Skip to content

Releases: ProcessusT/LoadThat-PEandAssembly

Word Dictionary Edition

02 Apr 05:55

Choose a tag to compare

This release introduces a polymorphic PE loader embedding a mimikatz x64 payload encoded via a 10,000-word English dictionary.
Each byte is mapped to a unique word, split into randomly-sized shuffled chunks, and reconstructed at runtime.

Improvements over previous editions:

  • Word dictionary byte encoding — defeats static pattern matching
  • Polymorphic chunking — random chunk sizes & shuffled order
  • SHA-256 Proof-of-Work (~40–50s) — bypasses sandbox timeouts
  • Stack strings — sensitive API names built char-by-char at runtime
  • Full identifier randomization — unique binary on every generation
  • PE metadata spoofing — MSVC linker, randomized timestamp, Rich header wiped
  • Authenticode signature theft — borrowed from PsExec64
  • Dynamic API resolution — no suspicious imports

Disclaimer: This release is purely for educational and research purposes. Use responsibly.