[Edward]

This crypter is different because instead of creating a new proces and then do the PE injection to memory etc it will execute the code it its own proces instead.

Allocates the amount of memory needed for the image
Then rebases(relocates) the image to the new imagebase wich is the memory allocated above, so your PE has to have a working relocation table
Processes the imports
Replaces the imagebase in the PEB to our supposed new one, so that the PE could get its own resources and stuff.
And then calls the entry point of the PE

it has a few detections on NVT(yes I scan on NVT, deal with it.) I guess its due to resource handling api's and GPA/LL combo wich is needed to proces the imports

The only thing that that might be a problem is that the proces doesn't use tls callbacks.

Download:
here

[Charon]

Nice share, this will be really useful for those who want to make a crypter in C++!

[Nefarious]

Thank you for this! Very nice share.

[antifascist]

"File Belongs to Non-Validated Account."

[Edward]

Sorry, I lost access to that account. I'll have the thread closed.

[Charon]

Closing the thread.