home

startengine.exe

GSC Game World

This is a setup program which is used to install the application. The file has been seen being downloaded from s10803.chomikuj.pl and multiple other hosts.
Publisher:
GSC Game World  (signed and verified)

MD5:
5b4294db0e2537e4129c9e748a903437

SHA-1:
f389fdba410a74531d5fb23037e3dcd0b6257533

SHA-256:
b43b008c3c10c73c2e182f442162d92bc44e82da3791a1be260f43e6909d13b7

Scanner detections:
2 / 68

Status:
Clean  (2 probable false positive detections)

Explanation:
These detections are probably false positives (erroneous), the file is probably malware free.

Analysis date:
5/27/2024 9:28:09 PM UTC  (today)

Scan engine
Detection
Engine version

Trend Micro House Call
PAK_Generic.005
7.2.270

Trend Micro
PAK_Generic.005
10.465.27

File size:
25.7 KB (26,304 bytes)

File type:
Executable application (Win32 EXE)

Digital Signature
Signed by:
GSC Game World

Authority:
Thawte Consulting (Pty) Ltd.

Valid from:
4/27/2007 6:00:00 AM

Valid to:
4/27/2009 5:59:59 AM

Subject:
CN=GSC Game World, OU=Secure Application Development, O=GSC Game World, L=Kiev, S=N/A, C=UA

Issuer:
CN=Thawte Code Signing CA, O=Thawte Consulting (Pty) Ltd., C=ZA

Serial number:
0B6D9DD1CE1FAA5827CC334F84A960BA

File PE Metadata
Compilation timestamp:
10/23/2008 4:16:05 PM

OS version:
4.0

OS bitness:
Win32

Subsystem:
Windows GUI

Linker version:
8.0

CTPH (ssdeep):
384:itII/OTHEXQ01yr4/ipOA8v6MMQhFV7Dw9ScwOHJWk0Jdt0EoYVP+lJLnH:27OD019ZDMQfxk9Scw4A5n5WLH

Entry address:
0xE780

Entry point:
60, BE, 00, A0, 40, 00, 8D, BE, 00, 70, FF, FF, 57, EB, 0B, 90, 8A, 06, 46, 88, 07, 47, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 72, ED, B8, 01, 00, 00, 00, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C0, 01, DB, 73, EF, 75, 09, 8B, 1E, 83, EE, FC, 11, DB, 73, E4, 31, C9, 83, E8, 03, 72, 0D, C1, E0, 08, 8A, 06, 46, 83, F0, FF, 74, 74, 89, C5, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB, 11, C9, 75, 20, 41, 01, DB, 75, 07, 8B, 1E, 83, EE, FC, 11, DB...
 
[+]

Packer / compiler:
UPX v0.89.6 - v1.02 / v1.05 -v1.24

Code size:
20 KB (20,480 bytes)

The file startengine.exe has been seen being distributed by the following 3 URLs.

http://s10803.chomikuj.pl/File.aspx?e=m2OSsdlyVHda6hJCy9-qSqbZVyw9oA089Q1zVqPCoH65L45hvZT-L8iY3vFCZpE9EIiYqxdV6CgP8Nh6RpPSVR7qFokr83tiYvXhOE23ax18A0CPphvA55ydOLhj9eF0w6Om6qHi1800Ac99QTOW6Q&pv=2

http://s10803.chomikuj.pl/File.aspx?e=m2OSsdlyVHda6hJCy9-qSqbZVyw9oA089Q1zVqPCoH5SfcVa1OMv3EZPi7jkbRVQ9OwSC5yMPPuc_whJXH_kfFVH6AU8ikDHfXFKO9GkNkJY3gVjv1Nnt7BU8mMHUKQovm4orLtW5PXyJDASK1tL0g&pv=2

http://s10803.chomikuj.pl/File.aspx?e=m2OSsdlyVHda6hJCy9-qSqbZVyw9oA089Q1zVqPCoH5Pwb5YAtRWrzDPd7A4YpFt_N8sf-iKoSO87gTgX-rpXd7AHFGIv8e6AFjiQGG5enwhv6SXMZfgmHgAxyznwhVKd79MbuPYLBk5freZHFRnjA&pv=2

Scan startengine.exe - Powered by Reason Core Security
herdProtect is a second line of defense malware removal platform powered by 68 anti-malware engines in the cloud. Since no single anti-malware program is perfect 100% of the time, herdProtect utilizes a 'herd' of multiple engines to guarantee the widest coverage and the earliest possible detection.