LordPE.EXE - Win.Trojan.Agent-131328

info
MZ
PE
resources
imports
foremost
hexdump
disasm
log
discuss
donate

filename	LordPE.EXE
size	208896 (0x33000)
md5	e59e119b3b2d3fe2a8ac8857c7dcecfc

type	MS-DOS executable PE32 executable (GUI) Intel 80386, for MS Windows, MZ for MS-DOS
mimetype	application/x-dosexec

clamav	Win.Trojan.Agent-131328 FOUND
virustotal	→ scan with virustotal.com

histogram

MZ Header

signature	MZ
bytes_in_last_block	0x40
blocks_in_file	1
num_relocs	0
header_paragraphs	2
min_extra_paragraphs	4
max_extra_paragraphs	0xffff
ss	2
sp	0x40
checksum	0
ip	0xe
cs	0
reloc_table_offset	0x1c
overlay_number	0
reserved0	0x336e695700000000
oem_id	0x2032
oem_info	0x6e6f
reserved2	0xd21796c
reserved3	0xb40e240a
reserved4	0xba09
reserved5	0xb821cd1f
reserved6	0x21cd4c01
lfanew	0xb0

Rich Header

lib id	version	times used
4	8447	4
4	8168	2
0	0	8
19	8034	14
14	7299	3
1	0	183
4	8047	3
10	8966	12
6	1735	1

DOS stub

00000000: 57 69 6e 33 32 20 6f 6e  6c 79 21 0d 0a 24 0e b4  |Win32 only!..$..|
00000010: 09 ba 00 00 1f cd 21 b8  01 4c cd 21 b0 00 00 00  |......!..L.!....|

PE Header

Signature	PE
Machine	0x14c
NumberOfSections	4
TimeDateStamp	0x3d586e63
PointerToSymbolTable	0
NumberOfSymbols	0
SizeOfOptionalHeader	0xe0
Characteristics	0x10f
Magic	0x10b
LinkerVersion	6.0
SizeOfCode	0x17400
SizeOfInitializedData	0x1c400
SizeOfUninitializedData	0
AddressOfEntryPoint	0x4340
BaseOfCode	0x1000
BaseOfData	0x19000
ImageBase	0x400000
SectionAlignment	0x1000
FileAlignment	0x200
OperatingSystemVersion	4.0
ImageVersion	0.0
SubsystemVersion	4.0
Reserved1	0
SizeOfImage	0x36000
SizeOfHeaders	0x400
CheckSum	0
Subsystem	2
DllCharacteristics	0
SizeOfStackReserve	0x100000
SizeOfStackCommit	0x1000
SizeOfHeapReserve	0x100000
SizeOfHeapCommit	0x1000
LoaderFlags	0
NumberOfRvaAndSizes	0x10

Packer / Compiler

MS Visual C++ v6.0

Sections

name	va	vsize	raw size	flags
.text	0x1000	0x172d0	0x17400	R-X CODE
.rdata	0x19000	0x1678	0x1800	R-- IDATA
.data	0x1b000	0x3a88	0x3000	RW- IDATA
.rsrc	0x1f000	0x16e50	0x17000	R-- IDATA

Data Directory

type	va	size
EXPORT	0	0
IMPORT	0x1956c	0x104
RESOURCE	0x1f000	0x16e50
EXCEPTION	0	0
SECURITY	0	0
BASERELOC	0	0
DEBUG	0	0
ARCHITECTURE	0	0
GLOBALPTR	0	0
TLS	0	0
LOAD_CONFIG	0	0
Bound_IAT	0	0
IAT	0x19000	0x320
Delay_IAT	0	0
CLR_Header	0	0

show previews

type	name	size
CURSOR	#1	308
BITMAP	#124	63040
BITMAP	#127	232
BITMAP	#130	232
BITMAP	#132	232
BITMAP	#134	224
BITMAP	#135	224
BITMAP	#140	232
ICON	#2	2216
DIALOG	#101	674
DIALOG	#102	2250
DIALOG	#103	166
DIALOG	#105	790
DIALOG	#106	1606
DIALOG	#107	3514
DIALOG	#108	2544
DIALOG	#109	1256
DIALOG	#111	812
DIALOG	#112	716
DIALOG	#113	1414
DIALOG	#114	418
DIALOG	#117	398
DIALOG	#118	1044
DIALOG	#119	722
DIALOG	#120	570
DIALOG	#121	748
DIALOG	#122	414
DIALOG	#123	488
DIALOG	#124	608
DIALOG	#126	240
DIALOG	#136	1102
DIALOG	#137	634
DIALOG	#138	162
DIALOG	#1234	424
DIALOG	#1235	170
DIALOG	#1239	354
DIALOG	#2385	174
DIALOG	#2386	194
GROUP_CURSOR	#123	20
GROUP_ICON	#104	20

module_name	hint	function_name
MSVCRT.dll	622	gmtime
MSVCRT.dll	724	toupper
MSVCRT.dll	584	div
MSVCRT.dll	567	asctime
MSVCRT.dll	666	mktime
MSVCRT.dll	466	_timezone
MSVCRT.dll	202	_except_handler3
MSVCRT.dll	704	strncmp
MSVCRT.dll	690	sprintf
MSVCRT.dll	695	strchr
MSVCRT.dll	606	free
MSVCRT.dll	679	realloc
MSVCRT.dll	657	malloc
MSVCRT.dll	709	strstr
KERNEL32.dll	773	lstrcpynA
KERNEL32.dll	761	lstrcatA
KERNEL32.dll	776	lstrlenA
KERNEL32.dll	68	CreateProcessA
KERNEL32.dll	722	WideCharToMultiByte
KERNEL32.dll	777	lstrlenW
KERNEL32.dll	372	GetVersion
KERNEL32.dll	403	GlobalUnlock
KERNEL32.dll	396	GlobalLock
KERNEL32.dll	385	GlobalAlloc
KERNEL32.dll	247	GetCurrentProcess
KERNEL32.dll	670	TerminateProcess
KERNEL32.dll	708	VirtualProtectEx
KERNEL32.dll	735	WriteFile
KERNEL32.dll	144	FindClose
KERNEL32.dll	157	FindNextFileA
KERNEL32.dll	450	LoadLibraryA
KERNEL32.dll	618	SetFilePointer
KERNEL32.dll	647	SetThreadPriority
KERNEL32.dll	703	VirtualFree
KERNEL32.dll	437	IsBadReadPtr
KERNEL32.dll	767	lstrcmpiA
KERNEL32.dll	125	ExitProcess
KERNEL32.dll	616	SetFileAttributesA
KERNEL32.dll	501	OutputDebugStringA
KERNEL32.dll	770	lstrcpyA
KERNEL32.dll	269	GetFileAttributesA
KERNEL32.dll	556	ResumeThread
KERNEL32.dll	249	GetCurrentThread
KERNEL32.dll	87	DeleteFileA
KERNEL32.dll	357	GetTempPathA
KERNEL32.dll	631	SetPriorityClass
KERNEL32.dll	711	VirtualQueryEx
KERNEL32.dll	764	lstrcmpA
KERNEL32.dll	316	GetPrivateProfileStructA
KERNEL32.dll	743	WritePrivateProfileStructA
KERNEL32.dll	245	GetCurrentDirectoryA
KERNEL32.dll	688	UnmapViewOfFile
KERNEL32.dll	483	MulDiv
KERNEL32.dll	336	GetStartupInfoA
KERNEL32.dll	67	CreatePipe
KERNEL32.dll	718	WaitForSingleObject
KERNEL32.dll	40	CopyFileA
KERNEL32.dll	470	MapViewOfFile
KERNEL32.dll	53	CreateFileMappingA
KERNEL32.dll	609	SetEndOfFile
KERNEL32.dll	741	WritePrivateProfileStringA
KERNEL32.dll	314	GetPrivateProfileStringA
KERNEL32.dll	713	VirtualUnlock
KERNEL32.dll	706	VirtualLock
KERNEL32.dll	292	GetModuleFileNameA
KERNEL32.dll	605	SetCurrentDirectoryA
KERNEL32.dll	274	GetFileSize
KERNEL32.dll	27	CloseHandle
KERNEL32.dll	495	OpenProcess
KERNEL32.dll	540	ReadProcessMemory
KERNEL32.dll	294	GetModuleHandleA
KERNEL32.dll	52	CreateFileA
KERNEL32.dll	318	GetProcAddress
KERNEL32.dll	745	WriteProcessMemory
KERNEL32.dll	248	GetCurrentProcessId
KERNEL32.dll	662	Sleep
KERNEL32.dll	536	ReadFile
KERNEL32.dll	307	GetPriorityClass
KERNEL32.dll	148	FindFirstFileA
KERNEL32.dll	699	VirtualAlloc
KERNEL32.dll	202	GetCommandLineA
USER32.dll	618	ShowWindow
USER32.dll	570	SetMenuItemInfoA
USER32.dll	7	AppendMenuA
USER32.dll	88	CreatePopupMenu
USER32.dll	606	SetWindowTextA
USER32.dll	140	DestroyIcon
USER32.dll	414	LoadIconA
USER32.dll	378	InvalidateRect
USER32.dll	33	CharLowerA
USER32.dll	408	LoadBitmapA
USER32.dll	556	SetDlgItemTextA
USER32.dll	260	GetDlgItemTextA
USER32.dll	324	GetSysColorBrush
USER32.dll	139	DestroyCursor
USER32.dll	544	SetClassLongA
USER32.dll	410	LoadCursorA
USER32.dll	309	GetParent
USER32.dll	183	EnableWindow
USER32.dll	350	GetWindowTextA
USER32.dll	181	EnableMenuItem
USER32.dll	396	IsIconic
USER32.dll	457	MoveWindow
USER32.dll	340	GetWindowDC
USER32.dll	636	TrackPopupMenu
USER32.dll	53	CheckMenuRadioItem
USER32.dll	594	SetTimer
USER32.dll	221	GetActiveWindow
USER32.dll	231	GetClassInfoA
USER32.dll	147	DialogBoxParamA
USER32.dll	213	FindWindowA
USER32.dll	560	SetForegroundWindow
USER32.dll	51	CheckDlgButton
USER32.dll	258	GetDlgItem
USER32.dll	185	EndDialog
USER32.dll	394	IsDlgButtonChecked
USER32.dll	527	SendDlgItemMessageA
USER32.dll	686	wvsprintfA
USER32.dll	227	GetAsyncKeyState
USER32.dll	547	SetClipboardData
USER32.dll	348	GetWindowRect
USER32.dll	603	SetWindowPos
USER32.dll	600	SetWindowLongA
USER32.dll	405	KillTimer
USER32.dll	403	IsZoomed
USER32.dll	141	DestroyMenu
USER32.dll	400	IsWindowEnabled
USER32.dll	54	CheckRadioButton
USER32.dll	559	SetFocus
USER32.dll	252	GetCursorPos
USER32.dll	522	ScreenToClient
USER32.dll	532	SendMessageA
USER32.dll	242	GetClipboardData
USER32.dll	60	CloseClipboard
USER32.dll	22	CallWindowProcA
USER32.dll	445	MessageBeep
USER32.dll	684	wsprintfA
USER32.dll	446	MessageBoxA
USER32.dll	47	CharUpperA
USER32.dll	467	OpenClipboard
USER32.dll	190	EnumClipboardFormats
USER32.dll	180	EmptyClipboard
GDI32.dll	293	GetDeviceCaps
GDI32.dll	55	CreateFontIndirectA
GDI32.dll	462	SetBkMode
GDI32.dll	499	SetTextColor
GDI32.dll	455	SelectObject
GDI32.dll	83	DeleteObject
comdlg32.dll	11	GetSaveFileNameA
comdlg32.dll	9	GetOpenFileNameA
ADVAPI32.dll	351	RegCreateKeyExA
ADVAPI32.dll	390	RegSetValueExA
ADVAPI32.dll	245	LookupPrivilegeValueA
ADVAPI32.dll	322	OpenProcessToken
ADVAPI32.dll	354	RegDeleteKeyA
ADVAPI32.dll	370	RegOpenKeyExA
ADVAPI32.dll	23	AdjustTokenPrivileges
ADVAPI32.dll	347	RegCloseKey
SHELL32.dll	114	ShellExecuteA
SHELL32.dll	72	SHGetFileInfoA
SHELL32.dll	18	DragFinish
SHELL32.dll	17	DragAcceptFiles
SHELL32.dll	20	DragQueryFileA
COMCTL32.dll	56	ImageList_Remove
COMCTL32.dll	67	InitCommonControlsEx
COMCTL32.dll	34	ImageList_Destroy
COMCTL32.dll	33	ImageList_Create
COMCTL32.dll	28	ImageList_Add
COMCTL32.dll	58	ImageList_ReplaceIcon
procs.dll	9	GetProcessPathID
procs.dll	1	GetModuleHandleList
procs.dll	7	GetProcessIDList
procs.dll	6	GetProcessBaseSize
procs.dll	4	GetNumberOfModules
procs.dll	5	GetNumberOfProcesses
procs.dll	3	GetModuleSize
procs.dll	2	GetModulePath
procs.dll	8	GetProcessPath
realign.dll	1	RealignPE
realign.dll		ReBasePEImage
realign.dll	4	WipeReloc
16Edit.DLL		HEEnterWindowLoop
16Edit.DLL	2	HESpecifySettings
IMAGEHLP.dll	1	BindImageEx
IMAGEHLP.dll	24	ImageRvaToVa
IMAGEHLP.dll	23	ImageRvaToSection
IMAGEHLP.dll	2	CheckSumMappedFile
IMAGEHLP.dll	21	ImageNtHeader

show previews

offset	size	type	comment
0	208896	EXE	08/13/2002 02:26:43	#
15c1	15	HTM		#

offset:( 0x )size:( 0x )hotkeys:-=[]<>, offset/size fields are also editable

Please donate some bucks to keep this site up and running:
Ko-fi
Yandex.Money
Thank you!

everything is OK

LordPE.EXE- Win.Trojan.Agent-131328

MZ Header

Rich Header

DOS stub

PE Header

Packer / Compiler

Sections

Data Directory

LordPE.EXE
- Win.Trojan.Agent-131328