The start exe File Malware Analysis

Technical Analysis

File Name	start.exe
File Type	PE32 executable (GUI) Intel 80386, for MS Windows
Scanner Version	1.0.214.174
Database Version	2025-04-16 07:00:16 UTC

Scan Another File

File Identification

Hash Type	Value	Action
MD5	19b26b162b522a7dda7408dc0a7b8c9b
SHA1	8857ce76af4d5a85b50cf20fda23e9620825f237
SHA256	d44ff8867a6a97b75539213aada380401c46a0b4763bfefd11279372a7630d91
SHA512	3ef82c27d497562348228fb5fed0f4040fc91ad6956c42147bfa0ca8d88c679d74bfe79bd06f4f731b16e3fe4e3364dc1d0b459984d462608cbf12e97db2ac87
ImpHash	61d8e6f750f94582c3a21788df0e047a

PE Analysis

Basic Information

▼

Icon	Hash: b8a4c86f4b6ae0d00860dfb762aff30d Fuzzy: e86457f73bcdf352ccf7af9e6dcac0b7 dHash: c8949c8de6b2aec6
Image Base	`0x00010000`
Entry Point	`0x00058624`
Compilation Time	1992-06-19 22:22:17
Checksum	0x00000000 (Actual: 0x0006041f)
OS Version	1.0
PEiD Signatures	`PE32 executable (GUI) Intel 80386, for MS Windows`
Digital Signature	No valid SignedData structure was found.
Imports	9 libraries kernel32, user32, advapi32, oleaut32, gdi32, ole32, comctl32, winspool, shell32
Exports	0 functions
Resources	41 Resources
Sections	8 Sections

PE Sections

▼

Name	Virtual Address	Virtual Size	Raw Size	Entropy	Characteristics	MD5
`CODE`	`0x00001000`	292,744 bytes	292,864 bytes	6.52 (Compressed)	`IMAGE_SCN_CNT_CODE\|IMAGE_SCN_MEM_EXECUTE\|IMAGE_SCN_MEM_READ`	`0E7FF8511EAF7AE2760F28475942FF65`
`DATA`	`0x00049000`	3,480 bytes	3,584 bytes	3.94 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`AF032AA4E9AC3507676A99BD8D881C4F`
`BSS`	`0x0004a000`	2,125 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.idata`	`0x0004b000`	8,282 bytes	8,704 bytes	4.89 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`79E5560636056CE14BA9BF00801D92B1`
`.tls`	`0x0004e000`	16 bytes	0 bytes	0.00 (Normal)	`IMAGE_SCN_MEM_READ\|IMAGE_SCN_MEM_WRITE`	`D41D8CD98F00B204E9800998ECF8427E`
`.rdata`	`0x0004f000`	24 bytes	512 bytes	0.20 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_SHARED\|IMAGE_SCN_MEM_READ`	`75D25E86DB930689210F8851D768D747`
`.reloc`	`0x00050000`	20,616 bytes	20,992 bytes	6.62 (Compressed)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_SHARED\|IMAGE_SCN_MEM_READ`	`28B418D1DE9E5A57970A273612322426`
`.rsrc`	`0x00056000`	18,432 bytes	18,432 bytes	4.28 (Normal)	`IMAGE_SCN_CNT_INITIALIZED_DATA\|IMAGE_SCN_MEM_SHARED\|IMAGE_SCN_MEM_READ`	`476EE0C2A74E2F46A7304C5A8D2169DD`

Entropy Analysis Alert

2 section(s) with elevated entropy (≥6.5) - possible compression

Resource Analysis

▼

Total Resources: 41 (16,060 bytes)

Resource Type	Count	Total Size	Percentage
RT_CURSOR	7	2,156 bytes	13.4%
RT_BITMAP	10	4,660 bytes	29%
RT_ICON	1	744 bytes	4.6%
RT_STRING	12	7,504 bytes	46.7%
RT_RCDATA	3	836 bytes	5.2%
RT_GROUP_CURSOR	7	140 bytes	0.9%
RT_GROUP_ICON	1	20 bytes	0.1%

Certificate Chain Analysis

▼

No Digital Signatures

This file is not digitally signed.

Security Implications:

Cannot verify the publisher's identity
Increased security risk when running this file
May trigger security warnings on some systems

⚠ This file either lacks a digital signature or the certificate chain could not be verified
Exercise caution when executing unsigned files from unknown sources

Certificate Verification Status

No valid SignedData structure was found.

Recommendation: Verify the file source and ensure it comes from a trusted publisher.

The start.exe File Analysis