search

Malandrone / PowerDecode

PowerDecode is a PowerShell-based tool that allows to deobfuscate PowerShell scripts obfuscated across multiple layers. The tool performs code dynamic analysis, extracting malware hosting URLs and checking http response.It can also detect if the malware attempts to inject shellcode into memory.
GNU General Public License v3.0
160 stars 14 forks source link

Fantastic idea but execution is buggy #1

Closed krsecurity closed 2 years ago

krsecurity commented 2 years ago

Hi,

First off, fantastic idea and I hope this is successful as I'm sure it will be.

However, it seems like it doesn't support a number of different obfuscating techniques, such as character replacement via variables or it doesn't appear to interpret ampersands correctly etc PowerDecode_report_94e0dfb6-898b-4000-8199-f804f9017a5a.txt

Appreciate feedback, willing to help improve the tool. P.S. I've just attached one example but there's others.

Thanks

Malandrone commented 2 years ago

Thanks a lot for the feedback! In order for a script to be successfully de-obfuscated by PowerDecode, there must be no errors in the code. In this case, code contains some errors that trigger at runtime: 1-iex's argument is not specified correctly img2

2-"\" string there must not be at the end img1

Applying these corrections to the script, PowerDecode generates this report: PowerDecode_report_32c25eb9-eedc-4296-9797-943b4fb8ec0d.txt As you can see, 2 obfuscation layers have been removed. The last layer contains plaintext PowerShell code, but some instructions are hidden in variables. PowerDecode actually does not handle these cases on the automatic mode, but I am thinking of a solution to automatically replace variable names with their contents.