+- Hack Forums (https://hackforums.net)
+-- Forum: Hacks, Exploits, and Various Discussions (https://hackforums.net/forumdisplay.php?fid=45)
+--- Forum: Blackhat • Red Team • Offensive Security (https://hackforums.net/forumdisplay.php?fid=447)
+---- Forum: Cryptography, Encryption, and Decryption (https://hackforums.net/forumdisplay.php?fid=126)
+---- Thread: [Free] Polymorphic PE Crypter x86/x64, no runtime deps, unique output per build (/showthread.php?tid=6331228)
Pages: Pages
1
2
[Free] Polymorphic PE Crypter x86/x64, no runtime deps, unique output per build - rspower - Sep 1, 2026
Hey,
free crypter written in C (no .NET, no C++ bloat). Goal is keeping
payloads clean vs AV/ML, every build produces a different binary, so static
signatures and hash DBs don't stick.
updates 2026-09-20
- payload is deflate-compressed before AES -> noticeably smaller output
- stub body now decodes out-of-place into a private scratch buffer:
the image's own code section is never made writable at runtime
(no RW->RX transition on the image section)
- stub body is XOR-encoded + opcode-varianted per build, not just the blob
- import table reduced to 6 kernel32 entries, the rest resolved via
GetProcAddress at runtime
- scantime hardening: entry point in .text, plausible section names,
randomized magics + PE header fields, random section padding
- anti-analysis: added PEB module-count sandbox heuristic (soft score)
- tempfile fallback now delete-on-close, minimal on-disk window
- build survives local AV quarantine (unique output names per run, retry)
features
- x86 + x64, and the 64-bit CLI can protect 32-bit targets (cross-arch)
- polymorphic: random section names, random AES-256 key/IV, junk-code +
opcode/register shuffling -> output is unique every run (diff two builds)
- AES-256-CBC on the payload (deflate-compressed first), high entropy,
no plaintext strings in the section
- zero runtime deps: static, only 6 kernel32 imports in the IAT,
no VCRUNTIME/MSVCP/UCRT — the protected EXE only needs the OS
- RWX split: code section [R,X] + data section [R,W], no single RWX block to flag
- runs the payload in-memory through the real Windows loader,
tempfile fallback if that path fails
- IAT + base-relocation fixup at runtime
- basic anti-analysis (debugger / hypervisor / module-count heuristics)
- GUI + CLI, no config, no license, no backdoors
https://antiscan.me/scans/ead5ed35-44f7-40d3-a14f-a218d389e29c
Never upload the stub to VirusTotal!
usage
- cli: prot.exe [-no-anti] <input.exe> [output.exe]
- gui.exe: drop the EXE, hit protect
feedback / bug reports welcome, PM me if something's off
[attachment=2438]
RE: [Free] Polymorphic PE Crypter x86/x64, no runtime deps, unique output per build - ryryh4ck - Sep 1, 2026
100 bytes dont Is free
RE: [Free] Polymorphic PE Crypter x86/x64, no runtime deps, unique output per build - rspower - Sep 2, 2026
(Sep 1, 2026 09:17 PM)ryryh4ck Wrote: 100 bytes dont Is free
skid protection
RE: [Free] Polymorphic PE Crypter x86/x64, no runtime deps, unique output per build - missionstatements - Sep 2, 2026
Willing to try it out. I am interested
RE: [Free] Polymorphic PE Crypter x86/x64, no runtime deps, unique output per build - seuq - Sep 3, 2026
gonna try it out. ty
RE: [Free] Polymorphic PE Crypter x86/x64, no runtime deps, unique output per build - cybervirus - Sep 10, 2026
Good Thanks a lot
How do I download it?
RE: [Free] Polymorphic PE Crypter x86/x64, no runtime deps, unique output per build - HaykHaykHayk - Sep 12, 2026
this is really interesting
RE: [Free] Polymorphic PE Crypter x86/x64, no runtime deps, unique output per build - rspower - Sep 14, 2026
Update:
Changelog (2026-09-14)
AV-Evasion Hardening, Deflate Payload, Build Resilience
Deflate Payload
New raw DEFLATE (RFC 1951) without zlib/GZIP wrapper.
Payload gets compressed before AES if it saves space; stub decompresses after AES.
Scan-Time Hardening
Plausible section names instead of random ones.
Entry point stays in .text; blob section is named .text.
Random padding, randomized magic, varied PE header per build.
Per-build instruction variants in stub body; smaller BSS path buffer.
Scattered API Resolution
Blob and stub resolve several APIs via LoadLibraryA + GetProcAddress.
IAT fallback remains if needed.
Anti-Debug (Soft)
PEB module count adds sandbox score if too few modules. No hard bail.
Tempfile Trace
Windows loader path deletes the file right after CreateProcessW.
RE: [Free] Polymorphic PE Crypter x86/x64, no runtime deps, unique output per build - CyberXero - Sep 14, 2026
Quite Interesting !
My laptop isn't at my fingertips right now so I am gonna bookmark this for now 😄
RE: [Free] Polymorphic PE Crypter x86/x64, no runtime deps, unique output per build - rspower - Sep 14, 2026
atm I am working on an auto-spreading worm (Discord, Telegram, LAN, USB, and email spreader) based on the Stuxnet source code. I will release an alpha version soon
RE: [Free] Polymorphic PE Crypter x86/x64, no runtime deps, unique output per build - CyberXero - Sep 14, 2026
(Sep 14, 2026 03:57 AM)rspower Wrote: atm I am working on an auto-spreading worm (Discord, Telegram, LAN, USB, and email spreader) based on the Stuxnet source code. I will release an alpha version soon
That's cool !
Keep us posted, will check back here laterrr
RE: [Free] Polymorphic PE Crypter x86/x64, no runtime deps, unique output per build - Unknown2027 - Sep 16, 2026
Thank you
RE: [Free] Polymorphic PE Crypter x86/x64, no runtime deps, unique output per build - drugsandmoney - Sep 17, 2026
thanks will check out.
RE: [Free] Polymorphic PE Crypter x86/x64, no runtime deps, unique output per build - rimpk901 - Sep 17, 2026
thx i try this
RE: [Free] Polymorphic PE Crypter x86/x64, no runtime deps, unique output per build - rspower - Sep 20, 2026
Changes:
- The stub body no longer decodes in place. At runtime the polymorphic blob now
copies the encoded body out of the image's .text into a private VirtualAlloc
scratch buffer (code RX, data RW), decodes it there, and jumps into it.
In-place decode remains as fallback if the alloc fails.
=> The image's own code section is never set writable at runtime again
no more RW->RX transition on the image section (WriteWatch /
ProcessWriteCache heuristics).
- All stub data (API resolution, strings, hoisted globals, kernel32/
GetProcAddress refs) is now routed through a single g_ctx structure in .data,
reached via one anchor pointer. The decoded body no longer touches the IAT,
.rdata or .data directly.
=> Import table shrunk to 6 kernel32 entries.
- The g_ctx magic and its string literals are randomized per build (same
scheme as the skeleton-table magic), so cross-build pattern matching
against the context block no longer works.
- AES/deflate lookup tables (sbox/rsbox/rcon, huffman tables) moved behind
UD for Windows Defender atm runtime and scantime