Case Study 15: PE packer

Case Study 15: PE packer

1. Basic Packers: Easy As Pie

Throughout Trustwave SpiderLabs' many forensicinvestigations, we often stumble upon malicious samples that have been'packed'. This technique/concept can be unfamiliar tothe aspiring malware reverser or digital forensic investigator, so I thought itwould be fun to use this opportunity to talk about portable executable (PE) packersat a high level. If you already know what PE packers are and how they work,you're more than welcome to continue reading, however it's certainly possibleyou may not learn something new. Think of this as a 101 blog post..

2. Creating Your Very Own x64 PE Packer/Protector from Scratch using C++

This article brings you a very detailed but easy to learn experience on creating your own x64 PE packer/protector using only VC++!.

3. Creating Shellcode from any Code Using Visual Studio and C++

Learn how to convert any code to a stable shellcode using Visual Studio 2019 and VC++ in easy steps!.

4. Protecting .NET 4.+ Application By C++ [Unmanaged]

Inject your 4.5 framework .NET application into a C++ unmanaged host application - fast, secure & without any extra tool or library..

5. Art of Anti Detection 3 – Shellcode Alchemy

This article will deal with basic shellcoding and similar concepts, assembly level encoder/decoder design and few methods for bypassing anti exploit solutions such as Microsoft’s Enhanced Mitigation Experience Toolkit(EMET). .

6. Art of Anti Detection 1 – Introduction to AV & Detection Techniques

This blog post will explain effective methods for bypassing the static, dynamic and heuristic analysis of up to date anti virus products. Some of the methods are already known by public but there are few methods and implementation tricks that is the key for generating FUD (Fully Undetectable) malware, also the size of the malware is almost as important as anti detection, when implementing these methods i will try to keep the size as minimum as possible. this paper also explains the inner workings of anti viruses and windows operating system, reader should have at least intermediate C/C++ and assembly knowledge and decent understanding of PE file structure..

7. Art of Anti Detection 2 – PE Backdoor Manufacturing

This paper will explain several methods used for placing backdoors in PE (Portable Executable) files for red team purposes, in order to fully grasp the content of this paper, readers needs to have at least intermediate x86 assembly knowledge, familiarity with debuggers and decent understanding of PE file format..

8. Art of Anti Detection 4 – Self-Defense

Throughout the Art of Anti Detection series we have mainly looked at methods for bypassing automated security products, but in this part we will focus on several self-defense methods for protecting our foothold on the target machines against actual users. These users may be technically insufficient employees or they may be blue team members in a cyber incident division of a company. Our goal is to stay alive and hide our presence inside the target system without having any privileges. But before getting deeper i advise you to read the previous articles of this series, because these methods will include a lot of shellcoding and API hooking thus requires prior knowledge. Now lets get to it !.

9. Introducing New Packing Method: First Reflective PE Packer Amber

Because of the increasing security standards inside operating systems and rapid improvements on malware detection technologies today’s malware authors takes advantage of the transparency offered by in-memory execution methods. In-memory execution or fileless execution of a PE file can be defined as executing a compiled PE file inside the memory with manually performing the operations that OS loader supposed to do when executing the PE file normally. In-memory execution of a malware facilitates the obfuscation and anti-emulation techniques. Additionally the malware that is using such methods leaves less footprints on the system since it does not have to possess a file inside the hard drive. Combining in-memory execution methods and multi stage infection models allows malware to infect systems with very small sized loader programs; only purpose of a loader is loading and executing the actual malware code via connecting to a remote system. Using small loader codes are hard to detect by security products because of the purpose and the code fragments of loaders are very common among legitimate applications. Malware that are using this approach can still be detected with scanning the memory and inspecting the behaviors of processes but in terms of security products these operation are harder to implement and costly because of the higher resource usage (Ramilli, 2010[1])..

10. czs108/PE-Packer

PE-Packer is a simple packer for Windows PE files. The new PE file after packing can obstruct the process of reverse engineering..

11. Writing a PE packer – Intro

This is a tutorial to program a PE packer : we will learn about the PE file format, headers and the inner workings of loading and packing binaries.

12. Writing a PE packer – Part 2 : imports and relocations

This is the part 2 of our tutorial to write a PE packer on Windows : handling imports and relocations, to execute an ASLR enabled file..

13. Writing a PE packer – Part 3 : packing with python

We have everything ready to do the actual packing of an ASLR enabled PE32 file. We’ll turn our loader in an unpacking stub, and use python to create a packed binary.

14. Writing a PE packer – Part 4 : packing with no relocation

At the end of the last part, I drawed your attention toward the fact that Mingw32 doesn’t produce movable binaries: it cannot create relocation table. You can force it to put the “Dll can move” flag, but without a relocation table, this binary would not work. We are going to change our packer to handle such non movable binaries..

15. Writing a PE packer – Part 5 : simple obfuscation

In this tutorial, we are going to complete our packer with some very basic obfuscation, as a demonstration of the possibilities we have..

16. Executable compression

Executable compression is any means of compressing an executable file and combining the compressed data with decompression code into a single executable. When this compressed executable is executed, the decompression code recreates the original code from the compressed code before executing it. In most cases this happens transparently so the compressed executable can be used in exactly the same way as the original. Executable compressors are often referred to as "runtime packers", "software packers", "software protectors" (or even "polymorphic packers" and "obfuscating tools")..

17. What it takes to write a simple PE file packer from scratch?

I was wondering to ask here what it takes to write a tiny simple packer for PE files? I know how a PE file looks like but not in accurate details (if necessary I'll learn as much as it takes) and I know C/C++ and assembly but not as much as a pro..

Good Try to Donate!

18. Exeinfo PE for Windows by A.S.L.

donate to give a try.

19. Exeinfo PE for Windows by A.S.L.

after donation, we can become a VIP. and download it from github from here.

20. two questions about writing executable file packer

I am trying to write my first PE packer with C++ , i studied about PE quite well and now i want to begin write my stub in pure assembly but i have two questions..

21. phil993 / PE-Crypter

PE-Crypter.

22. huntergregal/peCrypter

huntergregal/peCrypter.

23. Eronana / packer

This is a packer for exe under win32. You can use it to pack any 32-bit exe file..

24. UPX

UPX (Ultimate Packer for Executables) is an open source executable packer supporting a number of file formats from different operating systems.[3][4]

25. upx/README.SRC

The UPX Hacker's Guide

Examples to dive

26. Obsidium Product Information

Obsidium is available for 32-bit (x86) and 64-bit (x64) Windows systems. While mostly identical, there are some minor differences. Please refer to this page for a comparison of the two versions.

The 32-bit version and any protected executables it generates are fully compatible with any NT-based1 Windows operating system ranging from Windows NT 4 SP6 to Windows 10 (both 32- and 64-bit versions). It only supports protection of 32-bit executables..

27. Top 13 popular packers used in malware

Malware can wreak havoc on just about any system, and packers help malware stay one step ahead of security software. But what exactly do packers do? How can they be detected? And finally, what are some of the most popular packers used in malware today? .

28. Write Your Own Unpacker

This tutorial talks about writing a generic unpacker easily in 10 lines using pokas x86 Emulator.

1. UPX 2.FSG, 3.MEW, 4.Aspack, 5. PECompact, 6. Morphine

29. Protection Schemes Based on Virus Survival Techniques

A Survey of Virus Survival Techniques Applied to Protection Schemes.

30. Automated PE32 Threat Classification using Import Table and Deep Neural Networks

In this research, we are going to prove that Import Address Table is very helpful in classifying a malware..

31. How to make your own 100% FUD crypter with C++

I'm not going to explain a completely new method of how executables can be made FUD. I guess most of the public available crypters do it similarly. But the problem with those crypters is that they get detected very soon after they were published. So I figured out a way to write my own crypter in C++. In this tutorial I'm going to explain how you can implement your own crypter and how you can play around with the code to get your exe FUD again if it gets detected some day..

32. 100% evasion - Write a crypter in any language to bypass AV

This is a paragraphToday I will be showing you how to write your own crypter in any language you want. I will be using an earlier in-development version of my recently released free and open-source PowerShell crypter Xencrypt as the basis for my examples (and that’s the tool you see in action in the screenshot above) as I walk you through how to design and implement your own crypter. The purpose of this article is to discuss it at a high enough level that you can take the ‘design principles’ and apply them to any language that you want and make your own, though you’re free to follow along in PowerShell if you care to..

33. A Cookbook To Your Very Own Crypter™

In this guide, I will go through what elements you need to make your very own crypter. This is a very simple process, and the reason it is not documented very well is because of the masses of money people make from them. If everyone knew how to make one, there wouldn't be a market for it. So, I am here to half kill that market, per say..

34. Community-Articles/CookbookToYourOwnCrypter.pdf

a cookbook for your own cryptor.

35. HOW TO MAKE YOUR OWN CRYPTER IN C

I have seen lots of people asking for a c/c++ runtime crypter, most answers point to general guidance or worse, nothing of importance. So I’ve decided to show step by step a solution to creating your own crypters..

36. Basics - How to make a crypter.pdf - How to Code an FUD...

download this PDF to read.

37. [C#] A Simple Runtime Crypter

I think everyone of you has had the dream of building his own crypter; I know I have (for about a year, now)..

38. creating your own cryptor

creating your own cryptor.

39. Crypters tutorial for Hackers by Hackingloops

Crypters are computer applications which are solely used to bypass the antivirus detection of malwares. Hackers use crypters to hide viruses, Trojans, RATS, keyloggers and other hack tools into a new executable, whose sole purpose is to bypass the detection of the same from antivirus. Crypters are basically dead programs which does not affect the actual functionality of the program, they just spoof the actual program behind their encryption and make antivirus fool. Most antivirus detects viruses on basis of heuristics and normal string based detection. Since we have spoofed the original program, so antivirus stand lame and does not detect it as virus..

40. metablaster / BasicCrypter

Basic Crypter source code Tutorial by Subotai Info: This is just a simple noob-friendly source code of crypter to get you started with making your own crypters. Please note that this is just a "skeleton" of a crytpter, having only the bare-minimum that a crypter needs in order to be functional. Anything on top of that, including the encryption, you have to add. Also, keep in mind that you are building the crypter file (that you can run), not a builder that generetes crypted files. .

41. How to make money using your fud crypte

Kaspersky Antivirus -Clean. So to clarify, the fact that from all the other Crypters being distributed that for example that use a specific method of execution using a specific api which has slight relation to how your.

42. C++ Runtime Crypter

Tutorial on the structure of writing a runtime crypter in C++.

Misc.

43. CyberGod - An Antivirus in C++ for Windows and Android(Java)

CyberGod KSGMPRH is an open source antivirus which is designed to work under Windows operating system. It comes with a DOS Engine helping developers to customize the anti-virus engine as they please..

44. A Cessna Skyhawk Skeleton for Further Development in OpenGL (GLUT)

A Cessna Skyhawk Skeleton for further development in OpenGL (GLUT) using a Win32 Console.