Forum Discussion
Powershell Deobsfuscation Ep.7
It looks like you're on the right track by identifying the layer of decimal conversion, but running the From Decimal recipe on the entire PowerShell wrapper script is causing CyberChef to break or output empty data.
To proceed, look closely at how the script handles the massive data arrays—specifically the strings broken into sections like 1: [STRING]::Join(...) and 2: [STRING]::Join(...). You need to isolate just the raw, comma-separated decimal numbers of the main payload from those specific variables, strip out the PowerShell code, and pass only those numeric values into your CyberChef recipe.
Community ManagerIt looks like you're on the right track by identifying the layer of decimal conversion, but running the From Decimal recipe on the entire PowerShell wrapper script is causing CyberChef to break or output empty data.
To proceed, look closely at how the script handles the massive data arrays—specifically the strings broken into sections like 1: [STRING]::Join(...) and 2: [STRING]::Join(...). You need to isolate just the raw, comma-separated decimal numbers of the main payload from those specific variables, strip out the PowerShell code, and pass only those numeric values into your CyberChef recipe.
