Forum Discussion

kevinh's avatar
kevinh
Bronze III
1 hour ago

Powershell Deobsfuscation Ep.7

 

I first collected the .ps1 script 

and noticed that it is from hex

after decoding from hex 

 I noticed that it converts from decimals

This led me to use the from the from decimal recipe from Cyberchef

However, this led me towards only the decoded eding of the script itself.

with the main obfuscated payload being empty. 

I am wondering about where I am going wrong in my thought process.

No RepliesBe the first to reply