VX API
1.0.0
Gestionado por VX-Unterground | Síganos en Twitter | Descargue muestras de malware en la página VXUG/Muestras
Versión: 2.01.015
Desarrollador: Smelly__vx
El VX-API es una colección de funcionalidad maliciosa para ayudar en el desarrollo de malware. Se recomienda clonar y/o descargar este repositorio completo, luego abra el archivo de solución de Visual Studio para explorar fácilmente la funcionalidad y los conceptos.
Algunas funciones pueden depender de otras funciones presentes dentro del archivo de solución. El uso del archivo de solución proporcionado aquí facilitará la identificación de qué otra funcionalidad y/o datos de encabezado se requieren.
Eres libre de usar esto de cualquier manera que desee. No necesita usar toda esta solución para su prueba de concepto de malware o compromisos de equipo rojo. Desplárese, copie, pegue, elimine o edite los contenidos de estos proyectos tanto como desee.
| Nombre de función | Autor original |
|---|---|
| AdfcloseHandleonInValidaddress | Investigación de punto de control |
| AdFiscreateProcessDebugeVentCodeset | Investigación de punto de control |
| Adfopenprocessoncsrss | Investigación de punto de control |
| CheckremotedebuggerPresent2 | Reactos |
| IsdebuggerPresentEx | maloliente__vx |
| ISintelHardwareBreakPointPresent | Investigación de punto de control |
| Nombre de función | Autor original |
|---|---|
| Hashstringdjb2 | Dan Bernstein |
| Hashstringfowlernollvovariant1a | Glenn Fowler, Landon Curt Noll y Kiem-Phong VO |
| Hashstringjenkinsoneatatime32bit | Bob Jenkins |
| Hashstringloselose | Brian Kernighan y Dennis Ritchie |
| Hashstringrotr32 | T. Oshiba (1972) |
| Hashstringsdbm | Ozan Yigit |
| Hashstringsuperfasthash | Paul Hsieh |
| Hashstringunknowngenerichash1a | Desconocido |
| Hashstringsiphash | Ristbs |
| Muesca | Ristbs |
| Createmd5hashFromFilepath | Microsoft |
| Createpseudorandominteger | Apple (c) 1999 |
| Createpseudorandomstring | maloliente__vx |
| HashfileBymsifilehashtable | maloliente__vx |
| CreatePseudorAndomInTegerFromntdll | maloliente__vx |
| Lzmaximumcompressbuffer | maloliente__vx |
| Lzmaximumdecompressbuffer | maloliente__vx |
| Lzstandardcompressbuffer | maloliente__vx |
| LzSandardDecompressBuffer | maloliente__vx |
| Xpresshuffmaximumcompressbuffer | maloliente__vx |
| Xpresshuffmaximumdecompressbuffer | maloliente__vx |
| Xpresshuffstandardcompressbuffer | maloliente__vx |
| XpresshuffStandardDecompressBuffer | maloliente__vx |
| Xpressmaximumcompressbuffer | maloliente__vx |
| Xpressmaximumdecompressbuffer | maloliente__vx |
| Xpressstandardcompressbuffer | maloliente__vx |
| XpressStandardDecompressBuffer | maloliente__vx |
| ExtractFilesFromCabInToTarget | maloliente__vx |
| Nombre de función | Autor original |
|---|---|
| GetLasterrorFromteB | maloliente__vx |
| GetlastntstatusFromteB | maloliente__vx |
| RtlntstatustodosErrorviaimport | Reactos |
| GetLasterrorFromteB | maloliente__vx |
| SetLasterrorInteb | maloliente__vx |
| Setlastntstatusinteb | maloliente__vx |
| Win32 de la vida | Raymond Chen |
| Nombre de función | Autor original |
|---|---|
| Amsibypassviapatternscan | Zeromemoryex |
| DeletedEdExecutionExecuteDoSplaYoff | Am0nsec y Smelly__vx |
| HookEnginerestoreheapFree | RAD9800 |
| Masqueradepebasexplorer | maloliente__vx |
| Eliminlllfrompeb | RAD9800 |
| Removeregisterdllnotificación | Rad98, Peter Winter-Smith |
| Sleepobfuscationviavirtualprotect | 5pider |
| Rtlsetbaseunicodecommandline | Thewover |
| Nombre de función | Autor original |
|---|---|
| GetCurrentLocaleFromteB | 3xp0rt |
| GetNumberOfLinkeddlls | maloliente__vx |
| Getosbuildnumberfrompeb | maloliente__vx |
| Getosmajorversionfrompeb | maloliente__vx |
| GetosminorversionfromBeB | maloliente__vx |
| GetOSPlatformIDFrompeB | maloliente__vx |
| Isnvidiagraphicscard presente | maloliente__vx |
| ISProcoSrunning | maloliente__vx |
| IsProcessRunningAsadmin | Vimal shekar |
| GetPIDFromNcterySystemInformation | maloliente__vx |
| GetpidFromWindows terminalservice | moderno |
| GetPIDFromWMiComIinterface | Aalimian y Modexp |
| PROCESOS DE GETPIDFROMENUM | maloliente__vx |
| Getpidfrompidbruteforcing | moderno |
| GetPIDFromNTQueryFileInformation | Modexp, Lloyd Davies, Jonas Lyk |
| GetpidfrompidbruteforcingExw | Smelly__vx, Lloyd Davies, Jonas Lyk, Modexp |
| Nombre de función | Autor original |
|---|---|
| CreateLocalAppDataObjectPath | maloliente__vx |
| Createwindowsobjectpath | maloliente__vx |
| GetCurrentDirectoryFromUSerProcessParameters | maloliente__vx |
| GetCurrentProcessidFromteB | Reactos |
| GetCurrentusersid | Giovanni Dicanio |
| GetCurrentWindowTextFromUSerProcessparameter | maloliente__vx |
| GetFilesizefrompath | maloliente__vx |
| GetProcessheapFromteB | maloliente__vx |
| GetProcesspathFromLoCeaderLoadModule | maloliente__vx |
| GetProcessPathFromUSerProcessParameters | maloliente__vx |
| GetSystemWindowsDirectory | Geoff Chappell |
| Ispathvalid | maloliente__vx |
| FildFile recursivo | Luque |
| SetProcessPrivileGetoken | Microsoft |
| ISDLLOLOGADO | maloliente__vx |
| TryloadDllMultiMethod | maloliente__vx |
| Createthreadandwaitfortcompletion | maloliente__vx |
| GetProcessbinaryNameFromHwndw | maloliente__vx |
| GetBytearrayFromFile | maloliente__vx |
| Ex_gethandleondevicehttpcommunication | x86matthew |
| ISREGISTRISTRYKEKEVALID | maloliente__vx |
| FastcallexCuteBinaryShellexCuteEx | maloliente__vx |
| GetCurrentProcessidFromOffset | Ristbs |
| Getpebaseaddress | maloliente__vx |
| LDroadgetProcedureAddress | c5pider |
| Ispesección | maloliente__vx |
| AddSectiontopeFile | maloliente__vx |
| Writedatatopesection | maloliente__vx |
| GetPesectionSizeInbyte | maloliente__vx |
| ReadDatafrompeSection | maloliente__vx |
| GetCurrentProcessnoforward | Reactos |
| GetCurrentThreadnoforward | Reactos |
| Nombre de función | Autor original |
|---|---|
| Getkusershareddata | Geoff Chappell |
| GetModuleHandleEx2 | maloliente__vx |
| Getpeb | 29a |
| Getpebfromteb | Reactos |
| GetProcaddress | 29A Volumen 2, C5pider |
| GetProcaddressDJB2 | maloliente__vx |
| GetProcaddressfowlernollvovariant1a | maloliente__vx |
| GetProcaddressJenkinSoneatEtime32bit | maloliente__vx |
| GetProcaddressloselose | maloliente__vx |
| GetProcaddressrotr32 | maloliente__vx |
| GetProcAddresssdbm | maloliente__vx |
| GetProcaddressSuperfasthash | maloliente__vx |
| GetProcaddressUnknownGenerichash1 | maloliente__vx |
| GetProcaddressSiphash | Ristbs |
| GetProcaddressMurmur | Ristbs |
| Getrtluserprocessparameters | Reactos |
| Getteb | Reactos |
| Rtlloadpeheaders | maloliente__vx |
| Proxyworkitemloadlibrary | Rad98, Peter Winter-Smith |
| ProxyRegisterSwaitLoadLibrary | Rad98, Peter Winter-Smith |
| Nombre de función | Autor original |
|---|---|
| MpfgetlsapidfromserviceManager | moderno |
| MpfgetlsapidFromregistry | moderno |
| MpfgetlsapidfromnamedPipe | moderno |
| Nombre de función | Autor original |
|---|---|
| Urdownloadtofilesynchronous | Hans Passant |
| ConvertIPV4IPAdDressStructuretostring | maloliente__vx |
| ConvertIPV4StringTounSignedLong | maloliente__vx |
| Sendicmpechomessagetoipv4host | maloliente__vx |
| ConvertIPV4IPADDressUnsignedLongToString | maloliente__vx |
| DnsgetdomainnameIpv4AddressString | maloliente__vx |
| DnsgetdomainnameIpv4AddressUnsignedLong | maloliente__vx |
| GetDomainNameFromunSignedLongIPV4Address | maloliente__vx |
| GetDomainNameFromIPV4AddressString | maloliente__vx |
| Nombre de función | Autor original |
|---|---|
| Olegetclipboarddata | Microsoft |
| MPFCOMVSSDELETESHADOWVOLUMEBACKUPS | am0nsec |
| MPFCOMMOMTIFYSHORTCUTTARGET | Desconocido |
| MpfcommonitorCromesessiononce | maloliente__vx |
| MpfextractMaliciousPayLoadFromZipFilenOpassword | Codu |
| Nombre de función | Autor original |
|---|---|
| CreateProcessFromihxHelpPaneServer | James Forshaw |
| CreateProcessFromiHxInteractiveUser | James Forshaw |
| CreateProcessFromishellDispatchinvoke | Mohamed Fakroud |
| CreateProcessFromShellexCuteineExplorerProcess | Microsoft |
| CreateProcessViantCreateUserProcess | Capitán |
| CreateProcessWithCfguard | Solelly__vx y Adam Chester |
| CreateProcessByWindowsRhotkey | maloliente__vx |
| CreateProcessByWindowsRhotKeyex | maloliente__vx |
| CreateProcessFrominfSectionInstallStringNocab | maloliente__vx |
| CreateProcessFrominfSetUpCommand | maloliente__vx |
| CreateProcessFrominfSectionInstallStringNocab2 | maloliente__vx |
| CreateProcessFromieFRameOpenurl | maloliente__vx |
| CreateProcessfrompcwutil | maloliente__vx |
| CreateProcessFromShDocVWopenurl | maloliente__vx |
| CreateProcessFromShell32Shellexecrun | maloliente__vx |
| MpfExecute64bitpebinaryInmemoryFrombyTearrayNoreloc | aaaddress1 |
| CreateProcessFromWmiwin32_Processw | CIA |
| CreateProcessFromZipflDrroutecall | maloliente__vx |
| CreateProcessFromurlFileProTocolhandler | maloliente__vx |
| CreateProcessFromurlopenurl | maloliente__vx |
| CreateProcessfrommshtmlw | maloliente__vx |
| Nombre de función | Autor original |
|---|---|
| Mpfpicontrolinyección | Safebreach Labs |
| Mpfpiqueueuserapcviaatombomb | Safebreach Labs |
| MpfpiwriteProcessMemoryCreaterMotethread | Safebreach Labs |
| MpfprocessinyectionViaProcessflection | Instinto profundo |
| Nombre de función | Autor original |
|---|---|
| Iecreatefile | maloliente__vx |
| CopyFileviaSetupCopyFile | maloliente__vx |
| CreateFileFromdsCopyFromSharedFile | Jonas Lyk |
| Deletedirectoryandsubdataviadelnode | maloliente__vx |
| Eliminar el final de la creación | maloliente__vx |
| ISproCessRunningAsadmin2 | maloliente__vx |
| Iecreatedirectory | maloliente__vx |
| IEDELETEFILE | maloliente__vx |
| Iefindfirstfile | maloliente__vx |
| IEGETFILEATTRUTESEX | maloliente__vx |
| Iemovefileex | maloliente__vx |
| IEREMOVEDIRICTORY | maloliente__vx |
| Nombre de función | Autor original |
|---|---|
| MpfsceviaimmenuminputContext | Alfarom256, Aahmad097 |
| Mpfsceviacertfindchaininstore | Alfarom256, Aahmad097 |
| Mpfsceviaenumpropsexw | Alfarom256, Aahmad097 |
| MpfsceviAcreateThreadPoolwait | Alfarom256, Aahmad097 |
| Mpfsceviacrenumoidinfo | Alfarom256, Aahmad097 |
| Mpfsceviaga_enumCallback | Alfarom256, Aahmad097 |
| MpfsceviacreateTimerqueUetimer | Alfarom256, Aahmad097 |
| Mpfsceviaevtsubscribe | Alfarom256, Aahmad097 |
| Mpfsceviaflsalloc | Alfarom256, Aahmad097 |
| MpfsceviainitonceExecuteonce | Alfarom256, Aahmad097 |
| Mpfsceviaenumchildwindows | Alfarom256, Aahmad097, WRA7H |
| Mpfsceviacdeffoldermenu_create2 | Alfarom256, Aahmad097, WRA7H |
| Mpfsceviacertenumsystemstore | Alfarom256, Aahmad097, WRA7H |
| Mpfsceviacertenumsystemstorelocation | Alfarom256, Aahmad097, WRA7H |
| MpfsceviaenumdateFormatsw | Alfarom256, Aahmad097, WRA7H |
| Mpfsceviaenumdesktopwindows | Alfarom256, Aahmad097, WRA7H |
| Mpfsceviaenumdesktopsw | Alfarom256, Aahmad097, WRA7H |
| Mpfsceviaenumdirreew | Alfarom256, Aahmad097, WRA7H |
| Mpfsceviaenumdisplaymonitors | Alfarom256, Aahmad097, WRA7H |
| Mpfsceviaenumfontfamiliesexw | Alfarom256, Aahmad097, WRA7H |
| Mpfsceviaenumfontsw | Alfarom256, Aahmad097, WRA7H |
| Mpfsceviaenumlanguagegrouplocalesw | Alfarom256, Aahmad097, WRA7H |
| MpfsceviaenumObjects | Alfarom256, Aahmad097, WRA7H |
| Mpfsceviaenumresourcetypesexw | Alfarom256, Aahmad097, WRA7H |
| Mpfsceviaenumsystemcodepagesw | Alfarom256, Aahmad097, WRA7H |
| Mpfsceviaenumsystemgeoid | Alfarom256, Aahmad097, WRA7H |
| MpfsceviaenumsystemlanguageGroupsw | Alfarom256, Aahmad097, WRA7H |
| Mpfsceviaenumsystemlocalesex | Alfarom256, Aahmad097, WRA7H |
| Mpfsceviaenumthreadwindows | Alfarom256, Aahmad097, WRA7H |
| Mpfsceviaenumtimeformatsex | Alfarom256, Aahmad097, WRA7H |
| Mpfsceviaenumuilanguagesw | Alfarom256, Aahmad097, WRA7H |
| Mpfsceviaenumwindowstationsw | Alfarom256, Aahmad097, WRA7H |
| Mpfsceviaenumwindows | Alfarom256, Aahmad097, WRA7H |
| Mpfsceviaenumerateloadedmodules64 | Alfarom256, Aahmad097, WRA7H |
| MPFSCEVIAK32NUMPAGEFILESW | Alfarom256, Aahmad097, WRA7H |
| Mpfsceviaenumpwrschemes | Alfarom256, Aahmad097, WRA7H |
| MpfsceviaSageBoxIndirectw | Alfarom256, Aahmad097, WRA7H |
| Mpfsceviachoosecolorw | Alfarom256, Aahmad097, WRA7H |
| MpfsceviaclusworkerCreate | Alfarom256, Aahmad097, WRA7H |
| Mpfsceviasymenumprocesos | Alfarom256, Aahmad097, WRA7H |
| MpfsceviaiMageGetDigestStream | Alfarom256, Aahmad097, WRA7H |
| Mpfsceviaverifierenumerateresource | Alfarom256, Aahmad097, WRA7H |
| MpfsceviasymenumSourceFiles | Alfarom256, Aahmad097, WRA7H |
| Nombre de función | Autor original |
|---|---|
| BytearrayToCarArray | maloliente__vx |
| Chararraytobytearray | maloliente__vx |
| Shlwapicharstringtowartring | maloliente__vx |
| Shlwapiwcharstringtocharstring | maloliente__vx |
| CharstringTowCharstring | maloliente__vx |
| Wcharstringtocharstring | maloliente__vx |
| RtlinitemptyunicodeString | Reactos |
| RtlinitunicodeString | Reactos |
| Stribuzo | simular |
| Copymemoryex | Reactos |
| Securestringcopy | Apple (c) 1999 |
| StringCompare | Apple (c) 1999 |
| Stringconcat | Apple (c) 1999 |
| Stringcopy | Apple (c) 1999 |
| Stringfindsubstring | Apple (c) 1999 |
| Longitud de cuerda | Apple (c) 1999 |
| StringlocateChar | Apple (c) 1999 |
| Stremovesubstring | maloliente__vx |
| StringterMinateStringatchar | maloliente__vx |
| Stringtoken | Apple (c) 1999 |
| Zeromemoryex | Reactos |
| ConvertCharacterStringTointEgerUsingntdll | maloliente__vx |
| MemoryFindMemory | Kamilcuk |
| Nombre de función | Autor original |
|---|---|
| Uacbypassfodhelpermethod | Winscripting.blog |
| Nombre de función | Autor original |
|---|---|
| InithardwarebreakpointEngine | rad98 |
| ShutdownHardwareBreakPointEngine | rad98 |
| ExceptionHandlerCallbackRoutine | rad98 |
| Sethardwarebreakpoint | rad98 |
| InsertDescriptorEntry | rad98 |
| Eliminado | rad98 |
| SnapshotinserthardwarebreakpointThookInToToTargetThread | rad98 |
| Nombre de función | Autor original |
|---|---|
| GenicshellcodeHelloworldMessageBoxa | Safebreach Labs |
| GenicshellcodeHelloworldMessageBoxAbfbloop | Safebreach Labs |
| GenicshellcodeOpencalcexitThread | Msfvenom |
