Locked PSDecode v5.0 - Deobfuscating encoded PowerShell scripts

[itsMe]

PSDecode

This is a PowerShell script for deobfuscating other encoded PowerShell scripts. Often, malicious PowerShell scripts have several layers of encodings (Replace, Base64Decode, etc…) that, once decoded, are executed via a call to Invoke-Expression (IEX, &, .), Invoke-Command, etc… This script employs a technique called method overriding that enables us to essentially intercept calls to functions that I have accounted for within this script and print out the arguments being passed to it (a.k.a what the script was trying to execute).

** Important Note #1: Only run this script within an isolated sandbox. If the encoded PowerShell attempts to execute a function which I have not accounted for, there is a chance it could execute**

** Important Note #2: The default execution policy for PowerShell is Restricted and if you don’t use PowerShell a lot, chances are when you go running this script, it will give you an error stating “PSDecode cannot be loaded because the execution of scripts is disabled on this system”. If you receive this message, you’ll need to change your execution policy to Unrestricted either temporarily or permanently. The simplest way is to open a PowerShell command prompt as Administrator and run: set-executionpolicy unrestricted**

Changelog v5.0

    PowerShell Core Support. Can now run PSDecode on Linux. Tested with PowerShell Core v6.2.3 on Ubuntu 19.04. It should also work on MacOS but this has not been tested. Issue #8
    Improved regex for string replace resolution function

This is the hidden content, please

• Sign In
• or
• Sign Up