26ec31d2ff65879b8392519e6637da74b0265c9df34746602b186c1134ad459164405ead203b0028c31dcfd9df65577f75ab22f985e80da8bf0ec0fa5e3b00b37895e6731136bd631347bc205951985a4ea88140f19002b311bf6727a85d52027bf2353

http://high.software.dn.naver.com/f4b6ad4977ab8009690176bd4ebbf8c8/.../Toolbox-NDrive_x64.exe

http://low.software.dn.naver.com/f4b6ad4977ab8009690176bd4ebbf8c8/.../Toolbox-NDrive_x64.exe

http://software.naver.com/api/.../httpDown.nhn?softwareId=MFS_105031|64|GWV_007315&key=aa7e5b5af3405135cf440343aa2a2df25560c1b6722e67aedb6b4740344ad3e869c46f9843062dcf8f823900a8c3fcc35b438e330f9b44a3526596e3c8bd0f57f07de8932e0d0a82a612577cbbc063ac4955d438d6d498532c1d13b0fdb828fa307e1e5b9fb5811ff7acd27d5e1977be46e7b238ad9d3bdb263407cdb535e540187c0099cf549b0813df6356f3ab125cdc61547ba1c27ba3f1329f45020e60731669a14dd25a8cc3c7c42ee0015eae44096d2219e8f6d2e94dcb7e7c0a78226e6171c27b6255385b35c85a52e21a4db5adc34beb9c48b8a56cf01ac40f6f4598d178b88f4eb5e4b67b4cd1d3dc088f67eefe29313084aba48db5f9b3ef213aa0b66ab93a46fba959bd493d67a8e9579e

http://software.naver.com/api/.../httpDown.nhn?softwareId=MFS_105031|64|GWV_007007&key=b96701c0c21651bdb7b701134d20de7353300644880b5ecfa77d878370483f1062a4b77181a8ec02f4e241a7516bb7d4236e0dca6a6724b1fa85a846d1d188e4f5ffcd826ffe4bb5629d232c31a4ba00f8f898bf3e6b5a9287445877096fd6b3facc3d47d87817e1132401545ae3b23c3ca57243f7362c24f2bcec1186259000348ccbb5da3630f59304af96e91ae7ca310b08b95a6a65b23f174474372f87c3a451f9832f704212c40bc5a42ed6648d150647445e7d85eaad39bd909ea926721a321d32267246f1816434b2c555e3a7bac74006d8277fcbda1658c11a987adfd5b630c5662bea514c87dd925e3056edbac7e158ee5c58685510ec46e263a1ea03e4dbd9482a58cbd9ed5c18a8372c16

Scan toolbox-ndrive_x64.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.