Forum Discussion
kevinh
2 days agoBronze III
Powershell Deobsfuscation Ep.7
I first collected the .ps1 script and noticed that it is from hex after decoding from hex I noticed that it converts from decimals This led me to use the from the from decimal r...
SamDickison
Community Manager
9 hours agoIt looks like you're on the right track by identifying the layer of decimal conversion, but running the From Decimal recipe on the entire PowerShell wrapper script is causing CyberChef to break or output empty data.
To proceed, look closely at how the script handles the massive data arrays—specifically the strings broken into sections like 1: [STRING]::Join(...) and 2: [STRING]::Join(...). You need to isolate just the raw, comma-separated decimal numbers of the main payload from those specific variables, strip out the PowerShell code, and pass only those numeric values into your CyberChef recipe.