Skip to content

A tool implementing process hollowing making your PE polymorphic

Notifications You must be signed in to change notification settings

nqntmqmqmb/pePolymorpher

Repository files navigation

pePolymorpher

A tool implementing process hollowing making your PE polymorphic

Description

This tool uses the XOR operator as well as a RunPE (public) to make any PE polymorphic. No dependency is required.

Utilisation

Running pePolymorpherBuilder.exe will allow you to make your PE polymorphic :


You must enter a x64 PE which is not using .NET Framework.

Process

We will use putty.exe as an example. Openning "polymorphic.exe" will show that windows :

Every 20secs, all these steps happens:

  • calc.exe will get closed
  • Your PE will get XORed with a random key
  • XORed-PE will be injected in a new fresh generated stub
  • Stub will get runned
  • XORed-PE will get unxored
  • UnXOR-ed PE will be loaded in memory then injected to C:\\Windows\\system32\\calc.exe (you can change the host in Program.cs:89)

All of these steps are making your PE polymorphic since self md5-sum is always different.

PoC

About

A tool implementing process hollowing making your PE polymorphic

Topics

Resources

Stars

Watchers

Forks

Releases

No releases published

Packages

No packages published

Languages