Skip to content

Instantly share code, notes, and snippets.

@mak
Created July 21, 2020 11:53
Show Gist options
  • Star 0 You must be signed in to star a gist
  • Fork 0 You must be signed in to fork a gist
  • Save mak/26e513a38a959d9a07631d2f47b94ca7 to your computer and use it in GitHub Desktop.
Save mak/26e513a38a959d9a07631d2f47b94ca7 to your computer and use it in GitHub Desktop.
decode some powershell malware from image
ret = [ 0 for _ in range(40000)]
for i in range(26):
for j in range(800):
try:
px = img.getpixel((j,i))
except:
continue
ret[i * 800 + j ] = math.floor((px[2] & 0xf ) * 4 * 4 ) | (px[1]&0xf)
with open('x.ps1','w') as f: f.write(''.join(map(chr,filter(None,ret))))
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment