StartEN[.]exe | Triage

Sharing

Copy URL Twitter E-mail

General

Target

StartEN.exe
Size

128KB
MD5

44618e0907ab643085ec7fb3143f026b
SHA1

32845ed75267500b234b398b1453fe753c1ffd3b
SHA256

76e310590686a822e9723fad540e9c711ae4e79d0fe8a50cfba2ef0442cf6626
SHA512

dcda58e83edf877c035cba834c2b4b7f75260d7ffd024165f4009976bde7b2957419b23b770d9136dfaa92381ec43510446fa07e36c090ebd06eff0646e95061
SSDEEP

3072:1z+YRKy070FZfzKTIjUgtNSbBRPPmZLGJMv:ZTMd70yTAdqPS8

Score

3^/10

Malware Config

Signatures

Unsigned PE 1 IoCs

Checks for missing Authenticode signature.

resource
StartEN.exe

Files

StartEN.exe
.exe windows x64

09468b40739de1a2ece8ec9892e4eb7a

Headers

DLL Characteristics

IMAGE_DLLCHARACTERISTICS_HIGH_ENTROPY_VA
IMAGE_DLLCHARACTERISTICS_DYNAMIC_BASE
IMAGE_DLLCHARACTERISTICS_NX_COMPAT
IMAGE_DLLCHARACTERISTICS_TERMINAL_SERVER_AWARE

File Characteristics

IMAGE_FILE_EXECUTABLE_IMAGE
IMAGE_FILE_LARGE_ADDRESS_AWARE

Imports

opencv_world451

?imwrite@cv@@YA_NAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV_InputArray@1@AEBV?$vector@HV?$allocator@H@std@@@3@@Z
?cvtColor@cv@@YAXAEBV_InputArray@1@AEBV_OutputArray@1@HH@Z
?empty@Mat@cv@@QEBA_NXZ
?split@cv@@YAXAEBV_InputArray@1@AEBV_OutputArray@1@@Z
?resize@cv@@YAXAEBV_InputArray@1@AEBV_OutputArray@1@V?$Size_@H@1@NNH@Z
?circle@cv@@YAXAEBV_InputOutputArray@1@V?$Point_@H@1@HAEBV?$Scalar_@N@1@HHH@Z
??Gcv@@YA?AVMatExpr@0@AEBVMat@0@AEBV?$Scalar_@N@0@@Z
?line@cv@@YAXAEBV_InputOutputArray@1@V?$Point_@H@1@1AEBV?$Scalar_@N@1@HHH@Z
?rectangle@cv@@YAXAEBV_InputOutputArray@1@V?$Rect_@H@1@AEBV?$Scalar_@N@1@HHH@Z
?putText@cv@@YAXAEBV_InputOutputArray@1@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@V?$Point_@H@1@HNV?$Scalar_@N@1@HH_N@Z
??Dcv@@YA?AVMatExpr@0@AEBV10@N@Z
?convertTo@Mat@cv@@QEBAXAEBV_OutputArray@2@HNN@Z
?waitKey@cv@@YAHH@Z
?flip@cv@@YAXAEBV_InputArray@1@AEBV_OutputArray@1@H@Z
??0Mat@cv@@QEAA@$$QEAV01@@Z
??0Mat@cv@@QEAA@AEBV01@@Z
??0Mat@cv@@QEAA@HHH@Z
??0Mat@cv@@QEAA@XZ
??1Mat@cv@@QEAA@XZ
??4Mat@cv@@QEAAAEAV01@$$QEAV01@@Z
??4Mat@cv@@QEAAAEAV01@AEBV01@@Z
?clone@Mat@cv@@QEBA?AV12@XZ
?imshow@cv@@YAXAEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV_InputArray@1@@Z

onnxruntime

ord1

kernel32

GetPrivateProfileStringA
GetPrivateProfileIntA
WideCharToMultiByte
Sleep
GetModuleFileNameW
InitializeSListHead
GetSystemTimeAsFileTime
GetCurrentThreadId
GetCurrentProcessId
QueryPerformanceCounter
GetModuleHandleW
IsDebuggerPresent
IsProcessorFeaturePresent
TerminateProcess
GetCurrentProcess
SetUnhandledExceptionFilter
UnhandledExceptionFilter

user32

GetDC
SetWindowPos
GetAsyncKeyState
MessageBoxA
GetForegroundWindow
FindWindowW
GetWindowRect

gdi32

BitBlt
CreateCompatibleBitmap
SelectObject
CreateCompatibleDC
GetDIBits
GetDeviceCaps
DeleteObject

msvcp140

??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@M@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@H@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@P6AAEAV01@AEAV01@@Z@Z
?setstate@?$basic_ios@DU?$char_traits@D@std@@@std@@QEAAXH_N@Z
?flush@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@XZ
?_Osfx@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAXXZ
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@I@Z
??6?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV01@_J@Z
?_Throw_Cpp_error@std@@YAXH@Z
?cout@std@@3V?$basic_ostream@DU?$char_traits@D@std@@@1@A
?uncaught_exception@std@@YA_NXZ
?_Xout_of_range@std@@YAXPEBD@Z
?_Throw_C_error@std@@YAXH@Z
?_Xlength_error@std@@YAXPEBD@Z
_Mtx_destroy_in_situ
_Mtx_lock
_Mtx_init_in_situ
_Cnd_do_broadcast_at_thread_exit
_Thrd_detach
_Mtx_unlock
?sputn@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAA_JPEBD_J@Z
?widen@?$basic_ios@DU?$char_traits@D@std@@@std@@QEBADD@Z
?put@?$basic_ostream@DU?$char_traits@D@std@@@std@@QEAAAEAV12@D@Z
?sputc@?$basic_streambuf@DU?$char_traits@D@std@@@std@@QEAAHD@Z

winmm

timeBeginPeriod
timeEndPeriod

ntdll

NtDeviceIoControlFile
RtlInitUnicodeString
RtlCaptureContext
NtCreateFile
RtlVirtualUnwind
RtlLookupFunctionEntry
NtClose

vcruntime140_1

__CxxFrameHandler4

vcruntime140

memcpy
memmove
__std_exception_copy
_purecall
__std_terminate
memset
_CxxThrowException
__C_specific_handler
__current_exception_context
__current_exception
__std_exception_destroy

api-ms-win-crt-runtime-l1-1-0

_seh_filter_exe
terminate
__p___argc
_beginthreadex
_exit
_invalid_parameter_noinfo_noreturn
_initterm_e
_initterm
_get_initial_narrow_environment
_c_exit
exit
_set_app_type
_cexit
_register_thread_local_exe_atexit_callback
_configure_narrow_argv
_initialize_narrow_environment
_initialize_onexit_table
_register_onexit_function
_crt_atexit
__p___argv

api-ms-win-crt-locale-l1-1-0

setlocale
_configthreadlocale

api-ms-win-crt-heap-l1-1-0

_callnewh
free
_set_new_mode
malloc

api-ms-win-crt-time-l1-1-0

_time64
clock

api-ms-win-crt-utility-l1-1-0

rand
srand

api-ms-win-crt-convert-l1-1-0

mbstowcs
atof
wcstombs

api-ms-win-crt-math-l1-1-0

sqrtf
expf
hypot
cosf
ceilf
atanf
tan
__setusermatherr
_hypotf
sinf

api-ms-win-crt-stdio-l1-1-0

__stdio_common_vsprintf_s
__p__commode
__stdio_common_vsprintf
_set_fmode

api-ms-win-crt-string-l1-1-0

strcmp

Exports

Exports

??$argsort@M@math@utils@ortcv@@YA?AV?$vector@IV?$allocator@I@std@@@std@@AEBV?$vector@MV?$allocator@M@std@@@4@@Z
??$argsort@M@math@utils@ortcv@@YA?AV?$vector@IV?$allocator@I@std@@@std@@PEBMI@Z
??$cosine_similarity@M@math@utils@ortcv@@YAMAEBV?$vector@MV?$allocator@M@std@@@std@@0@Z
??$softmax@M@math@utils@ortcv@@YA?AV?$vector@MV?$allocator@M@std@@@std@@AEBV34@AEAI@Z
??$softmax@M@math@utils@ortcv@@YA?AV?$vector@MV?$allocator@M@std@@@std@@PEBMIAEAI@Z
??0?$BoundingBoxType@HM@types@ortcv@@QEAA@XZ
??0?$BoundingBoxType@MM@types@ortcv@@QEAA@XZ
??0?$BoundingBoxType@NN@types@ortcv@@QEAA@XZ
??0AgeType@types@ortcv@@QEAA@XZ
??0BasicOrtHandler@core@@IEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@HHI@Z
??0ColorizeContentType@types@ortcv@@QEAA@$$QEAU012@@Z
??0ColorizeContentType@types@ortcv@@QEAA@AEBU012@@Z
??0ColorizeContentType@types@ortcv@@QEAA@XZ
??0EmotionsType@types@ortcv@@QEAA@XZ
??0EulerAnglesType@types@ortcv@@QEAA@XZ
??0FaceContentType@types@ortcv@@QEAA@$$QEAU012@@Z
??0FaceContentType@types@ortcv@@QEAA@AEBU012@@Z
??0FaceContentType@types@ortcv@@QEAA@XZ
??0GenderType@types@ortcv@@QEAA@XZ
??0ImageNetContentType@types@ortcv@@QEAA@$$QEAU012@@Z
??0ImageNetContentType@types@ortcv@@QEAA@AEBU012@@Z
??0ImageNetContentType@types@ortcv@@QEAA@XZ
??0LandmarksType@types@ortcv@@QEAA@$$QEAU012@@Z
??0LandmarksType@types@ortcv@@QEAA@AEBU012@@Z
??0LandmarksType@types@ortcv@@QEAA@XZ
??0OCRContentType@types@ortcv@@QEAA@XZ
??0SegmentContentType@types@ortcv@@QEAA@$$QEAU012@@Z
??0SegmentContentType@types@ortcv@@QEAA@AEBU012@@Z
??0SegmentContentType@types@ortcv@@QEAA@XZ
??0StyleContentType@types@ortcv@@QEAA@$$QEAU012@@Z
??0StyleContentType@types@ortcv@@QEAA@AEBU012@@Z
??0StyleContentType@types@ortcv@@QEAA@XZ
??0SuperResolutionContentType@types@ortcv@@QEAA@$$QEAU012@@Z
??0SuperResolutionContentType@types@ortcv@@QEAA@AEBU012@@Z
??0SuperResolutionContentType@types@ortcv@@QEAA@XZ
??0YoloX@ortcv@@QEAA@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@HHI@Z
??1BasicOrtHandler@core@@MEAA@XZ
??1ColorizeContentType@types@ortcv@@QEAA@XZ
??1FaceContentType@types@ortcv@@QEAA@XZ
??1ImageNetContentType@types@ortcv@@QEAA@XZ
??1LandmarksType@types@ortcv@@QEAA@XZ
??1SegmentContentType@types@ortcv@@QEAA@XZ
??1StyleContentType@types@ortcv@@QEAA@XZ
??1SuperResolutionContentType@types@ortcv@@QEAA@XZ
??1YoloX@ortcv@@UEAA@XZ
??4?$BoundingBoxType@HM@types@ortcv@@QEAAAEAU012@$$QEAU012@@Z
??4?$BoundingBoxType@HM@types@ortcv@@QEAAAEAU012@AEBU012@@Z
??4?$BoundingBoxType@MM@types@ortcv@@QEAAAEAU012@$$QEAU012@@Z
??4?$BoundingBoxType@MM@types@ortcv@@QEAAAEAU012@AEBU012@@Z
??4?$BoundingBoxType@NN@types@ortcv@@QEAAAEAU012@$$QEAU012@@Z
??4?$BoundingBoxType@NN@types@ortcv@@QEAAAEAU012@AEBU012@@Z
??4AgeType@types@ortcv@@QEAAAEAU012@$$QEAU012@@Z
??4AgeType@types@ortcv@@QEAAAEAU012@AEBU012@@Z
??4ColorizeContentType@types@ortcv@@QEAAAEAU012@$$QEAU012@@Z
??4ColorizeContentType@types@ortcv@@QEAAAEAU012@AEBU012@@Z
??4EmotionsType@types@ortcv@@QEAAAEAU012@$$QEAU012@@Z
??4EmotionsType@types@ortcv@@QEAAAEAU012@AEBU012@@Z
??4EulerAnglesType@types@ortcv@@QEAAAEAU012@$$QEAU012@@Z
??4EulerAnglesType@types@ortcv@@QEAAAEAU012@AEBU012@@Z
??4FaceContentType@types@ortcv@@QEAAAEAU012@$$QEAU012@@Z
??4FaceContentType@types@ortcv@@QEAAAEAU012@AEBU012@@Z
??4GenderType@types@ortcv@@QEAAAEAU012@$$QEAU012@@Z
??4GenderType@types@ortcv@@QEAAAEAU012@AEBU012@@Z
??4ImageNetContentType@types@ortcv@@QEAAAEAU012@$$QEAU012@@Z
??4ImageNetContentType@types@ortcv@@QEAAAEAU012@AEBU012@@Z
??4LandmarksType@types@ortcv@@QEAAAEAU012@$$QEAU012@@Z
??4LandmarksType@types@ortcv@@QEAAAEAU012@AEBU012@@Z
??4OCRContentType@types@ortcv@@QEAAAEAU012@$$QEAU012@@Z
??4OCRContentType@types@ortcv@@QEAAAEAU012@AEBU012@@Z
??4SegmentContentType@types@ortcv@@QEAAAEAU012@$$QEAU012@@Z
??4SegmentContentType@types@ortcv@@QEAAAEAU012@AEBU012@@Z
??4StyleContentType@types@ortcv@@QEAAAEAU012@$$QEAU012@@Z
??4StyleContentType@types@ortcv@@QEAAAEAU012@AEBU012@@Z
??4SuperResolutionContentType@types@ortcv@@QEAAAEAU012@$$QEAU012@@Z
??4SuperResolutionContentType@types@ortcv@@QEAAAEAU012@AEBU012@@Z
??_7BasicOrtHandler@core@@6B@
??_7YoloX@ortcv@@6B@
?__autoclassinit2@BasicOrtHandler@core@@QEAAX_K@Z
?__autoclassinit2@YoloX@ortcv@@QEAAX_K@Z
?area@?$BoundingBoxType@HM@types@ortcv@@QEBAHXZ
?area@?$BoundingBoxType@MM@types@ortcv@@QEBAMXZ
?area@?$BoundingBoxType@NN@types@ortcv@@QEBANXZ
?blending_nms@utils@ortcv@@YAXAEAV?$vector@U?$BoundingBoxType@MM@types@ortcv@@V?$allocator@U?$BoundingBoxType@MM@types@ortcv@@@std@@@std@@0MI@Z
?create_tensor@transform@utils@ortcv@@YA?AUValue@Ort@@AEBVMat@cv@@AEBV?$vector@_JV?$allocator@_J@std@@@std@@AEBUMemoryInfo@5@AEAV?$vector@MV?$allocator@M@std@@@9@I@Z
?detect@YoloX@ortcv@@QEAAXAEBVMat@cv@@AEAV?$vector@U?$BoundingBoxType@MM@types@ortcv@@V?$allocator@U?$BoundingBoxType@MM@types@ortcv@@@std@@@std@@MMII@Z
?draw_age@utils@ortcv@@YA?AVMat@cv@@AEBV34@AEAUAgeType@types@2@@Z
?draw_age_inplace@utils@ortcv@@YAXAEAVMat@cv@@AEAUAgeType@types@2@@Z
?draw_axis@utils@ortcv@@YA?AVMat@cv@@AEBV34@AEBUEulerAnglesType@types@2@MH@Z
?draw_axis_inplace@utils@ortcv@@YAXAEAVMat@cv@@AEBUEulerAnglesType@types@2@MH@Z
?draw_boxes@utils@ortcv@@YA?AVMat@cv@@AEBV34@AEBV?$vector@U?$BoundingBoxType@MM@types@ortcv@@V?$allocator@U?$BoundingBoxType@MM@types@ortcv@@@std@@@std@@@Z
?draw_boxes_inplace@utils@ortcv@@YAXAEAVMat@cv@@AEBV?$vector@U?$BoundingBoxType@MM@types@ortcv@@V?$allocator@U?$BoundingBoxType@MM@types@ortcv@@@std@@@std@@@Z
?draw_emotion@utils@ortcv@@YA?AVMat@cv@@AEBV34@AEAUEmotionsType@types@2@@Z
?draw_emotion_inplace@utils@ortcv@@YAXAEAVMat@cv@@AEAUEmotionsType@types@2@@Z
?draw_gender@utils@ortcv@@YA?AVMat@cv@@AEBV34@AEAUGenderType@types@2@@Z
?draw_gender_inplace@utils@ortcv@@YAXAEAVMat@cv@@AEAUGenderType@types@2@@Z
?draw_landmarks@utils@ortcv@@YA?AVMat@cv@@AEBV34@AEAULandmarksType@types@2@@Z
?draw_landmarks_inplace@utils@ortcv@@YAXAEAVMat@cv@@AEAULandmarksType@types@2@@Z
?generate_anchors@YoloX@ortcv@@AEAAXHHAEAV?$vector@HV?$allocator@H@std@@@std@@AEAV?$vector@UGridAndStride@ortcv@@V?$allocator@UGridAndStride@ortcv@@@std@@@4@@Z
?generate_bboxes@YoloX@ortcv@@AEAAXAEAV?$vector@U?$BoundingBoxType@MM@types@ortcv@@V?$allocator@U?$BoundingBoxType@MM@types@ortcv@@@std@@@std@@AEAV?$vector@UValue@Ort@@V?$allocator@UValue@Ort@@@std@@@4@MMM@Z
?hard_nms@utils@ortcv@@YAXAEAV?$vector@U?$BoundingBoxType@MM@types@ortcv@@V?$allocator@U?$BoundingBoxType@MM@types@ortcv@@@std@@@std@@0MI@Z
?height@?$BoundingBoxType@HM@types@ortcv@@QEBAHXZ
?height@?$BoundingBoxType@MM@types@ortcv@@QEBAMXZ
?height@?$BoundingBoxType@NN@types@ortcv@@QEBANXZ
?initialize_handler@BasicOrtHandler@core@@AEAAXXZ
?max_nms@YoloX@ortcv@@0IB
?nms@YoloX@ortcv@@AEAAXAEAV?$vector@U?$BoundingBoxType@MM@types@ortcv@@V?$allocator@U?$BoundingBoxType@MM@types@ortcv@@@std@@@std@@0MII@Z
?normalize@transform@utils@ortcv@@YA?AVMat@cv@@AEBV45@MM@Z
?normalize@transform@utils@ortcv@@YA?AVMat@cv@@AEBV45@QEBM1@Z
?normalize@transform@utils@ortcv@@YAXAEBVMat@cv@@AEAV45@MM@Z
?normalize_inplace@transform@utils@ortcv@@YAXAEAVMat@cv@@MM@Z
?normalize_inplace@transform@utils@ortcv@@YAXAEAVMat@cv@@QEBM1@Z
?offset_nms@utils@ortcv@@YAXAEAV?$vector@U?$BoundingBoxType@MM@types@ortcv@@V?$allocator@U?$BoundingBoxType@MM@types@ortcv@@@std@@@std@@0MI@Z
?print_debug_string@BasicOrtHandler@core@@AEAAXXZ
?rb@?$BoundingBoxType@HM@types@ortcv@@QEBA?AV?$Point_@H@cv@@XZ
?rb@?$BoundingBoxType@MM@types@ortcv@@QEBA?AV?$Point_@H@cv@@XZ
?rb@?$BoundingBoxType@NN@types@ortcv@@QEBA?AV?$Point_@H@cv@@XZ
?rect@?$BoundingBoxType@HM@types@ortcv@@QEBA?AV?$Rect_@H@cv@@XZ
?rect@?$BoundingBoxType@MM@types@ortcv@@QEBA?AV?$Rect_@H@cv@@XZ
?rect@?$BoundingBoxType@NN@types@ortcv@@QEBA?AV?$Rect_@H@cv@@XZ
?tl@?$BoundingBoxType@HM@types@ortcv@@QEBA?AV?$Point_@H@cv@@XZ
?tl@?$BoundingBoxType@MM@types@ortcv@@QEBA?AV?$Point_@H@cv@@XZ
?tl@?$BoundingBoxType@NN@types@ortcv@@QEBA?AV?$Point_@H@cv@@XZ
?to_string@utils@ortcv@@YA?AV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@std@@AEBV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@4@@Z
?to_wstring@utils@ortcv@@YA?AV?$basic_string@_WU?$char_traits@_W@std@@V?$allocator@_W@2@@std@@AEBV?$basic_string@DU?$char_traits@D@std@@V?$allocator@D@2@@4@@Z
?transform@YoloX@ortcv@@EEAA?AUValue@Ort@@AEBVMat@cv@@@Z
?width@?$BoundingBoxType@HM@types@ortcv@@QEBAHXZ
?width@?$BoundingBoxType@MM@types@ortcv@@QEBAMXZ
?width@?$BoundingBoxType@NN@types@ortcv@@QEBANXZ

Sections

.text
Size: 88KB - Virtual size: 87KB

IMAGE_SCN_CNT_CODE
IMAGE_SCN_MEM_EXECUTE
IMAGE_SCN_MEM_READ

.rdata
Size: 32KB - Virtual size: 32KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.data
Size: 1024B - Virtual size: 3KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ
IMAGE_SCN_MEM_WRITE

.pdata
Size: 4KB - Virtual size: 4KB

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.rsrc
Size: 512B - Virtual size: 480B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_READ

.reloc
Size: 512B - Virtual size: 164B

IMAGE_SCN_CNT_INITIALIZED_DATA
IMAGE_SCN_MEM_DISCARDABLE
IMAGE_SCN_MEM_READ

Sharing

General

Malware Config

Signatures

Files

09468b40739de1a2ece8ec9892e4eb7a

Headers

DLL Characteristics

File Characteristics

Imports

opencv_world451

onnxruntime

kernel32

user32

gdi32

msvcp140

winmm

ntdll

vcruntime140_1

vcruntime140

api-ms-win-crt-runtime-l1-1-0

api-ms-win-crt-locale-l1-1-0

api-ms-win-crt-heap-l1-1-0

api-ms-win-crt-time-l1-1-0

api-ms-win-crt-utility-l1-1-0

api-ms-win-crt-convert-l1-1-0

api-ms-win-crt-math-l1-1-0

api-ms-win-crt-stdio-l1-1-0

api-ms-win-crt-string-l1-1-0

Exports

Exports

Sections

.text Size: 88KB - Virtual size: 87KB

.rdata Size: 32KB - Virtual size: 32KB

.data Size: 1024B - Virtual size: 3KB

.pdata Size: 4KB - Virtual size: 4KB

.rsrc Size: 512B - Virtual size: 480B

.reloc Size: 512B - Virtual size: 164B

.text
Size: 88KB - Virtual size: 87KB

.rdata
Size: 32KB - Virtual size: 32KB

.data
Size: 1024B - Virtual size: 3KB

.pdata
Size: 4KB - Virtual size: 4KB

.rsrc
Size: 512B - Virtual size: 480B

.reloc
Size: 512B - Virtual size: 164B