filenameLordPE.EXE
size208896 (0x33000)
md5e59e119b3b2d3fe2a8ac8857c7dcecfc
typeMS-DOS executable PE32 executable (GUI) Intel 80386, for MS Windows, MZ for MS-DOS
mimetypeapplication/x-dosexec
clamavWin.Trojan.Agent-131328 FOUND
virustotal→ scan with virustotal.com
histogram

MZ Header

signatureMZ
bytes_in_last_block0x40
blocks_in_file1
num_relocs0
header_paragraphs2
min_extra_paragraphs4
max_extra_paragraphs0xffff
ss2
sp0x40
checksum0
ip0xe
cs0
reloc_table_offset0x1c
overlay_number0
reserved00x336e695700000000
oem_id0x2032
oem_info0x6e6f
reserved20xd21796c
reserved30xb40e240a
reserved40xba09
reserved50xb821cd1f
reserved60x21cd4c01
lfanew0xb0

Rich Header

lib idversiontimes used
484474
481682
008
19803414
1472993
10183
480473
10896612
617351

DOS stub

00000000: 57 69 6e 33 32 20 6f 6e  6c 79 21 0d 0a 24 0e b4  |Win32 only!..$..|
00000010: 09 ba 00 00 1f cd 21 b8  01 4c cd 21 b0 00 00 00  |......!..L.!....|

PE Header

SignaturePE
Machine0x14c
NumberOfSections4
TimeDateStamp0x3d586e63
PointerToSymbolTable0
NumberOfSymbols0
SizeOfOptionalHeader0xe0
Characteristics0x10f
Magic0x10b
LinkerVersion6.0
SizeOfCode0x17400
SizeOfInitializedData0x1c400
SizeOfUninitializedData0
AddressOfEntryPoint0x4340
BaseOfCode0x1000
BaseOfData0x19000
ImageBase0x400000
SectionAlignment0x1000
FileAlignment0x200
OperatingSystemVersion4.0
ImageVersion0.0
SubsystemVersion4.0
Reserved10
SizeOfImage0x36000
SizeOfHeaders0x400
CheckSum0
Subsystem2
DllCharacteristics0
SizeOfStackReserve0x100000
SizeOfStackCommit0x1000
SizeOfHeapReserve0x100000
SizeOfHeapCommit0x1000
LoaderFlags0
NumberOfRvaAndSizes0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

namevavsizeraw sizeflags
.text0x10000x172d00x17400R-X CODE
.rdata0x190000x16780x1800R-- IDATA
.data0x1b0000x3a880x3000RW- IDATA
.rsrc0x1f0000x16e500x17000R-- IDATA

Data Directory

typevasize
EXPORT00
IMPORT0x1956c0x104
RESOURCE0x1f0000x16e50
EXCEPTION00
SECURITY00
BASERELOC00
DEBUG00
ARCHITECTURE00
GLOBALPTR00
TLS00
LOAD_CONFIG00
Bound_IAT00
IAT0x190000x320
Delay_IAT00
CLR_Header00
typenamesizecp
CURSOR#13080
BITMAP#124630400
BITMAP#1272320
BITMAP#1302320
BITMAP#1322320
BITMAP#1342240
BITMAP#1352240
BITMAP#1402320
ICON#222160
DIALOG#1016740
DIALOG#10222500
DIALOG#1031660
DIALOG#1057900
DIALOG#10616060
DIALOG#10735140
DIALOG#10825440
DIALOG#10912560
DIALOG#1118120
DIALOG#1127160
DIALOG#11314140
DIALOG#1144180
DIALOG#1173980
DIALOG#11810440
DIALOG#1197220
DIALOG#1205700
DIALOG#1217480
DIALOG#1224140
DIALOG#1234880
DIALOG#1246080
DIALOG#1262400
DIALOG#13611020
DIALOG#1376340
DIALOG#1381620
DIALOG#12344240
DIALOG#12351700
DIALOG#12393540
DIALOG#23851740
DIALOG#23861940
GROUP_CURSOR#123200
GROUP_ICON#104200
module_namehintordfunction_name
MSVCRT.dll622gmtime
MSVCRT.dll724toupper
MSVCRT.dll584div
MSVCRT.dll567asctime
MSVCRT.dll666mktime
MSVCRT.dll466_timezone
MSVCRT.dll202_except_handler3
MSVCRT.dll704strncmp
MSVCRT.dll690sprintf
MSVCRT.dll695strchr
MSVCRT.dll606free
MSVCRT.dll679realloc
MSVCRT.dll657malloc
MSVCRT.dll709strstr
KERNEL32.dll773lstrcpynA
KERNEL32.dll761lstrcatA
KERNEL32.dll776lstrlenA
KERNEL32.dll68CreateProcessA
KERNEL32.dll722WideCharToMultiByte
KERNEL32.dll777lstrlenW
KERNEL32.dll372GetVersion
KERNEL32.dll403GlobalUnlock
KERNEL32.dll396GlobalLock
KERNEL32.dll385GlobalAlloc
KERNEL32.dll247GetCurrentProcess
KERNEL32.dll670TerminateProcess
KERNEL32.dll708VirtualProtectEx
KERNEL32.dll735WriteFile
KERNEL32.dll144FindClose
KERNEL32.dll157FindNextFileA
KERNEL32.dll450LoadLibraryA
KERNEL32.dll618SetFilePointer
KERNEL32.dll647SetThreadPriority
KERNEL32.dll703VirtualFree
KERNEL32.dll437IsBadReadPtr
KERNEL32.dll767lstrcmpiA
KERNEL32.dll125ExitProcess
KERNEL32.dll616SetFileAttributesA
KERNEL32.dll501OutputDebugStringA
KERNEL32.dll770lstrcpyA
KERNEL32.dll269GetFileAttributesA
KERNEL32.dll556ResumeThread
KERNEL32.dll249GetCurrentThread
KERNEL32.dll87DeleteFileA
KERNEL32.dll357GetTempPathA
KERNEL32.dll631SetPriorityClass
KERNEL32.dll711VirtualQueryEx
KERNEL32.dll764lstrcmpA
KERNEL32.dll316GetPrivateProfileStructA
KERNEL32.dll743WritePrivateProfileStructA
KERNEL32.dll245GetCurrentDirectoryA
KERNEL32.dll688UnmapViewOfFile
KERNEL32.dll483MulDiv
KERNEL32.dll336GetStartupInfoA
KERNEL32.dll67CreatePipe
KERNEL32.dll718WaitForSingleObject
KERNEL32.dll40CopyFileA
KERNEL32.dll470MapViewOfFile
KERNEL32.dll53CreateFileMappingA
KERNEL32.dll609SetEndOfFile
KERNEL32.dll741WritePrivateProfileStringA
KERNEL32.dll314GetPrivateProfileStringA
KERNEL32.dll713VirtualUnlock
KERNEL32.dll706VirtualLock
KERNEL32.dll292GetModuleFileNameA
KERNEL32.dll605SetCurrentDirectoryA
KERNEL32.dll274GetFileSize
KERNEL32.dll27CloseHandle
KERNEL32.dll495OpenProcess
KERNEL32.dll540ReadProcessMemory
KERNEL32.dll294GetModuleHandleA
KERNEL32.dll52CreateFileA
KERNEL32.dll318GetProcAddress
KERNEL32.dll745WriteProcessMemory
KERNEL32.dll248GetCurrentProcessId
KERNEL32.dll662Sleep
KERNEL32.dll536ReadFile
KERNEL32.dll307GetPriorityClass
KERNEL32.dll148FindFirstFileA
KERNEL32.dll699VirtualAlloc
KERNEL32.dll202GetCommandLineA
USER32.dll618ShowWindow
USER32.dll570SetMenuItemInfoA
USER32.dll7AppendMenuA
USER32.dll88CreatePopupMenu
USER32.dll606SetWindowTextA
USER32.dll140DestroyIcon
USER32.dll414LoadIconA
USER32.dll378InvalidateRect
USER32.dll33CharLowerA
USER32.dll408LoadBitmapA
USER32.dll556SetDlgItemTextA
USER32.dll260GetDlgItemTextA
USER32.dll324GetSysColorBrush
USER32.dll139DestroyCursor
USER32.dll544SetClassLongA
USER32.dll410LoadCursorA
USER32.dll309GetParent
USER32.dll183EnableWindow
USER32.dll350GetWindowTextA
USER32.dll181EnableMenuItem
USER32.dll396IsIconic
USER32.dll457MoveWindow
USER32.dll340GetWindowDC
USER32.dll636TrackPopupMenu
USER32.dll53CheckMenuRadioItem
USER32.dll594SetTimer
USER32.dll221GetActiveWindow
USER32.dll231GetClassInfoA
USER32.dll147DialogBoxParamA
USER32.dll213FindWindowA
USER32.dll560SetForegroundWindow
USER32.dll51CheckDlgButton
USER32.dll258GetDlgItem
USER32.dll185EndDialog
USER32.dll394IsDlgButtonChecked
USER32.dll527SendDlgItemMessageA
USER32.dll686wvsprintfA
USER32.dll227GetAsyncKeyState
USER32.dll547SetClipboardData
USER32.dll348GetWindowRect
USER32.dll603SetWindowPos
USER32.dll600SetWindowLongA
USER32.dll405KillTimer
USER32.dll403IsZoomed
USER32.dll141DestroyMenu
USER32.dll400IsWindowEnabled
USER32.dll54CheckRadioButton
USER32.dll559SetFocus
USER32.dll252GetCursorPos
USER32.dll522ScreenToClient
USER32.dll532SendMessageA
USER32.dll242GetClipboardData
USER32.dll60CloseClipboard
USER32.dll22CallWindowProcA
USER32.dll445MessageBeep
USER32.dll684wsprintfA
USER32.dll446MessageBoxA
USER32.dll47CharUpperA
USER32.dll467OpenClipboard
USER32.dll190EnumClipboardFormats
USER32.dll180EmptyClipboard
GDI32.dll293GetDeviceCaps
GDI32.dll55CreateFontIndirectA
GDI32.dll462SetBkMode
GDI32.dll499SetTextColor
GDI32.dll455SelectObject
GDI32.dll83DeleteObject
comdlg32.dll11GetSaveFileNameA
comdlg32.dll9GetOpenFileNameA
ADVAPI32.dll351RegCreateKeyExA
ADVAPI32.dll390RegSetValueExA
ADVAPI32.dll245LookupPrivilegeValueA
ADVAPI32.dll322OpenProcessToken
ADVAPI32.dll354RegDeleteKeyA
ADVAPI32.dll370RegOpenKeyExA
ADVAPI32.dll23AdjustTokenPrivileges
ADVAPI32.dll347RegCloseKey
SHELL32.dll114ShellExecuteA
SHELL32.dll72SHGetFileInfoA
SHELL32.dll18DragFinish
SHELL32.dll17DragAcceptFiles
SHELL32.dll20DragQueryFileA
COMCTL32.dll56ImageList_Remove
COMCTL32.dll67InitCommonControlsEx
COMCTL32.dll34ImageList_Destroy
COMCTL32.dll33ImageList_Create
COMCTL32.dll28ImageList_Add
COMCTL32.dll58ImageList_ReplaceIcon
procs.dll9GetProcessPathID
procs.dll1GetModuleHandleList
procs.dll7GetProcessIDList
procs.dll6GetProcessBaseSize
procs.dll4GetNumberOfModules
procs.dll5GetNumberOfProcesses
procs.dll3GetModuleSize
procs.dll2GetModulePath
procs.dll8GetProcessPath
realign.dll1RealignPE
realign.dllReBasePEImage
realign.dll4WipeReloc
16Edit.DLLHEEnterWindowLoop
16Edit.DLL2HESpecifySettings
IMAGEHLP.dll1BindImageEx
IMAGEHLP.dll24ImageRvaToVa
IMAGEHLP.dll23ImageRvaToSection
IMAGEHLP.dll2CheckSumMappedFile
IMAGEHLP.dll21ImageNtHeader
offsetsizetypecomment
0208896EXE08/13/2002 02:26:43#
15c115HTM#
offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable











everything is OK