Threat Hunting: Investigating a Fake PoC Q9

Question

I am having issues trying to solve this last question.
After running some obfuscated Powershell commands, the program outputs either a success or a failure message. What command is executed that sets the value of the "text" variable within the "main" function? Any tip?

Thanks

netcat · Accepted Answer

Assuming you solved the previous questions, found the main function:Locate the row with "text = foo.bar()" and enter "foo.bar()". Too easy.

Forum Discussion

Threat Hunting: Investigating a Fake PoC Q9

2 Replies

Featured Places

Help

Related Content

Threat Hunting Mining Behaviour - Question 1

FIN7 Threat Hunting with Splunk: Ep.3 – Execution Logs

Help needed for Threat Hunting: Mining Behaviour

Help needed for Threat Hunting - Credential Access

APT29 Threat Hunting with Splunk: Ep.4 – Clean-up & Reconnaissance

Recent Discussions

Modern Encryption: Demonstrate Your Skills

Windows Basics: Demonstrate your knowledge Q11.

Python Scripting for Malware Analysis: Ep.4 – Static Analysis of Cryptographic Algorithms matplotlib problem

Wizard Spider DFIR: Ep.9 – Sigma

Modern Maze