Skip to content

Instantly share code, notes, and snippets.

What would you like to do?
Learning Aid - Top Base64 Encodings Table

Learning Aid - Top Base64 Encodings Table

Base64 Code Mnemonic Aid Decoded* Description
JAB 🗣 Jabber $. Variable declaration (UTF-16)
TVq 📺 Television MZ MZ header
SUVY 🚙 SUV IEX PowerShell Invoke Expression
SQBFAF 🐣 Squab favorite I.E. PowerShell Invoke Expression (UTF-16)
SQBuAH 🐣 Squab uahhh I.n. PowerShell Invoke string (UTF-16) e.g. Invoke-Mimikatz
PAA 💪 "Pah!" <. Often used by Emotet (UTF-16)
cwBhA 🦁 Chewbaka s.a. Often used in malicious droppers (UTF-16) 'sal' instead of 'var'
aWV4 😲 Awe version 4 iex PowerShell Invoke Expression
aQBlA 💦 Aqua Blah (aquaplaning) i.e. PowerShell Invoke Expression (UTF-16)
R2V0 🤖 R2D2 but version 0 Get Often used to obfuscate imports like GetCurrentThreadId
dmFy 👹 defy / demonify var Variable declaration
dgBhA debugger + high availability v.a. Variable declaration (UTF-16)
dXNpbm Dixon problem usin Often found in compile after delivery attacks
H4sIA 🚁 HForce (Helicopter Force) I agree gzip magic bytes (0x1f8b), e.g. echo 'test' | gzip -cf | base64
Y21k 🎆 Year 21k bug cmd As used in cmd.exe /c wscript.exe or the like
IAB 🥱 I am bored s wide lower case s, often something like sEt-iTem
cABhAH 🕋 Kaaba p.a. wide formatted param
Qzpc 🖥 Quiz PC C:\ Root of Windows partition (upper case)
Yzpc 🖥 Yes PC c:\ Root of Windows partition (lower case)
UEs 🏬 Upper East Side PK ZIP, Office documents
ey 🗣 Hey {  Indicates JSON data

* the . stands for 0x00

Cyber Chef Recipe'%5C%5Cn','%5C%5Cn',false)From_Base64('A-Za-z0-9%2B/%3D',true)&input=SkFCClRWcQpQQUEKU1VWWQpTUUJGQUYKYVdWNAphUUJsQQpSMlYwCmRtRnkKZGdCaEEKY3dCaEEKZFhOcGJtCkg0c0lBRldXc2wwQUF5dEpMUzdoQWdER05iazdCUUFBQUE9PQ



Tweet and Thread



Emotet process command line





This comment has been minimized.

Copy link

@srcr srcr commented Oct 15, 2020

should MITRE ATT4CK be changed to MITRE ATT&CK? Very nice list though. Danke


This comment has been minimized.

Copy link
Owner Author

@Neo23x0 Neo23x0 commented Oct 15, 2020

I'll remove the MITRE reference completely. Don't want that anyone tells me that it lacks a (r) character.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
You can’t perform that action at this time.