Windows Loader.exe

info
MZ
PE
resources
imports
foremost
7zip
version info
hexdump
disasm
log
discuss
donate

filename	Windows Loader.exe
size	4021049 (0x3d5b39)
md5	323c0fd51071400b51eedb1be90a8188

type	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
mimetype	application/x-dosexec

clamav	OK
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x90
blocks_in_file	3
num_relocs	0
header_paragraphs	4
min_extra_paragraphs	0
max_extra_paragraphs	0xffff
ss	0
sp	0xb8
checksum	0
ip	0
cs	0
reloc_table_offset	0x40
overlay_number	0
reserved0	0
oem_id	0
oem_info	0
reserved2	0
reserved3	0
reserved4	0
reserved5	0
reserved6	0
lfanew	0x108

Rich Header

lib id	version	times used
126	50327	3
110	50727	43
125	50727	56
109	50727	126
95	4035	10
28	9178	1
10	8168	6
93	4035	25
1	0	515
114	50727	256
124	50727	1
120	50727	1

DOS stub

00000000: 0e 1f ba 0e 00 b4 09 cd  21 b8 01 4c cd 21 54 68  |........!..L.!Th|
00000010: 69 73 20 70 72 6f 67 72  61 6d 20 63 61 6e 6e 6f  |is program canno|
00000020: 74 20 62 65 20 72 75 6e  20 69 6e 20 44 4f 53 20  |t be run in DOS |
00000030: 6d 6f 64 65 2e 0d 0d 0a  24 00 00 00 00 00 00 00  |mode....$.......|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	3
TimeDateStamp	0x4728b2ff
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x103
Magic	0x10b
LinkerVersion	8.0
SizeOfCode	0x91000
SizeOfInitializedData	0x7000
SizeOfUninitializedData	0x18a000
AddressOfEntryPoint	0x21a9a0
BaseOfCode	0x18b000
BaseOfData	0x21c000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x223000
SizeOfHeaders	0x1000
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

UPX 2.93 (LZMA)

This file is packed with UPX. Analysis will be incomplete without unpacking.
We can unpack it for you.

»» Analyze unpacked file

Sections

name	va	vsize	raw size	flags
UPX0	0x1000	0x18a000	0	RWX UDATA
UPX1	0x18b000	0x91000	0x90600	RWX IDATA
.rsrc	0x21c000	0x7000	0x6a00	RW- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x222678	0x2d0
RESOURCE	0x21c000	0x6678
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0	0
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size	cp
PICKLE	#101	8	1252
CURSOR	#7	308	1252
CURSOR	#8	308	1252
CURSOR	#9	308	1252
ICON	#1	1384	1252
ICON	#2	2216	1252
ICON	#3	3752	1252
ICON	#4	1128	1252
ICON	#5	4264	1252
ICON	#6	9640	1252
GROUP_CURSOR	#6601	20	1252
GROUP_CURSOR	#6602	20	1252
GROUP_CURSOR	#6603	20	1252
GROUP_ICON	#102	90	1252
VERSION	#1	1888	1252
MANIFEST	#1	863	1252

module_name	ord	function_name
KERNEL32.DLL		LoadLibraryA
KERNEL32.DLL		GetProcAddress
KERNEL32.DLL		VirtualProtect
KERNEL32.DLL		VirtualAlloc
KERNEL32.DLL		VirtualFree
KERNEL32.DLL		ExitProcess
ADVAPI32.dll		RegCloseKey
COMCTL32.dll	17
comdlg32.dll		PrintDlgA
GDI32.dll		LineTo
iphlpapi.dll		GetAdaptersInfo
ole32.dll		DoDragDrop
OLEAUT32.dll	424
SHELL32.dll		DragFinish
USER32.dll		GetDC
VERSION.dll		VerQueryValueA
WINMM.dll		midiOutOpen

StringTable 040904B0

CompanyName
FileVersion	2.2.2.0
Country
Release	Final
FileDescription
LegalCopyright
ProductVersion
ProductName
OriginalFilename	Windows Loader.exe
InternalName

VS_FIXEDFILEINFO

FileVersion	2.2.2.0
ProductVersion	2.2.2.0
StrucVersion	0x10000
FileFlagsMask	0x3f
FileFlags	0xa
FileOS	4
FileType	1
FileSubtype	0

show previews

offset	size	type	comment
0	619520	EXE	10/31/2007 16:53:19	#
15c1	15	HTM		#
27d1b6	97280	EXE	07/13/2009 23:13:35	#
32ecb4	1078	BMP	(16 x 16)	#
32f0f8	1078	BMP	(16 x 16)	#
32f53c	1078	BMP	(16 x 16)	#
32f980	1078	BMP	(16 x 16)	#
32fdc4	1078	BMP	(16 x 16)	#
330208	1078	BMP	(16 x 16)	#
33064c	255434	BMP	(565 x 113)	#
36ec30	93184	DLL	09/26/2007 15:39:17	#
385859	31744	DLL	09/18/2007 11:39:06	#
38d474	31744	DLL	09/18/2007 11:39:15	#
395091	40448	DLL	04/09/2007 15:41:49	#
39eeaa	101888	DLL	10/14/2006 13:04:37	#
3b7cd7	38912	DLL	01/17/2011 18:02:02	#
3c150a	38912	DLL	01/15/2011 21:25:03	#
3cad35	44544	DLL	01/15/2011 21:25:11	#
3d5b35	4	BIN	overlay data past EOF	#

Scanning the drive for archives:
1 file, 4021049 bytes (3927 KiB)



Errors: 1

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

[?] ignoring invalid PEdump::BITMAPINFOHEADER

[!] refusing to read CURDIRENTRY beyond resource size

[?] invalid VS_VERSIONINFO child type "xml ve"